Vgo0

The Toret Manager plugin for WordPress has a flaw that allows unauthorized modification of data, potentially leading to privilege escalation. This is due to a missing capability check in the `trman save option` and `trman save option items` functions. Authenticated attackers with Subscriber-level access or higher can update arbitrary options on the WordPress site. This can be used to change the default role for registration to administrator and enable user registration, allowing attackers to gain administrative user access.

The Academy LMS – WordPress LMS Plugin for Complete eLearning Solution is susceptible to privilege escalation through account takeover. The issue stems from insufficient validation of a user’s identity before allowing password updates, relying solely on a publicly accessible nonce for authorization. This allows unauthenticated attackers to modify any user’s password, including administrator accounts, and gain unauthorized access.

The WordPress Download Manager plugin is susceptible to Reflected Cross-Site Scripting due to inadequate input sanitization and output escaping. This allows unauthenticated attackers to inject arbitrary web scripts into pages, potentially leading to execution if a user is tricked into performing an action, such as clicking a malicious link. The vulnerability is located in the `user ids` parameter.

The HT Contact Form Widget For Elementor Page Builder & Gutenberg Blocks & Form Builder. plugin for WordPress is vulnerable to arbitrary file uploads due to missing file type validation in the `temp file upload` function. This allows unauthenticated attackers to upload arbitrary files to the affected server, potentially leading to remote code execution. Approximately 500 potentially vulnerable instances of the plugin have been identified. Attackers are observed exploiting the vulnerability through POST requests to `/wp-admin/admin-ajax.php` with malicious files and GET requests attempting to move or delete system files, such as `wp-config.php`.

The HT Contact Form Widget plugin for WordPress is vulnerable to arbitrary file deletion due to insufficient file path validation within the `temp file delete()` function. This allows unauthenticated attackers to delete arbitrary files on the server, potentially leading to remote code execution if critical files, such as `wp-config.php`, are deleted.

The issue allows unauthorized modification of data, potentially leading to privilege escalation, due to a missing capability check on the `uip save form as option()` function. This enables authenticated attackers with Subscriber-level access or higher to update arbitrary options on the WordPress site, which can be used to gain administrative user access.

The issue is related to Cross-Site Request Forgery due to missing nonce validation on a function, allowing unauthenticated attackers to inject malicious web scripts via a forged request if they can trick a site administrator into performing an action.

The issue is related to Reflected Cross-Site Scripting, which occurs due to the use of `add query arg` without proper escaping on the URL. This allows unauthenticated attackers to inject arbitrary web scripts into pages, which can be executed if a user is tricked into performing a specific action, such as clicking on a link.

The issue arises from insufficient input sanitization and output escaping, allowing unauthenticated attackers to inject arbitrary web scripts via the `nonce` parameter. This enables attackers to execute scripts if they can trick a user into performing a specific action, such as clicking on a link.

The issue arises from insufficient input sanitization and output escaping, allowing Reflected Cross-Site Scripting attacks. This enables unauthenticated attackers to inject arbitrary web scripts into pages by tricking a user into performing a specific action, such as clicking on a link, via the `s` parameter.

The issue is related to Reflected Cross-Site Scripting via the `channel` parameter due to insufficient input sanitization and output escaping. This allows unauthenticated attackers to inject arbitrary web scripts in pages that execute if they can successfully trick a user into performing an action such as clicking on a link.

The issue is related to Reflected Cross-Site Scripting due to the use of `add query arg` without appropriate escaping on the URL. This allows unauthenticated attackers to inject arbitrary web scripts in pages that execute if they can successfully trick a user into performing an action such as clicking on a link.

The issue is related to Reflected Cross-Site Scripting via the `Filename` parameter due to insufficient input sanitization and output escaping. This allows unauthenticated attackers to inject arbitrary web scripts in pages that execute if they can successfully trick an administrative user into performing an action such as clicking on a link.

The issue is related to Reflected Cross-Site Scripting via the `tab` parameter due to insufficient input sanitization and output escaping. This allows unauthenticated attackers to inject arbitrary web scripts in pages that execute if they can successfully trick a user into performing an action such as clicking on a link.

The issue is related to Reflected Cross-Site Scripting via the `page` parameter due to insufficient input sanitization and output escaping. This allows unauthenticated attackers to inject arbitrary web scripts in pages that execute if they can successfully trick a user into performing an action such as clicking on a link.

The issue is related to Reflected Cross-Site Scripting via the `s` parameter due to insufficient input sanitization and output escaping. This allows unauthenticated attackers to inject arbitrary web scripts in pages that execute if they can successfully trick a user into performing an action such as clicking on a link.

The issue is related to Reflected Cross-Site Scripting, which occurs due to insufficient input sanitization and output escaping. This allows unauthenticated attackers to inject arbitrary web scripts in pages that execute if they can successfully trick a user into performing an action such as clicking on a link. The estimated number of potentially affected devices worldwide is not specified.

The issue is due to missing or incorrect nonce validation on the `resync carousel()`, `seek snapshot()`, `uploaded cc()`, and `remove cc()` functions. This allows unauthenticated attackers to inject malicious web scripts via a forged request if they can trick a site administrator into performing an action such as clicking on a link.

The issue is due to missing or incorrect nonce validation on the `wp bibtex option page()` function, making it possible for unauthenticated attackers to inject malicious web scripts via a forged request. This can happen if attackers can trick a site administrator into performing an action such as clicking on a link.

The issue is due to missing nonce validation on the `wpabstracts load status()` and `wpabstracts delete abstracts()` functions, making it possible for unauthenticated attackers to inject malicious web scripts via a forged request. This can happen if an attacker can trick a site administrator into performing an action such as clicking on a link.