Tarpeg007

The Royal Addons for Elementor – Addons and Templates Kit for Elementor plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 1.7.1066 via the 'wpr keyword' parameter. This makes it possible for unauthenticated attackers to extract arbitrary postmeta values from all published posts via character-by-character substring matching across the entire wp postmeta table. The required nonce is emitted publicly via wp localize script on any frontend page that loads a Royal Elementor widget, meaning no authenticated session or prior action is needed to obtain it.

**Name of the Vulnerable Software and Affected Versions** Royal Elementor Addons versions prior to 1.7.1065 **Description** An issue exists in the Form Builder widget's `webhook url` setting that allows Server-Side Request Forgery (SSRF), a flaw where an attacker forces a server to make requests to an unintended location. The `render()` method saves a user-controlled URL into the `wpr webhook url {widget id}` option. Subsequently, the `wpr form builder webhook` AJAX handler reads this option and executes an outbound request using the `wp remote post()` function. Because the process lacks a host allowlist, scheme restrictions, and filters for private or loopback IP addresses, authenticated attackers with Contributor-level access or higher can trigger web requests to arbitrary locations from the server to query or modify internal services. **Recommendations** Update Royal Elementor Addons to a version newer than 1.7.1064. As a temporary mitigation, restrict access to the Form Builder widget's `webhook url` setting for users with Contributor-level permissions.

**Name of the Vulnerable Software and Affected Versions** Wazuh Manager versions prior to 5.0.0-beta3 **Description** The software fails to escape the `DataValue.index` field when constructing OpenSearch bulk requests. This allows enrolled agents to inject arbitrary NDJSON (Newline Delimited JSON) operations. Attackers can smuggle delete, index, or update operations into bulk requests executed with the manager's admin credentials, which can lead to document deletion, alert tampering, and cross-agent SIEM state manipulation. **Recommendations** Update Wazuh Manager to version 5.0.0-beta3 or later.

**Name of the Vulnerable Software and Affected Versions** Hono versions prior to 4.12.4 **Description** Hono is a Web application framework supporting various JavaScript runtimes. A flaw exists where the `event`, `id`, and `retry` fields within the `streamSSE()` function in the Streaming Helper were not properly validated for carriage return (r) or newline ( ) characters. The Server-Sent Events (SSE) protocol utilizes line breaks to delineate fields. Consequently, if untrusted input containing these characters was supplied to these fields, it could enable the injection of additional SSE fields within the same event frame. The issue stems from the SSE helper constructing event frames by joining lines with , and previously allowing raw values without rejecting CR/LF characters in the `event`, `id`, and `retry` fields. This could lead to the injection of additional fields like `data:`, `id:`, or `retry:`. Applications that render `e.data` unsafely, such as using `innerHTML`, could be vulnerable to client-side script injection. **Recommendations** Versions prior to 4.12.4 should be updated to version 4.12.4 or later.

**Name of the Vulnerable Software and Affected Versions** Hono versions prior to 4.12.4 **Description** The `setCookie()` utility did not properly validate semicolons (;), carriage returns (r), or newline characters ( ) in the `domain` and `path` options when creating the `Set-Cookie` header. Because cookie attributes are separated by semicolons, this could allow an attacker to inject additional cookie attributes if untrusted input is used in these fields. The issue stems from the interpolation of the `domain` and `path` options without rejecting unsafe characters. Including characters like `;`, `r`, or ` ` could lead to unintended cookie attributes being added to the header, potentially affecting cookie scoping or security. Exploitation requires misuse of cookie options at the application level. **Recommendations** Update to version 4.12.4 or later.