The WordPress plugin Be POPIA Compliant exposed sensitive information to unauthenticated users consisting of site visitors emails and usernames via an API route, in versions up to an including 1.1.5.

CVE-2022-1186: Changeset 2701343 for be-popia-compliant – WordPress Plugin Repository

The Simple File List WordPress plugin is vulnerable to Arbitrary File Download via the eeFile parameter found in the ~/includes/ee-downloader.php file due to missing controls which makes it possible unauthenticated attackers to supply a path to a file that will subsequently be downloaded, in versions up to and including 3.2.7.

CVE-2022-1119

The WordPress WP YouTube Live Plugin is vulnerable to Reflected Cross-Site Scripting via POST data found in the ~/inc/admin.php file which allows unauthenticated attackers to inject arbitrary web scripts in versions up to, and including, 1.7.21.

Timestamp:

03/31/2022 01:35:01 PM (4 weeks ago)

macbookandrew

Message:

Update to version 1.7.22 from GitHub  

Location:

wp-youtube-live

Files:

  

*   tags/1.7.22 _(copied from wp-youtube-live/trunk)_
*   tags/1.7.22/inc/admin.php (1 diff)
*   tags/1.7.22/readme.txt (2 diffs)
*   tags/1.7.22/wp-youtube-live.php (2 diffs)
*   trunk/inc/admin.php (1 diff)
*   trunk/readme.txt (2 diffs)
*   trunk/wp-youtube-live.php (2 diffs)

**Legend:**

Unmodified

Added

Removed

*   **wp-youtube-live/tags/1.7.22/inc/admin.php**
    
    r2488454
    
    r2702715
    
     
    
    346
    
    346
    
    347
    
    347
    
        if ( ! wp\_verify\_nonce( $nonce, 'wpYTcache\_nonce' ) ) {
    
    348
    
     
    
            die( 'Invalid nonce.' . var\_export( $\_POST, true ) );
    
     
    
    348
    
            die( 'Invalid nonce.' );
    
    349
    
    349
    
        }
    
    350
    
    350
    
*   **wp-youtube-live/tags/1.7.22/readme.txt**
    
    r2659419
    
    r2702715
    
     
    
    5
    
    5
    
    Requires at least: 3.6
    
    6
    
    6
    
    Tested up to:      5.7
    
    7
    
     
    
    Stable tag:        1.7.21
    
     
    
    7
    
    Stable tag:        1.7.22
    
    8
    
    8
    
    License:           GPLv2 or later
    
    9
    
    9
    
    License URI:       http://www.gnu.org/licenses/gpl-2.0.html
    
    …
    
    …
    
     
    
    179
    
    179
    
    \== Changelog ==
    
    180
    
    180
    
     
    
    181
    
    \= 1.7.22 =
    
     
    
    182
    
    \- Fix reflected cross-site scripting vulnerability
    
     
    
    183
    
    181
    
    184
    
    \= 1.7.21 =
    
    182
    
    185
    
    \- Fix error on activation
    
*   **wp-youtube-live/tags/1.7.22/wp-youtube-live.php**
    
    r2659419
    
    r2702715
    
     
    
    4
    
    4
    
     \* Plugin URI: https://github.com/macbookandrew/wp-youtube-live
    
    5
    
    5
    
     \* Description: Displays the current YouTube live video from a specified channel
    
    6
    
     
    
     \* Version: 1.7.21
    
     
    
    6
    
     \* Version: 1.7.22
    
    7
    
    7
    
     \* Author: Andrew Minion
    
    8
    
    8
    
     \* Author URI: https://andrewrminion.com/
    
    …
    
    …
    
     
    
    13
    
    13
    
    }
    
    14
    
    14
    
    15
    
     
    
    define( 'WP\_YOUTUBE\_LIVE\_VERSION', '1.7.21' );
    
     
    
    15
    
    define( 'WP\_YOUTUBE\_LIVE\_VERSION', '1.7.22' );
    
    16
    
    16
    
    17
    
    17
    
    /\*\*
    
*   **wp-youtube-live/trunk/inc/admin.php**
    
    r2488454
    
    r2702715
    
     
    
    346
    
    346
    
    347
    
    347
    
        if ( ! wp\_verify\_nonce( $nonce, 'wpYTcache\_nonce' ) ) {
    
    348
    
     
    
            die( 'Invalid nonce.' . var\_export( $\_POST, true ) );
    
     
    
    348
    
            die( 'Invalid nonce.' );
    
    349
    
    349
    
        }
    
    350
    
    350
    
*   **wp-youtube-live/trunk/readme.txt**
    
    r2659419
    
    r2702715
    
     
    
    5
    
    5
    
    Requires at least: 3.6
    
    6
    
    6
    
    Tested up to:      5.7
    
    7
    
     
    
    Stable tag:        1.7.21
    
     
    
    7
    
    Stable tag:        1.7.22
    
    8
    
    8
    
    License:           GPLv2 or later
    
    9
    
    9
    
    License URI:       http://www.gnu.org/licenses/gpl-2.0.html
    
    …
    
    …
    
     
    
    179
    
    179
    
    \== Changelog ==
    
    180
    
    180
    
     
    
    181
    
    \= 1.7.22 =
    
     
    
    182
    
    \- Fix reflected cross-site scripting vulnerability
    
     
    
    183
    
    181
    
    184
    
    \= 1.7.21 =
    
    182
    
    185
    
    \- Fix error on activation
    
*   **wp-youtube-live/trunk/wp-youtube-live.php**
    
    r2659419
    
    r2702715
    
     
    
    4
    
    4
    
     \* Plugin URI: https://github.com/macbookandrew/wp-youtube-live
    
    5
    
    5
    
     \* Description: Displays the current YouTube live video from a specified channel
    
    6
    
     
    
     \* Version: 1.7.21
    
     
    
    6
    
     \* Version: 1.7.22
    
    7
    
    7
    
     \* Author: Andrew Minion
    
    8
    
    8
    
     \* Author URI: https://andrewrminion.com/
    
    …
    
    …
    
     
    
    13
    
    13
    
    }
    
    14
    
    14
    
    15
    
     
    
    define( 'WP\_YOUTUBE\_LIVE\_VERSION', '1.7.21' );
    
     
    
    15
    
    define( 'WP\_YOUTUBE\_LIVE\_VERSION', '1.7.22' );
    
    16
    
    16
    
    17
    
    17
    
    /\*\*
    

**Note:** See TracChangeset for help on using the changeset viewer.

CVE-2022-1187: Changeset 2702715 for wp-youtube-live – WordPress Plugin Repository

The Elementor Website Builder plugin for WordPress is vulnerable to unauthorized execution of several AJAX actions due to a missing capability check in the ~/core/app/modules/onboarding/module.php file that make it possible for attackers to modify site data in addition to uploading malicious files that can be used to obtain remote code execution, in versions 3.6.0 to 3.6.2.

Timestamp:

04/12/2022 07:29:58 PM (2 weeks ago)

KingYes

Message:

Upload v3.6.3  

File:

  

*   elementor/trunk/core/app/modules/onboarding/module.php (3 diffs)

**Legend:**

Unmodified

Added

Removed

*   **elementor/trunk/core/app/modules/onboarding/module.php**
    
    r2688036
    
    r2708766
    
     
    
    3
    
    3
    
    4
    
    4
    
    use Automatic\_Upgrader\_Skin;
    
    5
    
     
    
    use Elementor\\Core\\App\\Modules\\KitLibrary\\Connect\\Kit\_Library;
    
    6
    
    5
    
    use Elementor\\Core\\Base\\Module as BaseModule;
    
    7
    
    6
    
    use Elementor\\Core\\Common\\Modules\\Ajax\\Module as Ajax;
    
    8
    
    7
    
    use Elementor\\Core\\Common\\Modules\\Connect\\Apps\\Library;
    
    9
    
     
    
    use Elementor\\Core\\Common\\Modules\\Connect\\Module as ConnectModule;
    
    10
    
    8
    
    use Elementor\\Core\\Files\\Uploads\_Manager;
    
    11
    
    9
    
    use Elementor\\Plugin;
    
    …
    
    …
    
     
    
    94
    
    92
    
                        'source' => 'generic',
    
    95
    
    93
    
                    \] ),
    
     
    
    94
    
                    'signUp' => $library->get\_admin\_url( 'authorize', \[
    
     
    
    95
    
                        'utm\_source' => 'onboarding-wizard',
    
     
    
    96
    
                        'utm\_campaign' => 'connect-account',
    
     
    
    97
    
                        'utm\_medium' => 'wp-dash',
    
     
    
    98
    
                        'utm\_term' => self::VERSION,
    
     
    
    99
    
                        'source' => 'generic',
    
     
    
    100
    
                        'screen\_hint' => 'signup',
    
     
    
    101
    
                    \] ),
    
    96
    
    102
    
                    'uploadPro' => Plugin::$instance->app->get\_base\_url() . '#/onboarding/uploadAndInstallPro?mode=popup',
    
    97
    
    103
    
                \],
    
    …
    
    …
    
     
    
    436
    
    442
    
                    isset( $\_POST\['action'\] ) &&
    
    437
    
    443
    
                    isset( $\_POST\['\_nonce'\] ) &&
    
    438
    
     
    
                    wp\_verify\_nonce( $\_POST\['\_nonce'\], Ajax::NONCE\_KEY )
    
     
    
    444
    
                    wp\_verify\_nonce( $\_POST\['\_nonce'\], Ajax::NONCE\_KEY ) &&
    
     
    
    445
    
                    current\_user\_can( 'manage\_options' )
    
    439
    
    446
    
                ) {
    
    440
    
    447
    
                    $this->maybe\_handle\_ajax();
    

**Note:** See TracChangeset for help on using the changeset viewer.

CVE-2022-1329: Changeset 2708766 for elementor/trunk/core/app/modules/onboarding/module.php – WordPress Plugin Repository

Multiple Unauthenticated Stored Cross-Site Scripting (XSS) vulnerabilities in KB Support (WordPress plugin) <= 1.5.5 versions.

**Solution**

Update the WordPress KB Support plugin to the latest available version (at least 1.5.6).

thiennv discovered and reported this Cross Site Scripting (XSS) vulnerability in WordPress KB Support Plugin. This could allow a malicious actor to inject malicious scripts, such as redirects, advertisements, and other HTML payloads into your website which will be executed when guests visit your site. This vulnerability has been fixed in version 1.5.6.

**No other known vulnerabilities for this plugin**Report

**Report to Patchstack Alliance bounty platform and earn monthly cash prizes.**

Learn more

CVE-2022-27852: WordPress KB Support plugin <= 1.5.5 - Multiple Unauth. Stored Cross-Site Scripting (XSS) vulnerabilities  - Patchstack

The Visual Form Builder WordPress plugin before 3.0.8 does not perform access control on entry form export, allowing unauthenticated users to see the form entries or export it as a CSV File using the vfb-export endpoint.

CVE-2022-0140

The Download Manager WordPress plugin before 3.2.34 uses the uniqid php function to generate the master key for a download, allowing an attacker to brute force the key with reasonable resources giving direct download access regardless of role based restrictions or password protections set for the download.

CVE-2022-0828

Improper Access Control in Adminer versions 1.12.0 to 4.6.2 (fixed in version 4.6.3) allows an attacker to achieve Arbitrary File Read on the remote server by requesting the Adminer to connect to a remote MySQL database.

Adminer up to 4.6.2 found vulnerable, all should upgrade to 4.7.0

**Update 2019-01-20**: the root cause is a protocol flaw in MySQL.

Adminer is a popular PHP tool to administer MySQL and PostgreSQL databases. However, it can be lured to disclose arbitrary files. Attackers can abuse that to fetch passwords for popular apps such as Magento and Wordpress, and gain control of a site’s database.

Exploitation happens in three stages. First, the attacker needs a modified MySQL server, which is altered to send out data import requests to any client that connects.

Second, an attacker needs to find an open adminer.php on the victim system. That is not hard, as many people install it in the root of their site. Once found, the attacker can instruct Adminer to connect to his rigged MySQL server (external connections are actually a feature of Adminer):

Adminer will then connect to the foreign server, login with the credentials, and immediately receive a data import request from the server for a specific file. Here is an example session, where Adminer sends the contents of local.xml (where Magento stores it secret database password) to the attacker-controlled server.

Third stage: as the attacker now has the master password for the victim site, he can use the same Adminer to access the database of the victim. And continue to steal private data or inject a skimmer.

**Abuse in the wild**

Until now there is no documented abuse of this method, but in hindsight we had observed it being used by different Magecart factions at least since October 2018 (although we didn’t understand what was going on back then). The vulnerability was subsequently used to inject payment skimmers on several high-profile stores (government & multinationals).

Because different Magecart factions use it, we suspect that the modified MySQL server is for sale on the dark web.

Via my honeypots and customers I have observed a recent surge in the volume of open Adminer scans. We expect that anyone running an unfixed Adminer will be breached in the coming months.

**The fix?**

We have tested Adminer versions 4.3.1 up to 4.6.2 and found all to be vulnerable. Adminer 4.6.3 was released in June, 2018 and appears safe. It is unclear whether the security flaw was fixed deliberately or by accident, as Adminer does not mention a security release.

We recommend anyone running Adminer to upgrade to the latest version (4.7.0). Also, we urge anyone to protect their database tools via an additional password and/or IP filter. Sometimes perpetrators can obtain your database password by other means, and an open Adminer makes life very easy for them.

CVE-2021-43008: PHP tool 'Adminer' leaks passwords – Sansec

Authenticated (subscriber or higher user role if allowed to access projects) Stored Cross-Site Scripting (XSS) vulnerability in weDevs WP Project Manager plugin <= 2.4.13 versions.

**Solution**

Update the WordPress WP Subscribe plugin to the latest available version (at least 2.4.14).

Jörgson discovered and reported this Cross Site Scripting (XSS) vulnerability in WordPress WP Project Manager Plugin. This could allow a malicious actor to inject malicious scripts, such as redirects, advertisements, and other HTML payloads into your website which will be executed when guests visit your site. This vulnerability has been fixed in version 2.4.14.

**2 other known vulnerabilities for this plugin**To plugin page

**Report to Patchstack Alliance bounty platform and earn monthly cash prizes.**

Learn more

Tag

#wordpress