Tharadol Suksamran

Stored Cross-Site Scripting occurs due to insufficient input sanitization and output escaping. Authenticated attackers with Contributor-level access or higher can inject arbitrary web scripts into pages via the `rootAttributes` parameter. These scripts execute automatically whenever a user visits the affected page.

An Insecure Direct Object Reference (IDOR) exists due to missing validation on a user-controlled key. Unauthenticated attackers can enumerate occurrence IDs via the `vcal` parameter to access the full iCalendar export of personal, draft, trashed, and non-public calendar events. This leads to the disclosure of sensitive metadata, including titles, descriptions, dates, locations, permalinks, and details regarding the organizer and host.

Reflected Cross-Site Scripting occurs due to insufficient input sanitization and output escaping. This allows unauthenticated attackers to inject arbitrary web scripts into pages, which execute when a user is tricked into performing an action, such as clicking a link. The issue involves the `failed orders` parameter.

The Youzify plugin for WordPress contains a Stored Cross-Site Scripting issue caused by insufficient input sanitization and output escaping. Authenticated attackers with Subscriber-level access or higher can inject arbitrary web scripts through the `checkin place id` parameter. These scripts execute whenever a user visits the affected page.

The plugin is subject to Stored Cross-Site Scripting via the 'z taxonomy image' shortcode. The issue occurs because the shortcode rendering path passes attacker-controlled class input into a fallback image builder that concatenates HTML attributes without proper escaping. This allows authenticated attackers with Contributor-level access or higher to inject arbitrary web scripts that execute when users interact with the injected frontend page through the `class` shortcode attribute.

Name of the Vulnerable Software and Affected Versions Beaver Builder Page Builder versions up to and including 2.10.1.1 Description The Beaver Builder Page Builder plugin for WordPress is susceptible to Stored Cross-Site Scripting through the `settings[js]` parameter due to inadequate input sanitization and output escaping. This allows authenticated attackers with author-level access or higher to inject malicious web scripts into pages, which will then execute when a user accesses the compromised page. Recommendations Update Beaver Builder Page Builder to a version later than 2.10.1.1.

The Contact List plugin for WordPress is susceptible to Stored Cross-Site Scripting through the ` cl map iframe` parameter. Insufficient input sanitization and output escaping when handling the Google Maps iframe custom field allows for the injection of malicious scripts. The `saveCustomFields()` function in the class-contact-list-custom-fields.php file extracts iframe tags using a regular expression but fails to validate or sanitize the iframe's attributes, enabling the inclusion of event handlers like 'onload'. The extracted iframe HTML is stored using the `update post meta()` function and subsequently rendered on the front-end in class-cl-public-card.php without proper escaping or filtering. This allows authenticated attackers with Contributor-level access or higher to inject arbitrary web scripts into pages, which will execute when a user accesses the affected page.

The Unlimited Elements for Elementor plugin for WordPress is susceptible to Stored Cross-Site Scripting through the form entry fields. This is caused by inadequate input sanitization and output escaping of form submission data when displayed in the admin Form Entries Trash view. This allows unauthenticated attackers to inject arbitrary web scripts that will execute when an administrator views the trashed form entries.

The EventPrime plugin for WordPress is susceptible to unauthorized image file uploads. The plugin registers the `upload file media` API endpoint as publicly accessible without requiring authentication, authorization, or nonce verification, despite a nonce being created. This allows unauthenticated attackers to upload image files to the WordPress uploads directory and create Media Library attachments via the `ep upload file media` endpoint.

The MyRewards – Loyalty Points and Rewards for WooCommerce plugin for WordPress does not properly verify user authorization when performing actions within the `ajax` function. This allows authenticated attackers with subscriber-level access or higher to modify, add, or delete loyalty program earning rules. Specifically, attackers can manipulate point multipliers to arbitrary values.

The Tutor LMS plugin for WordPress is susceptible to Insecure Direct Object References (IDOR) due to insufficient object-level authorization checks. Specifically, the `course list bulk action()`, `bulk delete course()`, and `update course status()` functions lack proper validation. This allows authenticated attackers with Tutor Instructor-level access or higher to modify or delete courses they do not own by manipulating course IDs in bulk action requests. The vulnerable parameter is the course ID used in bulk action requests.

The IndieWeb plugin for WordPress is susceptible to Stored Cross-Site Scripting. This is due to inadequate input sanitization and output escaping related to the `Telephone` parameter. Authenticated attackers with author-level access or higher can inject malicious web scripts into pages. These scripts will then execute when a user views the compromised page.