Webbernaut

**Name of the Vulnerable Software and Affected Versions** PPWP – Password Protect Pages versions prior to 1.9.19 **Description** The plugin is susceptible to PHP Object Injection, a condition where untrusted input is deserialized, allowing an attacker to inject PHP objects. This issue occurs through the `post protection roles` parameter and can be exploited by authenticated users with Contributor-level access or higher. The impact depends on the presence of a POP chain (a sequence of gadgets used to achieve code execution or other malicious actions) within other installed plugins or themes. If such a chain exists, an attacker could potentially delete arbitrary files, retrieve sensitive data, or execute code. **Recommendations** Update to a version newer than 1.9.18. Avoid using the `post protection roles` parameter until the update is applied.

**Name of the Vulnerable Software and Affected Versions** Ultra Addons for Contact Form 7 versions prior to 3.5.44 **Description** Stored Cross-Site Scripting occurs due to insufficient input sanitization and output escaping. Authenticated attackers with contributor-level access or higher can inject arbitrary web scripts through the `data-label` and `data-separator` attributes of the Range Slider. These scripts execute whenever a user visits the affected page. **Recommendations** Update Ultra Addons for Contact Form 7 to version 3.5.44 or later.

**Name of the Vulnerable Software and Affected Versions** Motors – Car Dealership & Classified Listings Plugin versions prior to 1.4.113 **Description** Insufficient input sanitization and output escaping allow unauthenticated attackers to perform Stored Cross-Site Scripting (XSS). This occurs when arbitrary web scripts are injected via comment content and user biographical information, which then execute in the browser of any user who accesses the affected pages. **Recommendations** At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** Export User Data versions prior to 2.2.7 **Description** Insufficient file path validation in the `unserialize()` function allows authenticated attackers with subscriber-level access or higher to delete arbitrary files on the server. This occurs when an administrator triggers a user data export while a malicious user has stored a crafted serialized XLSXWriter object payload within their display name. Deleting critical files, such as `wp-config.php`, can lead to remote code execution. **Recommendations** Update the plugin to a version newer than 2.2.6.

Name of the Vulnerable Software and Affected Versions: WordPress plugins using Magnific Popups library version 1.1.0 Description: The issue arises from insufficient input sanitization and output escaping on user-supplied attributes in the Magnific Popups library, allowing authenticated attackers with contributor-level access or higher to inject arbitrary web scripts in pages. This enables the execution of scripts whenever a user accesses an injected page. Recommendations: For WordPress plugins using the Magnific Popups library version 1.1.0, update the Magnific Popups library to version 1.2.0, which disables the loading of HTML within certain fields by default to fix the issue.

Name of the Vulnerable Software and Affected Versions: DethemeKit for Elementor plugin for WordPress versions up to, and including, 2.1.9 Description: The issue is related to Stored Cross-Site Scripting via the De Product Display Widget's countdown feature, caused by insufficient input sanitization and output escaping. This allows authenticated attackers with Contributor-level access and above to inject arbitrary web scripts in pages, which will execute when a user accesses an injected page. Recommendations: For versions up to, and including, 2.1.9, update to a version higher than 2.1.9 to resolve the issue. As a temporary workaround, consider restricting access to the De Product Display Widget's countdown feature to minimize the risk of exploitation.

Name of the Vulnerable Software and Affected Versions: All-in-One WP Migration and Backup plugin for WordPress versions up to, and including, 7.89 Description: The issue allows unauthenticated attackers to inject a PHP Object via deserialization of untrusted input in the `replace serialized values` function. If a POP chain is present, possibly through an additional plugin or theme, it could enable the attacker to delete arbitrary files, retrieve sensitive data, or execute code. The exploit can be triggered by an administrator exporting and restoring a backup. Recommendations: For versions up to, and including, 7.89, update to a version that fixes the PHP Object Injection issue to prevent exploitation. As a temporary workaround, consider restricting access to the `replace serialized values` function until a patch is available.

Name of the Vulnerable Software and Affected Versions: The ShopLentor – WooCommerce Builder for Elementor & Gutenberg +20 Modules – All in One Solution plugin for WordPress versions up to, and including, 3.1.0 Description: The issue is related to a Stored DOM-Based Cross-Site Scripting vulnerability in the plugin's Flash Sale Countdown module. This is due to insufficient input sanitization and output escaping on user-supplied attributes, allowing authenticated attackers with contributor-level access and above to inject arbitrary web scripts in pages. These scripts will execute whenever a user accesses an injected page. Recommendations: For versions up to, and including, 3.1.0, update to a version that addresses the insufficient input sanitization and output escaping issue in the Flash Sale Countdown module. As a temporary workaround, consider restricting access to the Flash Sale Countdown module to minimize the risk of exploitation.

Name of the Vulnerable Software and Affected Versions: The Finale Lite – Sales Countdown Timer & Discount for WooCommerce plugin for WordPress versions up to, and including, 2.19.0 Description: The issue is related to Stored DOM-Based Cross-Site Scripting via the countdown timer due to insufficient input sanitization and output escaping. This allows authenticated attackers with Contributor-level access and above to inject arbitrary web scripts in pages, which will execute whenever a user accesses an injected page. Recommendations: For versions up to, and including, 2.19.0, update to a version that addresses the insufficient input sanitization and output escaping issue to prevent Stored DOM-Based Cross-Site Scripting attacks. As a temporary workaround, consider restricting access to the countdown timer feature for users with Contributor-level access and above until a patch is available.

**Name of the Vulnerable Software and Affected Versions** HT Mega – Absolute Addons For Elementor plugin for WordPress versions up to, and including, 2.8.2 **Description** The issue is related to DOM-Based Stored Cross-Site Scripting via the plugin's Countdown widget due to insufficient input sanitization and output escaping on user-supplied attributes. This allows authenticated attackers with contributor-level access and above to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. **Recommendations** For versions up to, and including, 2.8.2, update to a version that includes a complete fix for the issue, as the current version has an incomplete fix.

**Name of the Vulnerable Software and Affected Versions** The Essential Blocks – Page Builder Gutenberg Blocks, Patterns & Templates plugin for WordPress versions up to, and including, 5.3.1 **Description** The issue is related to Stored Cross-Site Scripting via the Parallax slider due to insufficient input sanitization and output escaping. This allows authenticated attackers with Contributor-level access and above to inject arbitrary web scripts in pages, which will execute when a user accesses an injected page. **Recommendations** For versions up to, and including, 5.3.1, update to a version that includes the necessary input sanitization and output escaping fixes to prevent Stored Cross-Site Scripting attacks. As a temporary workaround, consider restricting access to the Parallax slider feature for users with Contributor-level access and above until a patch is available.

**Name of the Vulnerable Software and Affected Versions** WordPress plugins using Featherlight.js versions 1.7.13 through 1.7.14 **Description** The issue arises from insufficient input sanitization and output escaping on user-supplied attributes in the Featherlight.js JavaScript library. This allows authenticated attackers with contributor-level access and above to inject arbitrary web scripts in pages. The injected scripts will execute whenever a user accesses the injected page. **Recommendations** For WordPress plugins using Featherlight.js versions 1.7.13 through 1.7.14, consider updating Featherlight.js to a version outside of the affected range as a fix, or temporarily restrict contributor-level access to prevent exploitation until a patch is available.

**Name of the Vulnerable Software and Affected Versions** The Master Addons – Elementor Addons with White Label, Free Widgets, Hover Effects, Conditions, & Animations plugin for WordPress versions up to, and including, 2.0.7.2 **Description** The issue arises from insufficient input sanitization and output escaping on user-supplied attributes in multiple widgets, allowing authenticated attackers with contributor-level access and above to inject arbitrary web scripts in pages. These scripts will execute whenever a user accesses an injected page. **Recommendations** For versions up to, and including, 2.0.7.2, update to a version that addresses the insufficient input sanitization and output escaping issue to prevent stored cross-site scripting attacks.

**Name of the Vulnerable Software and Affected Versions** Image Photo Gallery Final Tiles Grid plugin for WordPress versions up to, and including, 3.6.0 **Description** The issue arises from insufficient input sanitization and output escaping on user-supplied attributes in the 'FinalTilesGallery' shortcode. This allows authenticated attackers with contributor-level access and above to inject arbitrary web scripts in pages, which will execute whenever a user accesses an injected page. **Recommendations** For versions up to, and including, 3.6.0, update to a version that includes the necessary input sanitization and output escaping fixes to prevent stored cross-site scripting attacks.

**Name of the Vulnerable Software and Affected Versions** Chaty plugin for WordPress versions up to and including 3.3.5 **Description** The issue is related to Stored Cross-Site Scripting due to insufficient input sanitization and output escaping in the `data-hover` parameter. This allows authenticated attackers with Contributor-level access and above to inject arbitrary web scripts in pages, which will execute when a user accesses the injected page. **Recommendations** For Chaty plugin for WordPress versions up to and including 3.3.5, update to a version that addresses the insufficient input sanitization and output escaping issue in the `data-hover` parameter to prevent Stored Cross-Site Scripting attacks.

**Name of the Vulnerable Software and Affected Versions** Lenix Elementor Leads addon plugin for WordPress versions up to, and including, 1.8.2 **Description** The Lenix Elementor Leads addon plugin for WordPress is vulnerable to Stored Cross-Site Scripting via a URL form field due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. **Recommendations** For versions up to, and including, 1.8.2, update to version 1.8.3 or later to resolve the issue. As a temporary workaround, consider disabling the URL form field in the Lenix Elementor Leads addon plugin until a patch is available. Restrict access to the plugin's functionality to minimize the risk of exploitation.

**Name of the Vulnerable Software and Affected Versions** The Visualizer: Tables and Charts Manager for WordPress versions up to, and including, 3.11.8 **Description** The issue is related to Stored Cross-Site Scripting via the plugin's Import Data From File feature due to insufficient input sanitization and output escaping on user-supplied attributes. This allows authenticated attackers with contributor-level access and above to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. **Recommendations** For versions up to, and including, 3.11.8, update to a version newer than 3.11.8 to resolve the issue. As a temporary workaround, consider restricting access to the Import Data From File feature to minimize the risk of exploitation. Additionally, restrict contributor-level access and above to trusted users only.

**Name of the Vulnerable Software and Affected Versions** ElementsKit Elementor addons plugin for WordPress versions up to, and including, 3.4.0 **Description** The issue is related to Stored Cross-Site Scripting via the plugin's Image Accordion widget due to insufficient input sanitization and output escaping on user-supplied attributes. This allows authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. **Recommendations** For versions up to, and including, 3.4.0, update to a version later than 3.4.0 to resolve the issue. As a temporary workaround, consider restricting access to the Image Accordion widget to minimize the risk of exploitation. Additionally, restrict contributor-level access and above to authorized personnel only.

**Name of the Vulnerable Software and Affected Versions** DethemeKit For Elementor plugin for WordPress versions up to, and including, 2.36 **Description** The issue allows authenticated attackers with Contributor-level access and above to extract data from password protected, private, draft, or scheduled posts by duplicating them. This is due to insufficient restrictions on which posts can be duplicated via the `duplicate post()` function. **Recommendations** For versions up to, and including, 2.36, consider disabling the `duplicate post()` function until a patch is available to prevent exploitation. Restrict access to sensitive posts and ensure that only authorized users have Contributor-level access and above to minimize the risk of data exposure.

**Name of the Vulnerable Software and Affected Versions** Rank Math SEO – AI SEO Tools to Dominate SEO Rankings plugin for WordPress versions up to, and including, 1.0.235 **Description** The issue is related to Stored Cross-Site Scripting via the plugin's Rank Math API due to insufficient input sanitization and output escaping on user-supplied attributes. This allows authenticated attackers with contributor-level access and above to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. **Recommendations** For versions up to, and including, 1.0.235, update to a version higher than 1.0.235 to resolve the issue. As a temporary workaround, consider restricting access to the Rank Math API to minimize the risk of exploitation. Additionally, limiting contributor-level access and above can help reduce the attack surface until a patch is applied.