Webbernaut

Insufficient input sanitization and output escaping allow authenticated attackers with contributor-level access and above to perform Stored Cross-Site Scripting. This is achieved by injecting arbitrary web scripts via the `brizy-compiled-sections` parameter, which execute when a user visits the affected page.

Insufficient input sanitization and output escaping allow authenticated attackers with contributor-level access and above to perform Stored Cross-Site Scripting. This is achieved by injecting arbitrary web scripts via the `id` attribute, which execute when a user accesses the affected page.

An authorization bypass exists because the plugin fails to properly verify if a user is authorized to perform specific actions. Authenticated attackers with subscriber-level access or higher can overwrite the `post content` of any post or page, regardless of ownership, using LLM-generated text influenced by attacker-controlled keywords. This allows for black-hat SEO manipulation and unauthorized use of the site owner's paid API credits. The required nonce is emitted on every admin page, including the `/wp-admin/profile.php` endpoint, making it easily obtainable by any authenticated user.

Stored Cross-Site Scripting (XSS) occurs via the 'marker' attribute of the Google Map block. The issue stems from insufficient input sanitization and output escaping of marker title and content values. These values are stored as JSON and subsequently decoded and concatenated directly into raw HTML by the frontend script's InfoWindow content builder. Authenticated attackers with Contributor-level access or higher can inject arbitrary web scripts into pages, which execute when a user visits the affected page.

Insufficient input sanitization and output escaping allow authenticated attackers with contributor-level access and above to perform Stored Cross-Site Scripting. This is achieved by injecting arbitrary web scripts via the `data-href` parameter, which execute when a user accesses the affected page.

The plugin is susceptible to PHP Object Injection, a condition where untrusted input is deserialized, allowing an attacker to inject PHP objects. This issue occurs through the `post protection roles` parameter and can be exploited by authenticated users with Contributor-level access or higher. The impact depends on the presence of a POP chain (a sequence of gadgets used to achieve code execution or other malicious actions) within other installed plugins or themes. If such a chain exists, an attacker could potentially delete arbitrary files, retrieve sensitive data, or execute code.

Stored Cross-Site Scripting occurs due to insufficient input sanitization and output escaping. Authenticated attackers with contributor-level access or higher can inject arbitrary web scripts through the `data-label` and `data-separator` attributes of the Range Slider. These scripts execute whenever a user visits the affected page.

Insufficient input sanitization and output escaping allow unauthenticated attackers to perform Stored Cross-Site Scripting (XSS). This occurs when arbitrary web scripts are injected via comment content and user biographical information, which then execute in the browser of any user who accesses the affected pages.

Insufficient file path validation in the `unserialize()` function allows authenticated attackers with subscriber-level access or higher to delete arbitrary files on the server. This occurs when an administrator triggers a user data export while a malicious user has stored a crafted serialized XLSXWriter object payload within their display name. Deleting critical files, such as `wp-config.php`, can lead to remote code execution.

Name of the Vulnerable Software and Affected Versions: WordPress plugins using Magnific Popups library version 1.1.0 Description: The issue arises from insufficient input sanitization and output escaping on user-supplied attributes in the Magnific Popups library, allowing authenticated attackers with contributor-level access or higher to inject arbitrary web scripts in pages. This enables the execution of scripts whenever a user accesses an injected page. Recommendations: For WordPress plugins using the Magnific Popups library version 1.1.0, update the Magnific Popups library to version 1.2.0, which disables the loading of HTML within certain fields by default to fix the issue.

Name of the Vulnerable Software and Affected Versions: DethemeKit for Elementor plugin for WordPress versions up to, and including, 2.1.9 Description: The issue is related to Stored Cross-Site Scripting via the De Product Display Widget's countdown feature, caused by insufficient input sanitization and output escaping. This allows authenticated attackers with Contributor-level access and above to inject arbitrary web scripts in pages, which will execute when a user accesses an injected page. Recommendations: For versions up to, and including, 2.1.9, update to a version higher than 2.1.9 to resolve the issue. As a temporary workaround, consider restricting access to the De Product Display Widget's countdown feature to minimize the risk of exploitation.

Name of the Vulnerable Software and Affected Versions: All-in-One WP Migration and Backup plugin for WordPress versions up to, and including, 7.89 Description: The issue allows unauthenticated attackers to inject a PHP Object via deserialization of untrusted input in the `replace serialized values` function. If a POP chain is present, possibly through an additional plugin or theme, it could enable the attacker to delete arbitrary files, retrieve sensitive data, or execute code. The exploit can be triggered by an administrator exporting and restoring a backup. Recommendations: For versions up to, and including, 7.89, update to a version that fixes the PHP Object Injection issue to prevent exploitation. As a temporary workaround, consider restricting access to the `replace serialized values` function until a patch is available.

Name of the Vulnerable Software and Affected Versions: The ShopLentor – WooCommerce Builder for Elementor & Gutenberg +20 Modules – All in One Solution plugin for WordPress versions up to, and including, 3.1.0 Description: The issue is related to a Stored DOM-Based Cross-Site Scripting vulnerability in the plugin's Flash Sale Countdown module. This is due to insufficient input sanitization and output escaping on user-supplied attributes, allowing authenticated attackers with contributor-level access and above to inject arbitrary web scripts in pages. These scripts will execute whenever a user accesses an injected page. Recommendations: For versions up to, and including, 3.1.0, update to a version that addresses the insufficient input sanitization and output escaping issue in the Flash Sale Countdown module. As a temporary workaround, consider restricting access to the Flash Sale Countdown module to minimize the risk of exploitation.

Name of the Vulnerable Software and Affected Versions: The Finale Lite – Sales Countdown Timer & Discount for WooCommerce plugin for WordPress versions up to, and including, 2.19.0 Description: The issue is related to Stored DOM-Based Cross-Site Scripting via the countdown timer due to insufficient input sanitization and output escaping. This allows authenticated attackers with Contributor-level access and above to inject arbitrary web scripts in pages, which will execute whenever a user accesses an injected page. Recommendations: For versions up to, and including, 2.19.0, update to a version that addresses the insufficient input sanitization and output escaping issue to prevent Stored DOM-Based Cross-Site Scripting attacks. As a temporary workaround, consider restricting access to the countdown timer feature for users with Contributor-level access and above until a patch is available.

The issue is related to DOM-Based Stored Cross-Site Scripting via the plugin's Countdown widget due to insufficient input sanitization and output escaping on user-supplied attributes. This allows authenticated attackers with contributor-level access and above to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.

The issue is related to Stored Cross-Site Scripting via the Parallax slider due to insufficient input sanitization and output escaping. This allows authenticated attackers with Contributor-level access and above to inject arbitrary web scripts in pages, which will execute when a user accesses an injected page.

The issue arises from insufficient input sanitization and output escaping on user-supplied attributes in the Featherlight.js JavaScript library. This allows authenticated attackers with contributor-level access and above to inject arbitrary web scripts in pages. The injected scripts will execute whenever a user accesses the injected page.

The issue arises from insufficient input sanitization and output escaping on user-supplied attributes in multiple widgets, allowing authenticated attackers with contributor-level access and above to inject arbitrary web scripts in pages. These scripts will execute whenever a user accesses an injected page.

The issue arises from insufficient input sanitization and output escaping on user-supplied attributes in the 'FinalTilesGallery' shortcode. This allows authenticated attackers with contributor-level access and above to inject arbitrary web scripts in pages, which will execute whenever a user accesses an injected page.

The issue is related to Stored Cross-Site Scripting due to insufficient input sanitization and output escaping in the `data-hover` parameter. This allows authenticated attackers with Contributor-level access and above to inject arbitrary web scripts in pages, which will execute when a user accesses the injected page.