Zaim

The Bold Timeline Lite plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the `supertitle` and `subtitle` attributes of the `bold timeline item` shortcode in all versions up to, and including, 1.2.8 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with Contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.

**Name of the Vulnerable Software and Affected Versions** SKT Skill Bar versions prior to 2.7 **Description** Stored Cross-Site Scripting occurs due to insufficient input sanitization and output escaping of the `chart size` attribute within the `skillwrapper` shortcode. The attribute is concatenated directly into an inline `<style>` block, allowing authenticated attackers with Contributor-level access or higher to inject arbitrary web scripts into pages. These scripts execute whenever a user visits the affected page. **Recommendations** Update to a version newer than 2.6. As a temporary mitigation, restrict the use of the `chart size` attribute in the `skillwrapper` shortcode.

**Name of the Vulnerable Software and Affected Versions** Simple Yearly Archive versions prior to 2.2.5 **Description** Stored Cross-Site Scripting occurs due to insufficient input sanitization and output escaping on user supplied attributes. Authenticated attackers with Contributor-level access and above can inject arbitrary web scripts via the `posttype` attribute of the `SimpleYearlyArchive` shortcode. These scripts execute whenever a user accesses the affected page. **Recommendations** Update Simple Yearly Archive to version 2.2.5 or later. As a temporary mitigation, restrict the ability of users with Contributor-level access to edit pages or posts containing the `SimpleYearlyArchive` shortcode.

**Name of the Vulnerable Software and Affected Versions** WPC Badge Management for WooCommerce versions prior to 3.1.7 **Description** Stored Cross-Site Scripting occurs due to insufficient input sanitization and output escaping on user-supplied attributes. Authenticated attackers with Contributor-level access and above can inject arbitrary web scripts through the `text` attribute of the `wpcbm best seller` shortcode. These scripts execute whenever a user accesses the affected page. **Recommendations** Update WPC Badge Management for WooCommerce to a version newer than 3.1.6. As a temporary mitigation, restrict the ability of users with Contributor-level access to edit pages or use the `wpcbm best seller` shortcode.

**Name of the Vulnerable Software and Affected Versions** WP Customer Area versions prior to 8.3.6 **Description** Stored Cross-Site Scripting occurs due to insufficient input sanitization and output escaping on the `type` attribute of the `customer-area-protected-content` shortcode. Authenticated attackers with Contributor-level access or higher can inject arbitrary web scripts into pages, which execute when a user visits the affected page. **Recommendations** Update WP Customer Area to version 8.3.6 or later.

**Name of the Vulnerable Software and Affected Versions** fresh Podcaster plugin for WordPress versions prior to 1.0.8 **Description** Stored Cross-Site Scripting occurs due to insufficient input sanitization and output escaping on user supplied attributes within the `freshpodcaster` shortcode. Authenticated attackers with contributor-level access or higher can inject arbitrary web scripts into pages, which execute when a user visits the affected page. **Recommendations** Update the plugin to a version newer than 1.0.7.

**Name of the Vulnerable Software and Affected Versions** Jeg Kit for Elementor versions prior to 3.2.7 **Description** Stored Cross-Site Scripting occurs due to insufficient input sanitization and output escaping of the description attribute within the `render body()` method of the `Image Box View` class. While other attributes are processed using `esc attr()`, the value of the `sg body description` parameter in the Image Box widget is concatenated directly into the HTML body context. This allows authenticated attackers with Contributor-level access or higher to inject arbitrary web scripts into pages, which execute when a user visits the affected page. **Recommendations** Update to a version newer than 3.2.6. As a temporary mitigation, restrict access to the Image Box widget or avoid using the `sg body description` parameter until the update is applied.

**Name of the Vulnerable Software and Affected Versions** Bookero.pl – system rezerwacji online plugin for WordPress versions prior to 2.3 **Description** Stored Cross-Site Scripting occurs due to insufficient input sanitization and output escaping in the `bookero products()` function. Authenticated attackers with contributor-level access and above can inject arbitrary web scripts via the `hide products` and `filter products` attributes of the `bookero products` shortcode. These scripts are concatenated directly into an inline `<script>` block and execute when a user accesses the affected page. **Recommendations** Update the plugin to a version later than 2.2. As a temporary mitigation, restrict contributor-level access to editing pages that utilize the `bookero products` shortcode.

**Name of the Vulnerable Software and Affected Versions** Website Builder by SeedProd - Theme Builder, Landing Page Builder, Coming Soon Page, Maintenance Mode versions prior to 6.20.3 **Description** Stored Cross-Site Scripting occurs due to insufficient input sanitization and output escaping on user supplied attributes within the `seedprodnestedmenuwidget` shortcode. This allows authenticated attackers with contributor level access and above to inject arbitrary web scripts into pages, which execute when a user accesses the affected page. **Recommendations** Update to a version newer than 6.20.2.

**Name of the Vulnerable Software and Affected Versions** Mosaic Gallery – Advanced Gallery versions prior to 1.2.1 **Description** A Cross Site Scripting (XSS) issue exists that allows users with Contributor privileges to execute malicious scripts. XSS is a type of security flaw where an attacker injects scripts into web pages viewed by other users. **Recommendations** Update Mosaic Gallery – Advanced Gallery to a version newer than 1.2.0.

**Name of the Vulnerable Software and Affected Versions** Structured Content versions prior to 1.7.1 **Description** Cross Site Scripting (XSS) allows an attacker with contributor privileges to execute malicious scripts in the browser of other users. **Recommendations** Update Structured Content to a version newer than 1.7.0.

**Name of the Vulnerable Software and Affected Versions** Surbma | Yoast SEO Breadcrumb Shortcode versions prior to 1.3 **Description** Cross Site Scripting (XSS) allows an attacker with contributor privileges to execute malicious scripts in the browser of other users. XSS is a security flaw where an application includes untrusted data in a web page without proper validation or escaping. **Recommendations** Update Surbma | Yoast SEO Breadcrumb Shortcode to a version newer than 1.2.

**Name of the Vulnerable Software and Affected Versions** LearnPress versions prior to 4.4.1 **Description** Stored Cross-Site Scripting occurs due to insufficient input sanitization and output escaping in the `FilterCourseTemplate::sections()` function. An authenticated attacker with contributor-level access or higher can inject arbitrary web scripts through the `class wrapper form` attribute of the `class wrapper form` shortcode. The issue arises because the `FilterCourseShortcode::render()` handler fails to apply `shortcode atts()` filtering, allowing raw user attributes to be inserted into an HTML class attribute via `sprintf()` without proper `esc attr()` escaping. These scripts execute whenever a user visits the affected page. **Recommendations** Update LearnPress to a version newer than 4.4.0. As a temporary mitigation, restrict users with contributor-level access from creating or editing pages containing shortcodes.

**Name of the Vulnerable Software and Affected Versions** RealMag777 MDTF wp-meta-data-filter-and-taxonomy-filter versions through 1.3.5 **Description** The software contains a flaw related to improper input neutralization during web page generation, leading to a DOM-based cross-site scripting issue. This allows for the execution of malicious scripts within the user's browser. **Recommendations** Versions through 1.3.5 should be updated to a newer, secure version when available.

**Name of the Vulnerable Software and Affected Versions** Podlove Podcast Publisher versions through 4.3.3 **Description** The software is susceptible to a cross-site scripting issue due to improper input validation during web page generation. This allows for the injection of malicious scripts, specifically Stored XSS. The issue affects the Podlove Podcast Publisher WordPress plugin. **Recommendations** Versions prior to and including 4.3.3 are affected. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** Themify Event Post versions through 1.3.4 **Description** The software contains a flaw due to improper neutralization of input during web page generation, leading to a Stored Cross-site Scripting (XSS) issue. This allows for the injection of malicious scripts into web pages. The vulnerability exists in the `themify-event-post` component. The issue allows for Stored XSS, meaning the malicious script is persistently stored on the target server. **Recommendations** Update Themify Event Post to a version later than 1.3.4.

**Name of the Vulnerable Software and Affected Versions** Active Products Tables for WooCommerce versions through 1.0.7 **Description** The software contains a flaw related to improper handling of user-supplied data during web page creation, which can lead to a DOM-based cross-site scripting (XSS) issue. This allows an attacker to inject malicious scripts into web pages viewed by other users. The issue affects the `profit-products-tables-for-woocommerce` component. **Recommendations** Update Active Products Tables for WooCommerce to a version newer than 1.0.7.

**Name of the Vulnerable Software and Affected Versions** Stylish Cost Calculator versions through 8.1.8 **Description** The software contains a flaw due to improper handling of user-supplied data when creating web pages, leading to a potential Cross-site Scripting (XSS) issue. This specific instance allows for Stored XSS, meaning malicious scripts can be stored and executed by other users. The vulnerability exists because the application does not adequately sanitize input, potentially allowing attackers to inject malicious code into web pages viewed by other users. **Recommendations** Update Stylish Cost Calculator to a version later than 8.1.8.

**Name of the Vulnerable Software and Affected Versions** BuddyDev MediaPress versions through 1.6.2 **Description** The software contains a flaw due to improper neutralization of input during web page generation, leading to a Stored Cross-site Scripting (XSS) condition. This allows for the injection of malicious scripts into web pages viewed by other users. The vulnerability affects the MediaPress plugin. No information was provided regarding the number of potentially affected devices or any real-world incidents where this issue was exploited. The vulnerability allows for Stored XSS, meaning that malicious scripts are permanently stored on the target server. **Recommendations** Update BuddyDev MediaPress to a version newer than 1.6.2.

**Name of the Vulnerable Software and Affected Versions** WP for church Sermon Manager versions through 2.30.0 **Description** The software contains a flaw related to improper input handling during web page creation, specifically a Stored Cross-site Scripting issue. This allows for the injection of malicious scripts. The affected component allows an attacker to execute arbitrary code within the context of a user's browser. The vulnerability impacts the Sermon Manager plugin. **Recommendations** Update WP for church Sermon Manager to a version later than 2.30.0.