Youcef Hamdani

The Cincopa video and media plug-in for WordPress contains a Stored Cross-Site Scripting issue. This occurs because the plugin processes the `[cincopa]` shortcode via a `comment text` filter hook without sufficient input sanitization and output escaping. Consequently, unauthenticated attackers can inject arbitrary web scripts through post comments that execute when a user accesses the affected page.

The Email JavaScript Cloak plugin for WordPress contains a Stored Cross-Site Scripting issue. This occurs due to insufficient input sanitization and output escaping on user-supplied attributes within the 'email' shortcode. Authenticated attackers with contributor-level access or higher can inject arbitrary web scripts into pages, which then execute when a user visits the affected page.

The FV Flowplayer Video Player plugin for WordPress contains a Stored Cross-Site Scripting issue caused by insufficient input sanitization and output escaping of comment text. This allows unauthenticated attackers to inject arbitrary web scripts into pages, which execute when a user visits the affected page. Successful exploitation depends on the administrator enabling the non-default `parse comments` setting (Parse Vimeo and YouTube links) and requires a submitted comment to be approved by an administrator before the payload is delivered.

The plugin contains a Stored Cross-Site Scripting issue caused by a regex bug in the ` filter videos()` method and unescaped output in the `admin/views/form-data.php` template. An authenticated attacker with Contributor-level access can insert a crafted `<video>` tag with a `src` attribute containing a `class="` substring. This tricks the class-replacement regex into consuming an attribute-value closing quote, shifting the HTML5 parser's quote boundary and allowing attacker-controlled text to be executed as standalone event-handler attributes, such as `autofocus` and `onfocus`. The injected script then executes in the browser of any user, including administrators, who views the post.

The plugin is subject to Reflected Cross-Site Scripting, a flaw where an application includes untrusted data in a web page without proper validation, allowing attackers to execute scripts in the victim's browser. The issue exists in the `render shortcode preview()` function, which processes the `shortcode` parameter from the `$ GET` request. The function uses `stripslashes()` but fails to perform sufficient input sanitization or output escaping before passing the data to `do shortcode()`. If the input is not a valid WordPress shortcode, it is reflected directly into the page. This requires the attacker to be authenticated with at least a Subscriber-level account, as the endpoint is registered via `admin post ` and lacks nonce verification or capability checks.

The Taqnix plugin for WordPress is susceptible to Cross-Site Request Forgery (CSRF), a flaw where an attacker tricks a user into performing actions they did not intend to. This occurs because of missing nonce verification in the `taqnix delete my account()` function, specifically where the `check ajax referer()` call is commented out. Unauthenticated attackers can exploit this to force logged-in non-administrator users to delete their own accounts by inducing them to click a malicious link or visit a compromised page.

The Create DB Tables plugin for WordPress contains an authorization bypass. The plugin registers admin post action hooks for creating tables ('admin post add table') and deleting tables ('admin post delete db table') without implementing capability checks or nonce verification. Consequently, any authenticated user, including those with Subscriber-level access, can access these endpoints. The `cdbt delete db table()` function processes a user-supplied table name from the `db table` variable and executes a DROP TABLE SQL query, which allows the deletion of any database table, including critical WordPress core tables. Similarly, the `cdbt create new table()` function allows the creation of arbitrary database tables.

The plugin is subject to Cross-Site Request Forgery, a flaw where an attacker tricks a victim into performing actions they did not intend to. This occurs because the `ajax revoke token()` function, which processes the 'petjeaf disconnect' AJAX action, fails to implement nonce validation. A nonce is a unique token used to ensure that a request was intentionally sent by the user. Consequently, unauthenticated attackers can force authenticated users to revoke OAuth2 tokens, delete user meta, and delete WordPress user accounts for those with the `petjeaf member` role by inducing them to click a malicious link or visit a compromised site.

Name of the Vulnerable Software and Affected Versions PZ Frontend Manager plugin for WordPress versions up to and including 1.0.6 Description The PZ Frontend Manager plugin for WordPress is susceptible to a missing authorization issue. The `pzfm user request action callback()` function, accessible through the `wp ajax pzfm user request action` AJAX endpoint, does not perform adequate capability checks or nonce verification. This function manages user activation, deactivation, and deletion. Specifically, when the `dataType` parameter is set to 'delete', the function calls `wp delete user()` on provided user IDs without verifying sufficient permissions. This allows authenticated attackers with Subscriber-level access or higher to delete arbitrary WordPress users, including administrators, by sending a crafted request to the ''wp ajax pzfm user request action'' endpoint. Recommendations For versions up to and including 1.0.6, update to a newer version that addresses this authorization issue.

Name of the Vulnerable Software and Affected Versions WP Blockade plugin for WordPress versions up to and including 0.9.14 Description The WP Blockade plugin for WordPress is susceptible to a missing authorization issue. The plugin registers an admin post action hook 'wp-blockade-shortcode-render' which maps to the `render shortcode preview()` function. This function does not perform capability checks or nonce verification, allowing authenticated users to execute arbitrary WordPress shortcodes. The function retrieves a user-supplied `shortcode` parameter from the $ GET request, processes it with stripslashes(), and directly executes it using do shortcode(). This allows authenticated attackers with Subscriber-level access or higher to execute arbitrary shortcodes, potentially leading to information disclosure, privilege escalation, or other impacts depending on the registered shortcodes on the site. Recommendations Versions up to and including 0.9.14: Update to a version beyond 0.9.14.

The Sherk Custom Post Type Displays plugin for WordPress is susceptible to Stored Cross-Site Scripting through the 'title' shortcode attribute. This is a result of inadequate input sanitization and output escaping on the 'title' attribute of the 'sherkcptdisplays' shortcode. The `sherkcptdisplays func()` function in includes/SherkCPTDisplaysShortcode.php extracts the 'title' attribute value from shortcode atts() on line 19 and directly incorporates it into an HTML <h2> tag on line 31 without proper escaping. This allows authenticated attackers with Contributor-level access or higher to inject arbitrary web scripts into pages, which will execute when a user accesses the affected page.

The Task Manager plugin for WordPress is susceptible to an issue allowing unauthorized access to files. Attackers with Subscriber-level access or higher can potentially read the contents of arbitrary files on the server through the `callback get text from url()` function. This could expose sensitive information.

The WPFAQBlock– FAQ & Accordion Plugin For Gutenberg plugin for WordPress has a stored cross-site scripting issue. The issue is due to insufficient input sanitization and output escaping on user-supplied attributes in the `class` parameter of the `wpfaqblock` shortcode. Authenticated attackers with Contributor-level access or higher can inject arbitrary web scripts into pages. These scripts will execute when a user accesses the injected page.

The Task Manager plugin for WordPress is susceptible to arbitrary shortcode execution through the 'search' AJAX action. This occurs because of missing capability checks within the `callback search()` function and inadequate input validation. Specifically, shortcode syntax can bypass `sanitize text field()` and is then incorporated into a `do shortcode()` call. This allows authenticated attackers with Subscriber-level access or higher to execute arbitrary shortcodes on the site by injecting shortcode syntax into parameters such as `task id`, `point id`, `categories id`, or `term`. The vulnerable API endpoint is '/wp-admin/admin-ajax.php'.

The Outgrow plugin for WordPress is susceptible to Stored Cross-Site Scripting through the 'id' attribute of the 'outgrow' shortcode. This is a result of inadequate input sanitization and output escaping of user-supplied attributes. Authenticated attackers with contributor-level access or higher can inject arbitrary web scripts into pages. These scripts will execute when a user accesses the affected page.

The WordPress Content Syndication Toolkit plugin is susceptible to a Server-Side Request Forgery issue. The plugin registers an unauthenticated proxy endpoint, ''wp ajax nopriv redux p'', which accepts a URL from the `url` GET parameter without validation. This parameter is passed to `wp remote request()`, lacking built-in SSRF protection. The absence of authentication checks, nonce verification, and URL restrictions allows attackers to make web requests to arbitrary locations from the web application, potentially enabling access to internal services, network scanning, and interaction with cloud metadata endpoints.

The Instant Popup Builder plugin for WordPress is susceptible to Unauthenticated Arbitrary Shortcode Execution. This occurs because the `handle email verification page()` function creates a shortcode string from user-provided `token` and `email` GET parameters and passes it to `do shortcode()` without sufficient sanitization of square bracket characters, and lacks authorization checks. The `sanitize text field()` and `esc attr()` functions do not remove or escape square bracket characters. A malicious `token` value containing a ']' character can prematurely close a shortcode tag, allowing unauthenticated attackers to inject and execute arbitrary registered shortcodes.

The ZoomifyWP Free plugin for WordPress has a Stored Cross-Site Scripting issue. This is due to insufficient input sanitization and output escaping on user-supplied attributes. Specifically, the 'filename' parameter of the 'zoomify' shortcode is affected. Authenticated attackers with Contributor-level access or higher can inject arbitrary web scripts into pages. These scripts will execute when a user accesses the injected page.

The Bold Page Builder plugin for WordPress is susceptible to Stored Cross-Site Scripting through the `bt bb accordion item` shortcode. This is due to inadequate input sanitization and output escaping of user-supplied attributes. Authenticated attackers with contributor-level access or higher can inject arbitrary web scripts into pages. These scripts will execute when a user accesses the affected page.

The Buy Now Plus – Buy Now buttons for Stripe plugin for WordPress is susceptible to Stored Cross-Site Scripting through the `buynowplus` shortcode. Insufficient input sanitization and output escaping on shortcode attributes allows authenticated attackers with Contributor-level access or higher to inject arbitrary web scripts into pages. These scripts will execute when a user accesses the injected page.