Multiple Authenticated (contributor or higher user role) Stored Cross-Site Scripting (XSS) vulnerabilities in wpWax Team plugin <= 1.2.6 at WordPress.

*   Details
*   Reviews
*   Support
*   Development

This plugin has been closed as of May 3, 2022 and is not available for download. Reason: Licensing/Trademark Violation.

I looked through plenty of plugins to display our team the way I wanted and there was always something missing. This one has it all: a great grid, pop-up more info on each person, nicely displayed social icons, additional fields for skills and more info. Really cool and super easy to use! The only two little things that were missing in our experience were: 1) some customisable features are not responsive (like font size of colour, even in the pro version) 2) we needed some additional customisation, like removing animation, changing titles of additional fields, etc. The plug-in support has helped us with everything adding code directly on the site! Super helpful and nice, definitely recommended 🙂

The plugin has several options with which one can modify the look of it. I especially want to complement the great support I got. I asked whether it would be possible to get a new feature to the plugin and it didn't take long and they had updated the plugin to include the requested feature. Great plugin and a great team behind it!

Read all 2 reviews

“Team” is open source software. The following people have contributed to this plugin.

Contributors

*    wpWax

CVE-2022-34650: Team

Severity of code execution bug mitigated by ‘high uptake’ of previous patch

James Walker 22 July 2022 at 13:40 UTC

Severity of code execution bug mitigated by ‘high uptake’ of previous patch

Zyxel has released patches for several of its firewall products following the discovery of two security vulnerabilities that left business networks open to exploitation.

First on the list is CVE-2022-2030, an authenticated directory traversal vulnerability in the Common Gateway Interface (GLI) programs of some Zyxel firewalls. This was caused by specific character sequences within an improperly sanitized URL.

The second flaw, CVE-2022-30526, is a local privilege escalation (LPE) vulnerability that was identified in the command-line interface (CLI) of some firewall versions.

Left unpatched, the flaw could allow a local attacker to execute some OS commands with root privileges in some directories on a vulnerable device.

**Breaking the chain**

The privilege escalation issue impacting Zyxel firewalls was discovered by security researchers from Rapid7. The vulnerability allows a low privileged user, such as nobody, to escalate to root on affected firewalls.

As explained in a technical blog post from Rapid7 on July 19, an attacker could establish shell access on the firewall by exploiting CVE-2022-30525 – a separate bug that was discovered by the same researchers and fixed by Zyxel earlier this year.

Read more of the latest infosec research news

Fortunately, the severity of this latest vulnerability has been mitigated by strong uptake of the previous fix.

Jake Baines, lead security researcher at Rapid7, told _The Daily Swig_: “CVE-2022-30526 is useless unless you are able to chain it with a vulnerability like CVE-2022-30525.”

He added: “We are happy to report that we’ve seen very high uptake on the patch for CVE-2022-30525, so Zyxel’s patch for CVE-2022-30526 is almost purely a defensive measure – at least until another remote code execution vulnerability is found in their firewalls. Then the patch will have paid off.”

The path traversal issue was discovered by Italian security researcher Maurizio Agazzini of HN Security.

“We agree with Zyxel to release further details of the vulnerability around mid-August in order to allow their customers to have the time to patch all systems,” Agazzini told us.

**Firmware patches**

The latest vulnerabilities affect various versions of several Zyxel firewalls, including USG Flex, ATP Series, VPN Series, and USG ZyWall.

The table below lists the vulnerable versions of each product line:

Firmware patches are now available. “Users are advised to install them for optimal protection,” Zyxel said.  

Full details can be found in an accompanying security advisory.

**YOU MIGHT ALSO LIKE** WordPress plugin security audit unearths dozens of flaws impacting 60,000 websites

Zyxel firewall vulnerabilities left business networks open to abuse

Unauthenticated Arbitrary Option Update vulnerability in biplob018's Shortcode Addons plugin <= 3.0.2 at WordPress.

CVE-2022-34487: Shortcode Addons- with Visual Composer, Divi, Beaver Builder and Elementor Extension

Unauthenticated WordPress Options Change vulnerability in Biplob Adhikari's Accordions plugin <= 2.0.2 at WordPress.

CVE-2022-33198: Accordions – Multiple Accordions or FAQs Builder

Authenticated (custom plugin role) Arbitrary File Read via Export function vulnerability in GiveWP's GiveWP plugin <= 2.20.2 at WordPress.

CVE-2022-31475: GiveWP – Donation Plugin and Fundraising Platform

Authenticated Stored Cross-Site Scripting (XSS) vulnerability in Florent Maillefaud's WP Maintenance plugin <= 6.0.7 at WordPress.

*   Details
*   Reviews
*   Installation
*   Support
*   Development

The WP Maintenance plugin allows you to put your website on the waiting time for you to do maintenance or launch your website. Personalize this page, pictures and countdown with:

**Features**

*   Choice texts colors and fonts
*   Upload logo picture
*   Upload background picture or pattern
*   Countdown
*   Custom Code Header for Analytics ready
*   Social Networks ready
*   Customize CSS
*   Insert for shorcode (Newletter or Contact form)
*   Enable “503 Service temporarily unavailable”
*   Choose access by Roles and Capabilities
*   Choose access by IP address
*   Choose access by ID Pages

wp-maintenance.pot file available

1.  Upload the full directory into your ‘/wp-content/plugins’ directory
2.  Activate the plugin at the plugin administration page

You will find ‘WP Maintenance’ menu in your WordPress admin panel

**WP Maintenance Needs Your Support**

It is hard to continue development and support for this free plugin without contributions from users like you. If you enjoy using WP Maintenance and find it useful, please consider making a donation. Your donation will help encourage and support the plugin’s continued development and better user support.

**I have activated plugin and don’t see any changes, looks like plugin is not working.**

This is normal because you are logged in as an administrator. Try a different browser or use the preview link. If you have registered as a wordpress user, you see the site in normal mode.

**I have disabled plugin but I don’t see any changes, I have always the maintenance page, looks like plugin is not working.**

You have a cache plugin ? Try to purge it and try again.

**Where can I find out the login page to get to the site?**

You can use your administrator access or create new user in wordpress dashboard  
https://yousite.com/wp-admin/

**Can I change the plugin code?**

Yes. Thank you for submitting your changes to update the plugin.

**Translations**

You can translate WP Maintenance on **translate.wordpress.org**.

très bon plugin, seul bémol il ne fonctionne pas sur les mobiles, impossible de l'activer sur les mobiles

Propre, efficace, maintenue, gratuite, que demander de + ? Merci au dev !

Efficace et pratique. Merci à l'Auteur

Je pensais avoir trouvé un super widget avec celle-ci, mais elle réagit vraiment bizarrement au point ou parfois on perd du temps pour savoir si des choses marchent. La page rs notamment. On dit que l'on peut mettre ses propres images rs. Cela ne marche pas... et je ne sais pas pourquoi... d'autant que l'appli semble vous aider en ajoutant l'url du dossier de destination. Mais quand vous complétez le chemin et enregistrez... ben il commence forcement l'enregistrement par https... parmi les icônes proposées une série fonctionne pas... tout ça est bien dommage. Enfin si l'auteur peut déjà "clarifier" et comment on met ses propres icones ce serait cool.

Отличный дизайн плагина и полный перевод на русский язык. Спасибо!

3 mn chrono pour ma page ! Bravo.

Read all 71 reviews

“WP Maintenance” is open source software. The following people have contributed to this plugin.

Contributors

*    Florent Maillefaud

CVE-2022-30536: WP Maintenance

Broken Access Control vulnerability in YIKES Inc. Custom Product Tabs for WooCommerce plugin <= 1.7.7 at WordPress leading to &yikes-the-content-toggle option update.

*   Details
*   Reviews
*   Installation
*   Support
*   Development

This plugin extends WooCommerce to allow shop owners to add custom tabs to products. The tabs are displayed on the individual product pages to the right of the default “Description” tab.

Individual product tabs are managed on the WooCommerce Edit Product screen and can be added on a per product basis. You can also create saved tabs and add them to multiple products as needed. Tabs can be easily added, deleted and rearranged.

Tab content areas use the standard WordPress text editor and may contain text, images, HTML or shortcodes.

If you experience any problems, please submit a ticket on our Free WordPress Support Forums and we’ll look in to it as soon as possible.

This plugin is compatible with WPML.

Upgrade to Custom Product Tabs Pro for great enhanced features!

1.  Download the plugin .zip file and make note of where on your computer you downloaded it to.
2.  In the WordPress admin (yourdomain.com/wp-admin) go to Plugins > Add New or click the “Add New” button on the main plugins screen.
3.  On the following screen, click the “Upload Plugin” button.
4.  Browse your computer to where you downloaded the plugin .zip file, select it and click the “Install Now” button.
5.  After the plugin has successfully installed, click “Activate Plugin” and enjoy!
6.  Edit a product, then click on ‘Custom Tab’ within the ‘Product Data’ panel
7.  Create saved, reusable tabs under Settings > Custom Product Tabs for WooCommerce

**All documentation can be found in our Knowledge Base.**

**Where do I go to add tabs to a product?**

When editing a product in WooCommerce, you will find “Custom Tabs” in the bottom left corner of the Product Data box. Click on “Custom Tabs” to reveal the custom tab manager.

**Where will these tabs appear?**

When the product is viewed on your website you will see the tabs you created to the right of the default “Description” tab.

**How do I change the order of the tabs?**

To change the order of custom tabs use the up and down “Move tab order” arrows.

**How do saved tabs work?**

Saved tabs are tabs you can create and then add to as many products you would like. If you update a saved tab, the changes will be updated for all products using that tab.

**How do I create saved tabs?**

To create a saved tab, click on the ‘Custom Product Tabs’ item on the WordPress dashboard menu and click the “Add Tab” button.

**How do I add a saved tab to a product?**

To add a saved tab to a product, go to the custom tabs section on the edit product screen, click the ‘Add a Saved Tab’ button above the tab, and choose which tab you would like to add.

**What does overriding a saved tab do?**

When using a saved tab on a product, a checkbox appears with the message ‘Override Saved Tab’ If you click that checkbox, edit the tab and save, the tab will be changed for that product only. Any edits to that saved tab under ‘Custom Product Tabs’ will not be applied to that product.

**Why does the WYSIWYG editor default to the ‘Visual’ tab?**

This was added in version 1.5 to support the dynamic adding and removing of the wp\_editor/WYSIWYG editor. Without this setting, the WYSIWYG editor does not load the correct toolbar and the editor can potentially break.

**Does custom tab data get exported with standard WooCommerce product data?**

Yes! Since v1.4 we’ve added the necessary code to ensure the custom tab data is exported with all of the other standard WooCommerce data. This ensures a smooth transition of products between sites.

Thank you for creating this useful plugin.

Hey Guys, I really respect that you think about the others. <3 <3 <3

Doesn't display new tabs, even with the apply\_filters checked. Useless for me.

I just added this plugin to a site and so far it works great. Thanks to the author!

Thank you very much for such helpful and very simple tabs for the woocommerce.

Every time there is an update something stops working.

Read all 145 reviews

“Custom Product Tabs for WooCommerce” is open source software. The following people have contributed to this plugin.

Contributors

**1.7.9 – June 21st, 2022**

*   Address minor vulnerability
*   Fix issue related to Divi Builder

**1.7.7 – March 8th, 2021**

*   Housekeeping

**1.7.6 – October 19th, 2020**

*   WooCommerce 4.6 tested.

**1.7.5 – September 18th, 2020**

*   Swapping (deprecated) wp\_make\_content\_images\_responsive for wp\_filter\_content\_tags in our content filter. Thanks @stephencd!

**1.7.4 – September 12th, 2020**

*   WooCommerce 4.5.

**1.7.3 – August 19th, 2020**

*   WooCommerce 4.4.
*   Fixes issues related to WordPress 5.5.

**1.7.1 – March 13th, 2020**

*   Fixes a bug with product display in certain conditions.

**1.7.0 – March 10th, 2020**

*   Toggle the content filter on or off setting added. Use this to help with compatibility.
*   Support WooCommerce 4.0.
*   Support WordPress 5.4.

**1.6.13 – January 22nd, 2020**

*   Support WooCommerce 3.9.

**1.6.12 – November 20th, 2019**

*   Support WooCommerce 3.8.

**1.6.11 – September 25th, 2019**

*   Adding additional checks to post global before enqueueing assets.

**1.6.10 – April 19th, 2019**

*   Updating WC compatibility.
*   Fixing JS issue with WP backwards compatibility for versions < 4.7.

**1.6.9 – January 18th, 2019**

*   Fixing an issue where the visual editor shows a small portion of the content on product edit pages.

**1.6.8 – January 2nd, 2019**

*   Fixing some HTML markup.
*   Applying PHPCS fixes.

**1.6.7 – December 18th, 2018**

*   Adding filter to help allow importing of custom tabs.
*   Changing our export filters so custom tabs work with WooCommerce’s native meta export/import features.
*   The default capability for all admin pages is now publish_products.

**1.6.6 – October 26th, 2018**

*   Bumping WooCo Compatibility.
*   Changed wp_send_json_failure() to wp_send_json_error().

**1.6.5 – October 3rd, 2018**

*   Bumping WooCo Compatibility.

**1.6.4 – January 9th, 2018**

*   Happy new year!
*   The editor is now vertically resizeable.
*   The default capability for interacting with saved tabs is now Publish Products (publish\_products)

**1.6.3 – November 1st, 2017**

*   Declaring compatibility with WooCommerce and WordPress

**1.6.2 – October 13th, 2017**

*   Fixed a PHP Fatal Error that was occurring for users with PHP versions < 5.5.
*   Updated some of our documentation and language

**1.6.1 – October 12th, 2017**

*   Fixed an issue with handling foreign characters. Foreign character tab titles should be working properly now. Sorry about that everyone!
*   Added support for native WooCommerce exporting. You can now export and import your tabs with just WooCommerce!
*   Fixed some styling issues
*   Added a new “Support” page
*   Added a new “Go Pro” page – check out Custom Product Tabs Pro

**1.6.0 – October 9th, 2017**

*   Complete re-organization of all plugin files and removal of legacy code
*   Added a “name” field for saved tabs. This field is used only on the admin as a way of identifying tabs.
*   Tab “slugs” are now created via the WP Core sanitize_title() function. This should allow meaningful tab slugs when foreign characters are used in a title.
*   Re-added the “Add Media” button to the editor when it’s first initialized. This had disappeared when WP4.8 was released.
*   Fixed some issues with loading saved tab content into the editor. This should fix the issue that some users were experiencing where adding a saved tab would only work the second time.
*   Setting the width of the editor to 100%.
*   Custom Product Tabs is now a top-level menu item instead of a sub-menu item.
*   Cleaning up the saved tab’s array so we don’t leave orphaned data (e.g. added a hook so we delete a product’s tabs when the product is deleted)
*   Added a data update script to update all existing tab slugs to use sanitize_title() function.
*   Generated new POT file.
*   Added support and hooks for our new Custom Product Tabs Pro plugin!

**1.5.17 – August 23rd, 2017**

*   Cleaning up some PHP Notices being thrown – thanks to @ZombiEquinox on GitHub for reporting this
*   Updating readme compatibility values

**1.5.16 – August 1st, 2017**

*   Adding a proper deactivation hook. The plugin will leave no trace.

**1.5.15 – June 8th, 2017**

*   WordPress 4.8 support – using the new JavaScript Editor API functions to instantiate the editor and removed requiring WordPress’ wpembed plugin

**1.5.14 – May 8th, 2017**

*   Updating some CSS for the admin tabs table – the table should now render correctly regardless of “Visual” or “Text” tab and the saved tabs list should include a scrollbar if necessary

**1.5.13 – April 17th, 2017**

*   Updating a WooCommerce action – now using the proper one instead of a deprecated one

**1.5.12 – April 10th, 2017**

*   Adding some CSS to allow the editor’s text mode to function properly

**1.5.11 – April 6th, 2017**

*   Checking for the existence of the get_id() method before using it.

**1.5.10 – April 5th, 2017**

*   Duplicating a product now duplicates custom product tabs and saved tabs correctly

**1.5.9 – April 4th, 2017**

*   Tested and updated the plugin for WooCommerce v3.0.0

**1.5.8 – March 17th, 2017**

*   Replaced the saved tab’s ID w/ an “Add New” button on the single saved tab page – it should be easier to add saved tabs in bulk now
*   Added a filter for all of the custom tab content – it should allow you to apply custom logic such as permissions in one central location
*   Changed the way saved tabs are applied on the edit product page – it should allow embed content (especially Google Maps Embed content) to function correctly in all instances.

**1.5.7 – February 27th, 2017**

*   Duplicating a product now duplicates the corresponding saved tabs correctly
*   Added two filters (yikes_woo_use_the_content_filter and yikes_woo_filter_main_tab_content) to help provide a work-around to using the standard the_content filter which has caused numerous issues due to plugin conflicts.

**1.5.6 – February 16th, 2017**

*   Fixed an issue where the “Add a Saved Tab” modal was displaying YouTube videos if a saved tab had a YouTube URL in its content

**1.5.5 – January 23rd, 2017**

*   Re-did 1.5.4 changes – checking for function existence before using it

**1.5.4 – January 23rd, 2017**

*   Re-did 1.5.3 changes – the_content filter is reapplied and the specific Site Builder plugin’s filters are

**1.5.3 – January 23rd, 2017**

*   Replaced the use of the_content filter with the filter’s associated functions (e.g. wptexturize, wpautop)

**1.5.2 – December 23rd, 2016**

*   The editor should only default to the ‘Visual’ tab for our Custom Product Tabs (no other editors)
*   Added all of the default WordPress settings to the editor

**1.5.1 – December 22nd, 2016**

*   Fixed bug that caused content to be copied incorrectly when moving tabs up / down
*   Only on the product page will the editor default to ‘Visual’ (instead of every page)

**1.5 – December 20th, 2016**

*   Version 1.5 includes a brand new feature – saved tabs – as well as a number of bug fixes, style tweaks, code clean-up, and comments
*   UI: Complete overhaul of the custom tab interface for an easier, responsive tab creating experience.
*   Saved Tabs: A new settings page has been added for users to create / update / delete saved tabs (see FAQ for more information)
*   Saved Tabs: On the product edit page, a new button (‘Add a Saved Tab’) has been added that allows you to choose one of your saved tabs and add it to the current product
*   Adding a new tab initializes a new wp\_editor (WYSIWYG) instead of a plain textarea
*   Added warning message when two tabs have the same title
*   Tabs with empty titles are no longer shown on the product page
*   Added ability to remove the first tab
*   Adding, moving, and removing tabs works as expected when the user’s ‘Visual Editor’ option is checked
*   On the product & settings pages, WYSIWYG editors will default to the visual tab (this helps prevent errors with dynamic wp\_editor generation)
*   Added a filter yikes_woocommerce_default_editor_mode that can change the default-to-visual-tab behavior (use at your own risk!)
*   Updated the ‘How To’ text, and slight modification to the style
*   Changed the JavaScript methods controlling how tabs were added, deleted, and moved up/down
*   Cleaned up and commented on all PHP and JavaScript files
*   Added proper i18n, with languages/ folder, .pot file, and load_plugin_textdomain hook
*   Incremented version #

**1.4.4 – March 1st, 2016**

*   Re-named the tab ID’s to support URL’s with query args (eg: http://www.example.com/shop#tab-reviews)

**1.4.3 – February 18th, 2016**

*   Wrapped missing ‘Custom Tab Title’ in localization/translation functions. (Plugin is now 100% translatable)
*   Removed i18n class files, and old .po/.mo files (less bloat)

**1.4.2 – February 17th, 2016**

*   Updated the internationalization strings ( yikes-inc-woocommerce-custom-product-tabs to yikes-inc-easy-custom-woocommerce-product-tabs )

**1.4.1 – August 20th, 2015**

*   Fixed conflict with other CSV export plugins for WooCommerce
*   Now custom product tab and row data/headers only get exported via ‘Tools > Export > Products’

**1.4 – July 29th, 2015**

*   Enhancement: Added the ‘Custom Product Tabs for WooCommerce ‘ data to the standard WooCommerce export file, so custom tab data can be transferred between sites smoothly.

**1.3 – July 21st, 2015**

*   Enhancement: Enabled WYSIWYG editor on tab content containers (enables shortcode and content to pass through the\_content() filter)
*   Updated repo screenshots and descriptions

**1.2 – March 18th, 2015**

*   Enhancement: Fixed issue where non utf8 characters in tab titles caused front end not to generate the tabs
*   Enhancement: When user doesn’t have WooCommerce installed, they are now redirected to the plugin install search page, with WooCommerce at the top.

**1.1**

*   Added class to the Woo tabs content title, for targeting via CSS ( .yikes-custom-woo-tab-title )

**1.0.0**

*   Initial Release

CVE-2022-28666: Custom Product Tabs for WooCommerce

Broken Access Control vulnerability in YIKES Inc. Custom Product Tabs for WooCommerce plugin <= 1.7.7 at WordPress leading to &yikes-the-content-toggle option update.



**Solution**

 Fixed

Update the WordPress Custom Product Tabs for WooCommerce plugin to the latest available version (at least 1.7.9).

Nguyen Anh Tien discovered and reported this Broken Authentication vulnerability in WordPress Custom Product Tabs for WooCommerce Plugin. This can be abused by a malicious actor to perform action which normally should only be able to be executed by higher privileged users. These actions might allow the malicious actor to gain admin access to the website. This vulnerability has been fixed in version 1.7.9.

**Other vulnerabilities in this plugin**

 0 present

 2 patched

View all

**WordPress plugin developer?**

Start a free security program for your WordPress plugins or request an audit.

Apply for MVDP

**Security researcher?**

Report to Patchstack Alliance bounty platform and earn monthly cash prizes.

Learn more

CVE-2022-28666: WordPress Custom Product Tabs for WooCommerce plugin <= 1.7.7 -  Broken Access Control vulnerability leading to &yikes-the-content-toggle option update - Patchstack

Cross-Site Request Forgery (CSRF) vulnerability in JoomUnited WP Meta SEO plugin <= 4.4.8 at WordPress allows an attacker to update the social settings.

CVE-2022-30337: WP Meta SEO

Cross-Site Request Forgery (CSRF) vulnerability in Sygnoos Popup Builder plugin <= 4.1.0 at WordPress leading to popup status change.

 Verified

 Fixed

**5.4**

CVSS 3.1 score Medium severity

Monitoring Coming soon

PSID 

de4f39bd2fdd

Classification 

Cross Site Request Forgery (CSRF)

OWASP Top 10 

A5: Broken Access Control

Publicly disclosed

2022-06-17

**Details**

Cross-Site Request Forgery (CSRF) vulnerability leading to Popup Status Change discovered by BEE-K (Patchstack) in WordPress Popup Builder plugin (versions <= 4.1.0).

**Solution**

Update the WordPress Popup Builder plugin to the latest available version (at least 4.1.1).

**References**

Changeset

Tag

#wordpress