Vaibhav Narkhede

The Contact Form to Chat Apps | Click to Chat to Order WordPress plugin before 2.15.8 does not perform any capability, nonce or session check on one of its public AJAX actions, allowing unauthenticated users to read the submitted entries of any form created with a supported third-party form Contact Form to Chat Apps | Click to Chat to Order WordPress plugin before 2.15.8.

The SureRank SEO WordPress plugin before 1.10.1 does not exclude users' registered account email addresses from the structured data it outputs on public pages by default, allowing unauthenticated visitors to obtain the email address of any user who has published content.

**Name of the Vulnerable Software and Affected Versions** FormLayer WordPress plugin versions prior to 1.0.9 **Description** An authorization bypass exists in the public submission handler that allows unauthenticated users to retrieve the full stored configuration of a form. This can lead to the disclosure of sensitive information, such as notification recipient addresses, confirmation redirect targets, and integration settings, including data from forms that have not been published. **Recommendations** Update FormLayer WordPress plugin to version 1.0.9 or later.

**Name of the Vulnerable Software and Affected Versions** Document Embedder WordPress plugin versions prior to 2.3.1 **Description** The plugin fails to verify the status of a document before generating a download token and streaming the file. This allows unauthenticated attackers to download arbitrary documents, including those marked as private or drafts, by enumerating document IDs. **Recommendations** Update Document Embedder WordPress plugin to version 2.3.1 or later.

**Name of the Vulnerable Software and Affected Versions** Stripe Payment Forms by WP Full Pay versions prior to 8.5.1 **Description** An issue exists where the plugin fails to properly verify if a customer portal session has completed its confirmation step before returning data. This allows unauthenticated users to access and read the subscription and billing information of other customers. **Recommendations** Update Stripe Payment Forms by WP Full Pay to version 8.5.1 or later.

**Name of the Vulnerable Software and Affected Versions** Kirki versions prior to 6.0.14 **Description** The plugin fails to perform a capability check on certain endpoints of a public AJAX action, specifically within the `kirki get apis` function. This allows unauthenticated users to retrieve email addresses of registered users and comment authors, along with non-public page content and settings. **Recommendations** Update to version 6.0.14 or later.

**Name of the Vulnerable Software and Affected Versions** Privacy Policy Generator, Terms & Conditions, GDPR, CCPA, Cookie Policy & Disclaimer Templates WordPress plugin versions prior to 3.7.1 **Description** An authorization check is missing on a REST route that returns stored account data. This allows unauthenticated visitors to retrieve the connected service's API secret and account details, which can subsequently be used to disconnect the plugin's integration. **Recommendations** Update the Privacy Policy Generator, Terms & Conditions, GDPR, CCPA, Cookie Policy & Disclaimer Templates WordPress plugin to version 3.7.1 or later.

**Name of the Vulnerable Software and Affected Versions** Food Menu versions prior to 6.0.2 **Description** An issue exists where the plugin fails to perform capability or ownership checks on the reservation-status update action. This action is exposed to unauthenticated users and is protected only by a nonce (a number used once to prevent replay attacks) that is publicly available to visitors, allowing unauthenticated attackers to modify the status of arbitrary reservations. **Recommendations** Update to version 6.0.2 or later.

**Name of the Vulnerable Software and Affected Versions** WP Photo Album Plus versions prior to 9.2.07.002 **Description** The plugin fails to perform capability or nonce checks on a public REST endpoint action. This allows unauthenticated users to delete generated album export ZIP archives stored by the system via the `delexportzips` action. A nonce is a unique token used to prevent replay attacks by ensuring that a request is intentional and comes from a trusted source. **Recommendations** Update to version 9.2.07.002 or later.

**Name of the Vulnerable Software and Affected Versions** Nexter Blocks versions prior to 5.0.2 **Description** Insufficient access control in a REST endpoint allows users with the Contributor role or higher to save arbitrary global CSS. This stored CSS is rendered site-wide on the front end, which can lead to defacement, content hiding, and UI redressing (a technique used to trick a user into performing an action in a different application than the one they intended). **Recommendations** Update Nexter Blocks to version 5.0.2 or later.

**Name of the Vulnerable Software and Affected Versions** GeoDirectory versions prior to 2.8.168 **Description** An issue exists where a user-search handler is not properly restricted to users authorized to list users. This allows any authenticated user with Contributor-level access or higher to retrieve the email addresses of all registered users, including administrators, via the `geodir json search users` function. **Recommendations** Update GeoDirectory to version 2.8.168 or later.

**Name of the Vulnerable Software and Affected Versions** The Chat Widget: Floating Customer Support Button for 30+ Channels, Supporting SMS, Calls, and Chat WordPress plugin versions prior to 1.8.2 **Description** An unauthenticated user can upload arbitrary files because the plugin fails to validate the type, extension, content, or size of files submitted to its public response endpoint. These files are stored in the uploads directory. Since the original extension is discarded and files are stored using a bare UUID (Universally Unique Identifier), this issue does not allow for code execution or stored XSS (Cross-Site Scripting). The impact is limited to content hosting and disk consumption. This issue requires the channel's response storage or mail-forwarding to be configured. **Recommendations** Update the plugin to version 1.8.2 or later.

**Name of the Vulnerable Software and Affected Versions** Buckaroo Woocommerce Payments Plugin versions prior to 4.9.0 **Description** An issue exists where the plugin fails to perform capability checks or nonce validation—a security mechanism used to prevent cross-site request forgery—on an AJAX action used to process payment capture refunds. This allows any authenticated user, including those with Subscriber privileges, to trigger refunds for captured orders. **Recommendations** Update the plugin to version 4.9.0 or later.

**Name of the Vulnerable Software and Affected Versions** JS Help Desk WordPress plugin versions prior to 3.1.4 **Description** Upon activation, the plugin grants support-agent capabilities to the Contributor role. Additionally, it fails to perform a capability check on a user-listing handler, which allows users with Contributor-level privileges to enumerate the email addresses of all registered WordPress users. **Recommendations** Update JS Help Desk WordPress plugin to version 3.1.4 or later.

The Animation Addons for Elementor WordPress plugin before 2.7.0 does not sanitise uploaded SVG/SVGZ files, which it adds to the list of allowed upload types, allowing users with the upload files capability (Author and above) to upload files containing malicious JavaScript, leading to Stored Cross-Site Scripting.

**Name of the Vulnerable Software and Affected Versions** Header Footer Builder for Elementor versions prior to 1.2.1 **Description** Insufficient administrative capability requirements for the dashboard template-import action allow users with `edit posts` permissions, such as Contributors, to import templates. An attacker can include an Elementor HTML widget configured for site-wide display to inject JavaScript that executes in the session of any visitor or administrator who loads the site. **Recommendations** Update Header Footer Builder for Elementor to version 1.2.1 or later.

**Name of the Vulnerable Software and Affected Versions** Adminify WordPress plugin versions prior to 4.2.10 **Description** An issue exists in an administration search feature that fails to perform per-user read-capability checks on returned results. This allows users with low-privilege roles, such as Contributor, to disclose non-public content that is normally restricted, including unpublished post titles from other authors, pending comment content, user account names, and the plugin inventory. **Recommendations** Update Adminify WordPress plugin to version 4.2.10 or later.

**Name of the Vulnerable Software and Affected Versions** Decent Comments versions prior to 3.0.2 **Description** The Decent Comments WordPress plugin fails to restrict access to comment author and post author email addresses through its REST API endpoint. This allows unauthenticated attackers to enumerate the email addresses of registered users. **Recommendations** Update to version 3.0.2 or later.