Theviper17Y

The plugin contains a flaw allowing unauthenticated users to delete arbitrary attachments. This occurs because the `ajax remove uploaded()` function lacks proper capability or ownership checks. The handler is registered for both `wp ajax` and `wp ajax nopriv` and relies only on the `file handling nonce` nonce, which is exposed in the public checkout page markup when a File Upload field is active. An attacker can exploit this by sending a crafted `attachment id` to the `thwcfe remove uploaded` AJAX action, potentially resulting in the loss of critical media files and a denial of service.

Insufficient input sanitization and output escaping allow unauthenticated attackers to perform Stored Cross-Site Scripting (XSS), a technique where malicious scripts are permanently stored on a target server. The issue occurs via the `comment` parameter. Exploitation requires the 'Parse Vimeo and YouTube links' option to be enabled and the injected comment to be approved by an administrator before the script executes for visitors.

Stored Cross-Site Scripting occurs via the comment field due to a Regex-Mangled Output Buffer resulting from insufficient input sanitization and output escaping. This allows unauthenticated attackers to inject arbitrary web scripts into pages that execute when a user accesses them. Exploitation requires the plugin's Remove mode to be active and the malicious comment to be published, either through auto-approval for known commenters or manual moderator approval.

Insufficient input sanitization and output escaping allow unauthenticated attackers to perform Reflected Cross-Site Scripting. This occurs on product pages where a Date & Time Range Picker extra field is configured. Attackers can inject arbitrary web scripts via the `<fieldname> start` and `<fieldname> end` parameters, which execute if a user is tricked into clicking a malicious link. The required field name is visible in the product page source.

Insufficient input sanitization and output escaping allow unauthenticated attackers to perform Stored Cross-Site Scripting (XSS) via comment content. This occurs through Output Buffer Regex Corruption, enabling the injection of arbitrary web scripts that execute when a user visits the affected page. Exploitation requires the administrator to have enabled the 'Google Tag Manager' integration and the 'Replace integration automatically [Beta]' option, and the malicious comment must be approved by an administrator.

Stored Cross-Site Scripting occurs due to insufficient input sanitization and output escaping within the 'Remove Microdata' output filter. Unauthenticated attackers can inject arbitrary web scripts into comment content. These scripts execute when a user accesses the affected page, provided an administrator has enabled the 'Remove Microdata' option and approved the malicious comment.

Stored Cross-Site Scripting occurs due to insufficient input sanitization and output escaping. Authenticated attackers with contributor-level access and above can inject arbitrary web scripts into pages via the `forget password link` parameter. These scripts execute whenever a user accesses the affected page.

Insufficient input sanitization and output escaping allow unauthenticated attackers to perform Stored Cross-Site Scripting (XSS) via comment content. The issue occurs when the `yotu-wp` Cookie-Blocker Filter uses `str replace()` rewrites in its output-buffer filter, which can break out of the attribute context and execute arbitrary web scripts. This method bypasses the `wp kses()` comment sanitization by using allow-listed tags and hiding executable tokens within quoted attribute values as plain text. The execution of the script requires the comment to be approved before it affects visitors.

Insufficient authorization and input sanitization in the `send test mail()` function allow authenticated attackers with subscriber-level access and above to write user-controlled PHP code to executable files within the uploads directory. This flaw enables the execution of arbitrary PHP code on the server, which can lead to a full site compromise.

Insufficient input sanitization and output escaping in the Group Block `linkToPost` feature allow authenticated attackers with contributor-level access or higher to perform Stored Cross-Site Scripting. This enables the injection of arbitrary web scripts into pages, which execute when a user visits the affected page.

Insufficient input sanitization and output escaping allow unauthenticated attackers to perform Stored Cross-Site Scripting (XSS), a technique where malicious scripts are permanently stored on a target server. This occurs via the `synopsis` shortcode attribute. The attack is successful when the `parse comments` option (Parse Vimeo and YouTube links) is enabled and the `liststyle` attribute is set to "season".

Insufficient input sanitization and output escaping allow for Stored Cross-Site Scripting. Authenticated attackers with contributor-level access or higher can inject arbitrary web scripts into pages. Additionally, unauthenticated visitors can exploit this issue if the `parse comments` setting (Parse Vimeo and YouTube links) is enabled, which allows the plugin to process shortcodes within comment text. The issue occurs via the `synopsis` shortcode attribute.

Stored Cross-Site Scripting occurs via the `comment content` parameter, which is rendered inline into the page HTML. This issue stems from insufficient input sanitization and output escaping. Unauthenticated attackers can inject arbitrary web scripts that execute when a user accesses the affected page. The vulnerability bypasses the WordPress core `wp kses data` allow-list because the payload uses permitted tags and attributes, hiding the event handler within a broken attribute region. The plugin's render-time `str replace()` function then promotes this to a real DOM attribute. Execution of the payload requires a site administrator to approve the crafted comment.

Insufficient input sanitization and output escaping allow authenticated attackers with Contributor-level access and above to perform Stored Cross-Site Scripting. This is achieved by injecting arbitrary web scripts via the `not found` parameter, which execute when a user accesses the affected page.

Insufficient input sanitization and output escaping allow unauthenticated attackers to perform Stored Cross-Site Scripting (XSS), a technique where malicious scripts are permanently stored on a target server. The issue occurs when a payload is delivered through the comment author name field. These scripts execute whenever a user accesses the affected page, provided the comment has passed the WordPress moderation workflow.

The DoFollow Case by Case plugin for WordPress contains a Stored Cross-Site Scripting issue caused by insufficient input sanitization and output escaping. Unauthenticated attackers can inject arbitrary web scripts through comment content. While comment moderation may delay the process, the payload executes in the browser of any visitor who accesses the affected post once an administrator approves the comment.

Insufficient input sanitization and output escaping allow unauthenticated attackers to perform Stored Cross-Site Scripting (XSS) via comment content. This is achieved by using a predictable `{rstr keep}` placeholder, enabling the injection of arbitrary web scripts that execute when a user views the affected page. The payload bypasses standard WordPress comment sanitization because the used tags and attributes, such as `a[title]` and `code`, are permitted by the core comment kses allow-list, and the plugin's shortcode markers and placeholder tokens are not removed.

Stored Cross-Site Scripting occurs due to insufficient input sanitization and output escaping. Unauthenticated attackers can inject arbitrary web scripts into pages that execute when a user accesses them. Successful exploitation requires the 'Lazy-load images?' option to be enabled, the `w3-total-cache/w3-total-cache.php` file to be present on disk while the plugin is disabled, a `Minify HTML` class to be loaded into scope by another plugin, and the malicious comment to be approved by a moderator.

Insufficient input sanitization and output escaping allow unauthenticated attackers to perform Stored Cross-Site Scripting via comment content. This is achieved through an mXSS-style transform, where the payload is stored using tags and attributes allowed by WordPress comment kses sanitization. The malicious event handlers and style fragments are activated when the plugin's output-buffer callback rewrites the rendered HTML during the request. This allows the execution of arbitrary web scripts whenever a user accesses the affected page.

Stored Cross-Site Scripting occurs due to insufficient input sanitization and output escaping. Unauthenticated attackers can inject arbitrary web scripts into pages via comment content. This issue is triggered by an Output-Buffer Regex Rewrite and is only exploitable when the 'Remove query strings from static resources' option is enabled. In this configuration, the `mutate url()` function strips the '?' delimiter and subsequent characters, which can break the attribute boundary and allow script execution when a user accesses the affected page.