Truoc Phan

The plugin contains a Stored Cross-Site Scripting issue within the `vc raw html` shortcode. The `vc raw html::render()` function fails to properly sanitize input and escape output by base64-decoding shortcode content and inserting it directly into the page HTML. This process bypasses the `wp kses post()` filter, which is a WordPress function used to sanitize HTML content, because the filter does not decode base64 text. Consequently, authenticated attackers with Contributor-level access or higher can inject arbitrary web scripts that execute when a user, such as an Editor or Administrator, views the affected page.

The issue is related to Reflected Cross-Site Scripting due to insufficient input sanitization and output escaping. This allows unauthenticated attackers to inject arbitrary web scripts in pages that execute if they can successfully trick a user into performing an action such as clicking on a link. The `data` parameter is specifically vulnerable to this type of attack.

The issue is related to time-based SQL Injection via the `subscriptionCouponId` parameter due to insufficient escaping on the user-supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possible for authenticated attackers, with Subscriber-level access and above, to append additional SQL queries into already existing queries that can be used to extract sensitive information from the database.

The issue is related to Cross-Site Request Forgery due to missing or incorrect nonce validation within the `td ajax get views` AJAX action. This allows unauthenticated attackers to inject malicious web scripts via a forged request if they can trick a site administrator into performing a specific action, such as clicking on a link.

The issue is related to Reflected Cross-Site Scripting due to insufficient input sanitization and output escaping. This allows unauthenticated attackers to inject arbitrary web scripts in pages that execute if they can successfully trick a user into performing an action such as clicking on a link. The `account id` and `account username` parameters are vulnerable to this issue.

The issue is related to Improper Neutralization of Input During Web Page Generation, also known as 'Cross-site Scripting'. This allows for Stored XSS.

The WP Hotel Booking plugin for WordPress is vulnerable to arbitrary file uploads due to missing file type validation in the `update review()` function. This makes it possible for authenticated attackers, with subscriber-level access and above, to upload arbitrary files on the affected site's server, which may make remote code execution possible.

The issue arises from insufficient input sanitization and output escaping within the `on ajax check envato code` function, allowing unauthenticated attackers to inject arbitrary web scripts in pages via the `envato code[]` parameter. This can be exploited if an attacker tricks a user into performing a specific action, such as clicking on a link.

The issue is related to Reflected Cross-Site Scripting via the `envato code[]` parameter due to insufficient input sanitization and output escaping within the `on ajax register forum user` function. This allows unauthenticated attackers to inject arbitrary web scripts in pages that execute if they can successfully trick a user into performing an action such as clicking on a link.

The issue concerns a Blind SQL Injection vulnerability via the `couponId` parameter of the "recreate stripe subscription" REST API endpoint. This vulnerability is due to insufficient escaping on the user-supplied parameter and lack of sufficient preparation on the existing SQL query, allowing authenticated attackers with administrator-level privileges to append additional SQL queries into already existing queries. This can be used to extract sensitive information from the database.

The issue is related to Blind SQL Injection via the `subscriptionCouponId` parameter through the "create stripe subscription" REST API endpoint. This occurs due to insufficient escaping on user-supplied parameters and lack of sufficient preparation on existing SQL queries. Authenticated attackers with administrator-level privileges can append additional SQL queries to extract sensitive information from the database.

The issue is due to the use of loose comparison in the `verify id token` function, making it possible for unauthenticated attackers to log in as any existing user on the site, such as an administrator, if they have access to an @flutter.io email address or phone number. This also requires Firebase to be configured on the website and the user to have set up Firebase for their account.

The issue is due to the use of loose comparison of the activation code in the `woo slg confirm email user` function. This makes it possible for unauthenticated attackers to log in as any existing user on the site, such as an administrator, if they have access to the `userID`. The email module must be enabled for this issue to occur.

The issue is due to insufficient verification on the `phone` parameter of the `firebase sms login` and `firebase sms login v2` functions. This allows unauthenticated attackers to log in as any existing user, such as an administrator, if they have access to the email address or phone number. Additionally, if a new email address is supplied, a new user account is created with the default role, even if registration is disabled.

The issue is due to insufficient verification of the `API key`, allowing unauthenticated attackers to log in as any existing user, such as an administrator, if they have access to the `username`. This enables them to perform various administrative tasks. The vulnerability was partially fixed in version 0.1.0.44 but remained exploitable via Cross-Site Request Forgery.

The issue is due to a lack of validation on user-supplied data in the 'pm upload image' AJAX action, allowing authenticated attackers with Subscriber-level access and above to update their user capabilities to Administrator.

The issue is related to a missing capability check on the `delete resmush list()` function, allowing authenticated attackers with minimal permissions, such as a subscriber, to delete the resmush list for Nextgen or the Media Library. This enables unauthorized deletion of the resmush list.

The issue is related to missing authorization checks on the REST API calls, allowing unauthenticated attackers to connect the site to InstaWP API, edit arbitrary site options, and create administrator accounts.

The issue is related to Stored Cross-Site Scripting via the plugin's button shortcode due to insufficient input sanitization and output escaping on user-supplied attributes. This allows authenticated attackers with contributor-level access and above to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. The vulnerable code is specifically tied to the tagDiv Newspaper theme and may not be present if another theme is installed.

The issue is related to a Cross-Site Request Forgery (CSRF) vulnerability that allows Cross-Site Scripting (XSS) in tagDiv Composer.