Waris Damkham

An authorization bypass and Stored Cross-Site Scripting (XSS) issue exists due to missing capability checks on popup management actions. Authenticated users with Subscriber-level access or higher can exploit multiple AJAX endpoints to create arbitrary popups and inject malicious JavaScript. This script executes when the popup is displayed to other users. Stored XSS is a type of vulnerability where a malicious script is permanently stored on the target server.

This issue is a Server-Side Request Forgery, a flaw that allows an attacker to induce the server-side application to make requests to an unintended location. Authenticated users with Contributor-level access and above can exploit this by providing malicious input through the 'Changelog File' setting, which is passed to the `wp remote get()` function without proper validation or sanitization of the URL. This allows attackers to make web requests to arbitrary locations from the web application to query or modify information from internal services.

An information leakage vulnerability exists in the Endpoint DLP component (epdlpdrv.sys) of Netskope Client for Windows prior to version R141. An internal communication channel used by the user-space hook DLL to pass messages through the kernel driver to the daemon lacked proper token-based message validation, allowing local unprivileged processes to send unauthorized queries. Additionally, a reply buffer used by the port message handler was not properly initialized before returning data, leaking residual kernel pool memory from prior allocations. A local unprivileged attacker could exploit this vulnerability to enumerate DLP configuration and feature flags, extract live session tokens, and read kernel memory fragments from other users' operations.

The ShopLentor plugin for WordPress allows arbitrary function execution through the 'woolentoropt/v1/custom-action' REST API endpoint. The issue occurs because the `handle action()` method passes user-supplied input to the `call user func()` function without validating it against an allowlist of permitted callbacks. Consequently, authenticated attackers with Administrator-level access or higher can execute arbitrary PHP callable functions by manipulating the `callback` parameter.

Unauthenticated attackers can perform blind SQL Injection through the `filter data[comment count]` parameter of the public `tableon get table data` AJAX action. The issue occurs because user-supplied input is split on a colon and interpolated directly into a `posts where` SQL clause without using `intval()` casting or `$wpdb->prepare()`. This allows the execution of additional SQL queries to extract sensitive data from the database, such as database names, usernames, and passwords.

Name of the Vulnerable Software and Affected Versions The Quick Playground plugin for WordPress versions up to and including 1.3.1 Description The Quick Playground plugin for WordPress is susceptible to Remote Code Execution due to inadequate authorization checks on REST API endpoints. These endpoints expose a sync code and permit arbitrary file uploads. This allows unauthenticated attackers to retrieve the sync code, upload PHP files using path traversal techniques, and ultimately achieve remote code execution on the server. Recommendations Update the Quick Playground plugin to a version later than 1.3.1.

The Easy Image Gallery plugin for WordPress is susceptible to Stored Cross-Site Scripting through the Gallery shortcode post meta field. Insufficient input sanitization and output escaping of user-supplied gallery shortcode values allows authenticated attackers with Contributor-level access or higher to inject arbitrary web scripts into pages. These scripts will execute when a user accesses the affected page.

The Hr Press Lite plugin for WordPress has a flaw that allows unauthorized access to sensitive employee data. This is due to a missing capability check on the `hrp-fetch-employees` AJAX action. Attackers with Subscriber-level access or higher can retrieve sensitive employee information, including names, email addresses, phone numbers, salary/pay rates, employment dates, and employment status. The vulnerable component is the `hrp-fetch-employees` AJAX action.

The NextGEN Gallery plugin for WordPress is susceptible to a Local File Inclusion issue. This affects versions up to and including 4.0.3. The issue is triggered through the `template` parameter within gallery shortcodes. Successful exploitation allows authenticated attackers with Author-level access or higher to include and execute arbitrary .php files on the server. This can lead to bypassing access controls, obtaining sensitive data, or achieving code execution if .php files can be uploaded and included. The vulnerable parameter is `template`.

The WowStore – Store Builder & Product Blocks for WooCommerce plugin for WordPress is susceptible to SQL Injection via the `search` parameter. Insufficient escaping of user-supplied input and inadequate preparation of existing SQL queries allow unauthenticated attackers to inject additional SQL queries, potentially extracting sensitive information from the database.

The JS Archive List plugin for WordPress is susceptible to PHP Object Injection through the 'included' shortcode attribute. This occurs because of the deserialization of untrusted input provided through the 'included' parameter of the plugin’s shortcode. Authenticated attackers with Contributor-level access or higher can inject a PHP Object. Currently, no known practical exploitation chain (POP chain) exists within the vulnerable software itself. However, if a POP chain is present through an additional plugin or theme installed on the target system, an attacker could potentially delete arbitrary files, retrieve sensitive data, or execute code.

The WowOptin plugin for WordPress is susceptible to unauthorized arbitrary plugin installation. This is due to a missing capability check within the `install and active plugin` function. Authenticated attackers possessing Subscriber-level access or higher can exploit this to install and activate plugins without authorization.

The Envira Gallery for WordPress plugin is susceptible to Stored Cross-Site Scripting through the `justified gallery theme` parameter. Insufficient input sanitization and output escaping allow authenticated attackers with Author-level access or higher to inject arbitrary web scripts into pages. These scripts will execute when a user accesses the injected page.

The Prodigy Commerce plugin for WordPress is susceptible to a Local File Inclusion issue. This allows unauthenticated attackers to include and read arbitrary files or execute arbitrary files on the server. Exploitation of this issue can lead to bypassing access controls, obtaining sensitive data, or achieving code execution. The vulnerability is due to insufficient input validation of the `parameters[template name]` parameter. This allows attackers to include and execute PHP code within uploaded files.

The Library Management System plugin for WordPress is susceptible to SQL Injection due to inadequate input validation and query preparation. Specifically, the `bid` parameter is not properly sanitized, allowing attackers to inject malicious SQL code. This can enable unauthenticated attackers to extract sensitive information from the database by appending additional SQL queries to existing ones.

The WP Customer Reviews plugin for WordPress is susceptible to Reflected Cross-Site Scripting. This is due to inadequate input sanitization and output escaping of the `wpcr3 fname` parameter. An unauthenticated attacker can inject arbitrary web scripts into pages, which will execute if a user is tricked into performing an action, such as clicking a malicious link.

The WP Event Aggregator plugin for WordPress is susceptible to Stored Cross-Site Scripting through the 'wp events' shortcode. Insufficient input sanitization and output escaping on user-supplied attributes allows authenticated attackers with Contributor-level access or higher to inject arbitrary web scripts into pages. These scripts will execute when a user accesses the affected page.

The midi-Synth plugin for WordPress is susceptible to arbitrary file uploads because of a lack of validation for file types and extensions within the 'export' AJAX action. This allows unauthenticated attackers to upload files to the affected server. Successful exploitation, which requires obtaining a valid nonce, could potentially lead to remote code execution. The nonce is exposed in frontend JavaScript, making it easily accessible to attackers. **API Endpoint:** '/export' **Vulnerable Parameter:** No specific parameters are mentioned, but the issue relates to file uploads handled by the 'export' AJAX action. **Vulnerable Function:** The 'export' AJAX action is vulnerable.

The FastDup plugin for WordPress is affected by a flaw that allows unauthorized backup creation and download. This is due to a missing capability check on REST API endpoints. Authenticated attackers with Contributor-level access or higher can create and download full-site backup archives, including database exports and configuration files. The affected API endpoints are not explicitly specified, but the issue relates to REST API functionality. The vulnerability allows access to the entire WordPress installation data.

The Beaver Builder Page Builder plugin for WordPress is susceptible to Stored Cross-Site Scripting. This is due to missing capability checks within the `save global settings()` function and insufficient input sanitization and output escaping. Authenticated attackers with Custom-level access or higher, who have been granted Beaver Builder access, can inject arbitrary web scripts into pages. These scripts will execute whenever a user accesses an injected page via the `js` Global Settings parameter.