Wordfence Prism

Stored Cross-Site Scripting occurs due to insufficient input sanitization and output escaping. Authenticated attackers with contributor-level access and above can inject arbitrary web scripts via the `help title` parameter. These scripts execute whenever a user accesses the affected page.

Stored Cross-Site Scripting occurs via the `flip-box-image-upload-url-01-alt` parameter. The issue arises because the plugin uses `sanitize text field()` in functions such as `Inc/Style22::register child()` (and styles 18, 19, 20, 25, 29), which preserves double-quote characters. These values are subsequently concatenated into double-quoted HTML attributes in `Public Render/Style22::default render()` (and corresponding renderers for styles 18, 19, 20, 25, 29) without `esc attr()` escaping. Authenticated attackers with contributor-level access or higher can inject arbitrary web scripts into pages. These scripts execute when a user visits any page containing an affected `[oxilab flip box]` shortcode or block.

An issue exists where authenticated attackers with subscriber-level access and above can perform a generic SQL Injection. This occurs due to insufficient escaping of user-supplied parameters and a lack of sufficient preparation on the existing SQL query. The flaw is triggered via the `input <field id>.<part>` parameter, specifically affecting Gravity Forms name-field parts or list-field rows. Successful exploitation allows attackers to append additional SQL queries to extract sensitive information from the database. This requires a GamiPress achievement to be configured against a Gravity Forms 'field value submission' event with the corresponding form published.

Stored Cross-Site Scripting occurs due to insufficient input sanitization and output escaping. Authenticated attackers with contributor-level access or higher can inject arbitrary web scripts into pages via the `modalPlaceholder` block attribute. These scripts execute in the browser of any administrator or editor who previews or views a pending post containing the malicious payload.

Sensitive information exposure occurs via the `id` parameter. Authenticated attackers with contributor-level access or higher can extract the full rendered body content of any password-protected post across any post type by embedding a shortcode with the target post's ID. Furthermore, attackers with author-level access or higher can publish a post containing this shortcode, which exposes the password-protected content to unauthenticated visitors.

This issue involves PHP Object Injection caused by the deserialization of untrusted input. Unauthenticated attackers can inject a PHP Object, although the impact depends on the presence of a POP chain (a sequence of gadgets used to execute arbitrary code) within another installed plugin or theme. If such a chain exists, it could lead to the deletion of arbitrary files, retrieval of sensitive data, or remote code execution. Exploitation requires an administrator to have configured at least one active NexForms integration in the database. In the free tier, only POST parameter keys containing the substrings `name`, `email`, `first`, or `last` are processed by the vulnerable normalizer.

Stored Cross-Site Scripting occurs via the `items` parameter. The issue stems from insufficient input sanitization of the per-image `link` field within the `save merged items()` REST handler and `ImagesAdapter::normalize item row()` function, which preserves unknown keys verbatim. Additionally, the `Modula Helper::generate attributes()` function applies only `esc attr()` to the resulting anchor href and fails to strip the `javascript:` URL scheme. This allows authenticated attackers with Author-level access or higher to inject arbitrary web scripts into pages that execute when a user clicks a gallery tile.

Stored Cross-Site Scripting occurs due to insufficient input sanitization and output escaping. Authenticated attackers with contributor-level access and above can inject arbitrary web scripts into pages via the `headingTag` parameter. These scripts execute whenever a user accesses the affected page.

An issue exists where the `checkToken()` AJAX handler, registered under the `wp ajax pubjet-check-token` endpoint, fails to perform capability checks or nonce verification. This allows authenticated users with Subscriber-level access or higher to use the `token` GET parameter to overwrite the site-wide `pubjet settings` option via the `pubjet update setting()` function. By injecting a chosen token, an attacker can bypass authentication in the `RestApi::isTokenValid()` function, which validates the `Authorization` header against the stored token. This results in privilege escalation, allowing unauthorized access to restricted endpoints including `createReportage`, `updateReportage`, `deleteReportage`, `toggleCopyright`, and `createBacklink` to manage reportage posts and plugin states.

Stored Cross-Site Scripting occurs due to insufficient input sanitization and output escaping. Unauthenticated attackers can inject arbitrary web scripts into pages that execute when a user accesses them. The issue resides in the `iq tree chart node font family` parameter and any text control serialized into `chart data['settings']`. The vulnerability persists because the `Utils::kses post deep()` function fails to strip payloads containing only single quotes and event-handler fragments, as they do not contain disallowed HTML tags.

An authorization bypass exists because the plugin fails to properly verify if a user is authorized to perform specific actions. This allows unauthenticated attackers to write arbitrary post meta values to newly created lead posts and copy arbitrary server-side files with allowed MIME-type extensions into the plugin's uploads directory. This issue can be exploited if a published Contact Form 7 form is configured with the Save Entry (Save Lead) action enabled.

Insufficient input sanitization and output escaping allow authenticated attackers with subscriber-level access and above to perform Stored Cross-Site Scripting (XSS). This occurs when arbitrary web scripts are injected via the `wp users.display name` parameter within the REST users endpoint. The payload is stored using the WordPress core REST endpoint 'POST /wp-json/wp/v2/users/me', which bypasses the `wpum sanitize text` sanitizer used on the front-end account form. These scripts execute whenever a user accesses a page containing the injected content.

Insufficient sanitization of the `feedConfigCustom2` parameter allows authenticated attackers with Shop Manager-level access or higher to perform PHP Code Injection. The issue occurs because the `Custom2Template::evaluate return()` function passes stored template expressions directly to the PHP `eval()` function. This can lead to remote code execution and full site takeover. The `ctxfeed custom2 eval enabled` option is enabled by default, making the system exploitable without additional configuration.

Authenticated attackers with administrator-level access and above can perform a time-based SQL Injection. This occurs due to insufficient escaping of user-supplied input and lack of proper preparation of the SQL query. By manipulating the `params[searchKey]` parameter, an attacker can append additional SQL queries to extract sensitive information from the database.

Insufficient input sanitization and output escaping allow authenticated attackers with contributor-level access and above to perform Stored Cross-Site Scripting. By manipulating the `date format` parameter, an attacker can inject arbitrary web scripts into pages. The attack bypasses the `wp kses post` function during the saving process because the payload avoids using literal angle bracket characters, reconstructing the malicious HTML tags only during rendering. This allows users without the `unfiltered html` capability to execute scripts when other users access the affected page.

Stored Cross-Site Scripting occurs due to insufficient input sanitization and output escaping. Authenticated attackers with contributor-level access or higher can inject arbitrary web scripts via the `badge` parameter. These scripts execute when a user accesses the affected page, specifically targeting higher-privileged users like editors and administrators who preview pending posts containing the malicious shortcode.

An authorization bypass exists because the plugin fails to properly verify if a user is authorized to perform specific actions. Authenticated attackers with contributor-level access or higher can view stored WooCommerce payment gateway credentials, such as PayPal API username, password, and signature, and Stripe test and live secret keys. These credentials are injected directly into the HTML response of the tour edit screen and can be accessed via the raw HTTP response by viewing the page source, regardless of the CSS visibility of the modal.

Insufficient input sanitization and output escaping allow authenticated attackers with author-level access and above to perform Stored Cross-Site Scripting (XSS). An attacker can submit a percent-encoded HTML or JavaScript payload through the `slug` parameter via the REST API. This payload is stored and subsequently executes in the browser session of an administrator when the URI Editor admin page is accessed.

Insufficient input sanitization and output escaping allow unauthenticated attackers to perform Stored Cross-Site Scripting (XSS), a technique where malicious scripts are permanently stored on the target server. The issue occurs via the `vars` parameter and requires the target site to have a published page or post containing the [meta data filter results] shortcode. When a user accesses the affected page, the injected scripts execute in their browser.

Authenticated attackers with subscriber-level access and above can extract the email address and phone number of any WordPress user, including administrators. This occurs by supplying a target user's `id` in a query-string parameter while placing the attacker's own `id` in the URL path.