Thevietronin

An issue exists where the plugin registers its admin page using `add management page()` with a role name from `InstaWP Setting::get allowed role()` as the required capability. Because `generate section field()` renders the master API key from the `instawp api options` option as a plain-text HTML input without a `manage options` check, authenticated users with Subscriber-level access or higher can read the plaintext master API key. An attacker can then use the SHA-256-derived secret of this key as a bearer token accepted by the `validate api request()` function in the REST API. By calling the `POST /wp-json/instawp-connect/v2/auto-login` endpoint, the attacker can generate a 30-second single-use login URL that sets an administrator authentication cookie, resulting in full privilege escalation. This requires the site to be connected to InstaWP and the attacker's role to be included in the `instawp sync tab roles` list.

Insufficient input sanitization and output escaping allow unauthenticated attackers to perform Stored Cross-Site Scripting (XSS), a technique where malicious scripts are permanently stored on the target server. This occurs via the `order email` variable, enabling the injection of arbitrary web scripts that execute when a user accesses the affected page.

The Groundhogg — CRM, Newsletters, and Marketing Automation plugin for WordPress contains a Stored Cross-Site Scripting issue. This occurs due to insufficient input sanitization and output escaping when handling the `ref` parameter. Unauthenticated attackers can exploit this to inject arbitrary web scripts into pages, which then execute when a user visits the affected page.

Insufficient input sanitization and output escaping allow unauthenticated attackers to perform Stored Cross-Site Scripting (XSS), a technique where malicious scripts are permanently stored on a target server. This occurs via the `formString` parameter. The `rednao smart forms save form values` AJAX handler only enforces a nonce check—a security token used to prevent request forgery—when the `smart forms block anonymous submissions` option is enabled. Consequently, default installations allow the submission and storage of malicious payloads without authentication or nonce verification, which execute when a user accesses the affected page.

Insufficient input sanitization and output escaping allow unauthenticated attackers to perform Stored Cross-Site Scripting (XSS), a technique where malicious scripts are permanently stored on the target server. The issue occurs via the `form id` parameter. The malicious payload is stored in the registering user's `submitted` usermeta through the `update user meta()` function. The script executes when an administrator views the affected user record in the wp-admin Users modal, which inserts the unescaped output using the jQuery `.html()` method.

The plugin is subject to Stored Cross-Site Scripting (XSS), a flaw where malicious scripts are permanently stored on the target server. This occurs due to insufficient input sanitization and output escaping via the `css[fonts]` parameter. Unauthenticated attackers can inject arbitrary web scripts into pages that execute when a user accesses them. The security nonce required to reach the vulnerable endpoint is visible in the front-end page markup, effectively reducing the security barrier to a CSRF token and allowing full exploitation by unauthenticated users.

Insufficient input sanitization and output escaping in the AJAX Cron Handler allow unauthenticated attackers to perform Stored Cross-Site Scripting (XSS). This occurs when arbitrary web scripts are injected into pages via a request parameter, which then execute when a user accesses the affected page.

This issue is a generic SQL Injection via URL Path caused by insufficient escaping of user-supplied parameters and a lack of sufficient preparation of the existing SQL query. Authenticated attackers with subscriber-level access or higher can append additional SQL queries to existing ones to extract sensitive information from the database. This is only exploitable when the `[mpg spintax]` shortcode is rendered in site-wide content, such as a footer or template part, because the vulnerable code path is only accessed when the shortcode is active on the requested page.

An authentication bypass allows unauthenticated attackers to take over accounts. The issue occurs because the `pre update value` function lacks capability or ownership checks, and the `ActionPost::conditions logic()` function bypasses the `current user can('edit post')` authorization check when the post ID is non-numeric (for example, using the string `user 1`). This allows unauthenticated form submissions to be routed to arbitrary user records, enabling attackers to overwrite any user's registered email address, including administrators, and subsequently use the native password-reset process to gain full account access.

The Pods – Custom Content Types and Fields plugin for WordPress contains a privilege escalation flaw allowing unauthenticated attackers to gain Administrator privileges or overwrite any user account password, including the site owner's, leading to complete site takeover. The issue resides in the `pods admin` AJAX router, which handles security checks such as method allowlists, nonce verification, login enforcement, and capability gates through the `pods error()` function. Under the JSON `meta-box-loader` compatibility path, `pods error()` only logs failures to the PHP error log and returns false without terminating the request, allowing execution to continue to privileged API methods such as `save user()`. Over 100,000 active installations are potentially affected, and real-world incidents have been reported where attackers added unauthorized administrator users to websites.

This issue allows unauthenticated attackers to perform an account takeover by exploiting improper password reset validation. The plugin fails to properly verify a user's identity during the password reset process, enabling attackers to reset passwords for arbitrary accounts, including those with administrator privileges.

The Uncanny Automator plugin for WordPress contains a missing authorization flaw. Authenticated users with Subscriber-level access or higher can exploit this by sending requests to the `automator google contacts fetch labels`, `automator mautic segment fetch`, `automator mautic tags fetch`, and `automator mautic render contact fields` AJAX actions. The issue stems from a lack of capability checks and missing nonce verification (a security token used to prevent cross-site request forgery) in the `ajax fetch labels()`, `segments fetch()`, `tags fetch()`, and `render contact fields()` handlers. This allows attackers to enumerate sensitive Google Contacts groups and labels, as well as Mautic segments, tags, and contact-field definitions, using credentials configured by an administrator. Additionally, this can lead to the consumption of third-party API quotas.

The Web Directory Free plugin for WordPress contains a generic SQL Injection flaw. This issue occurs because the software fails to properly escape user-supplied input and lacks sufficient preparation of the SQL query. Unauthenticated attackers can exploit this by appending malicious SQL queries via the `levels` parameter to extract sensitive information from the database.

Unauthenticated attackers can achieve Remote Code Execution by sending unsanitized values through the `postData` parameter. The plugin writes these values into a PHP-includeable .log file, which is later rendered using the `include once` function within `wpfnl show log()`. For successful exploitation, the Log Settings Enable Logs toggle must be active, and an administrator must view the polluted log file via the Log Settings View UI. The nonce required to reach the endpoint is publicly available on every funnel step page, allowing the initial injection to be performed without authentication.

The plugin is susceptible to privilege escalation through account takeover. This occurs because the software fails to properly validate a user's identity before updating a password, allowing unauthenticated attackers to change the passwords of arbitrary users, including administrators, to gain unauthorized account access.

An improper limitation of a pathname to a restricted directory, known as Path Traversal, allows for arbitrary file download. This occurs when the application fails to properly validate user-supplied input used to construct a file path, enabling access to files outside the intended directory.

Improper neutralization of input during web page generation in Liquid Web / StellarWP GiveWP allows for DOM-Based Cross-site Scripting (XSS), a flaw where the application contains client-side JavaScript that processes data from an untrusted source in an unsafe way, typically by writing the data to a dangerous sink.

Improper neutralization of input during web page generation allows for stored Cross-site Scripting (XSS), a condition where malicious scripts are permanently stored on the target server and executed in the browser of users who view the affected page.

WeGIA is a web management application for institutions. A Reflected Cross-Site Scripting (XSS) issue exists in the `/html/atendido/cadastro atendido parentesco pessoa nova.php` API endpoint. Attackers can inject malicious scripts through the `idatendido` parameter.

WeGIA is a Web Manager for Institutions. A SQL Injection issue exists in the `/html/funcionario/dependente listar.php` API endpoint, specifically through the `id funcionario` parameter. Successful exploitation allows attackers to execute arbitrary SQL commands, potentially compromising the database's confidentiality, integrity, and availability.