Suhayb Ahmed

Insufficient input sanitization and output escaping allow authenticated users with the Author role or higher to perform Stored Cross-Site Scripting (XSS). An attacker can upload a crafted SVG file containing JavaScript that is stored in a publicly accessible location and served from the site origin. The script executes in the browser of any user who opens the affected file.

Insufficient file path validation and a lack of capability or nonce checks on an AJAX action allow authenticated users with Subscriber level access and above to delete the backup directory. This action removes download protection from stored backups, disrupts backups currently in progress, and enables the deletion of arbitrary backup directories on the server.

An issue exists where a capability check is missing in an AJAX action. The nonce protecting this action is exposed to any user with access to the admin dashboard. This allows users with roles as low as Contributor to overwrite the tracking configuration, leading to the execution of arbitrary JavaScript in the browsers of all visitors, including administrators. A nonce is a unique token used to protect against cross-site request forgery (CSRF) attacks.

The plugin fails to invalidate a time-based one-time passcode after its initial use. This allows an attacker who possesses a user's password and has intercepted a valid code during its validity window to replay that code and bypass two-factor authentication, which can include access to administrator accounts.

Insufficient authentication verification on integration REST API endpoints occurs when the integration is unconfigured. This allows unauthenticated attackers to retrieve personal data of registered users, including `id`, `username`, `email address`, and `registration date`.

The template-import feature lacks Cross-Site Request Forgery (CSRF) checks and fails to sanitize imported data before storage and output. This allows an attacker to trick a logged-in administrator into importing a crafted template through a forged request, leading to Stored Cross-Site Scripting (XSS) within the administrator's session. CSRF is a flaw that allows an attacker to induce a user to perform actions they did not intend to take, while Stored XSS occurs when a malicious script is permanently stored on the target server.

An issue exists where the plugin fails to perform capability or nonce checks on a certificate-file download routine. This routine executes early in the WordPress admin request lifecycle, enabling any authenticated user, including those with Subscriber-level access, to download the site's TLS private key, certificates, and diagnostic logs. A nonce is a unique token used to prevent replay attacks by ensuring that a request is intentional and not forged.

The plugin fails to verify the signature of a SAML response before storing the included certificate. An administrator can then promote this stored certificate to the site's trusted signing certificate via a one-click control. This allows unauthenticated attackers to establish trust for their own certificate and authenticate as any user, including those with administrator privileges.