Intelligence
Explorer.

Subscriber Privilege Escalation in Import and export users and customers <= 2.5.2 versions.

Unauthenticated SQL Injection in GamiPress <= 8.0.2 versions.

Contributor Insecure Direct Object References (IDOR) in Business Directory <= 6.4.27 versions.

Unauthenticated Arbitrary File Download in NextGEN Gallery <= 4.5.0 versions.

Editor PHP Object Injection in Responsive Slider Gallery <= 1.5.5 versions.

Contributor PHP Object Injection in 10Web Booster – Website speed optimization, Cache & Page Speed optimizer <= 2.33.6 versions.

Unauthenticated Broken Access Control in GravityExport Lite for Gravity Forms <= 2.7.2 versions.

Contributor SQL Injection in Easy Pricing Tables <= 4.1.2 versions.

Author SQL Injection in Quiz Cat <= 3.1.1 versions.

Unauthenticated Cross Site Scripting (XSS) in WordPress Persistent Login <= 3.1.3 versions.

Unauthenticated Cross Site Scripting (XSS) in Site Reviews <= 8.3.1 versions.

Contributor Cross Site Scripting (XSS) in Safe SVG <= 2.5.0 versions.

Contributor PHP Object Injection in SEO Plugin by Squirrly SEO <= 14.2.5 versions.

Unauthenticated Broken Access Control in Simply Schedule Appointments <= 1.6.12.29 versions.

Shop manager PHP Object Injection in Cost of Goods for WooCommerce <= 3.5.2 versions.

Unauthenticated Cross Site Scripting (XSS) in WP Statistics <= 14.16.13 versions.

Author PHP Object Injection in Minimum and Maximum Quantity for WooCommerce <= 2.1.2 versions.

Shop manager PHP Object Injection in Music Player for WooCommerce <= 1.9.1 versions.

Unauthenticated SQL Injection in WP Data Access <= 5.5.84 versions.

Unauthenticated Cross Site Scripting (XSS) in Notification for Telegram <= 3.5.2 versions.

Unauthenticated Cross Site Scripting (XSS) in JW Player for WordPress <= 2.3.11 versions.

Apache WSS4J remembers the Nonce of each UsernameToken it accepts, so a captured token cannot be reused. It stored the Nonce as raw base64 text, but authentication decodes that text and uses the bytes.The same bytes can be written as base64 in several ways. An attacker who captured an authenticated request could re-send it with a space added to the Nonce: the password digest still verified, but the token no longer matched the remembered one, so the replay was accepted. Since a UsernameToken does not cover the message body, the captured token could then be reused on requests of the attacker's choosing until it expired. Affects deployments with a nonce replay cache configured, as Apache CXF has by default, and only tokens using a password digest. The cache is now keyed on the decoded Nonce. Users are recommended to upgrade to versions 4.0.2 or 3.0.6 or 2.4.4, which fix this issue.

In the WSS4J streaming (StAX) code, a signature reference using the WS-Security STR-Transform leaves an internal "inside signed content" flag permanently set. The WS-SecurityPolicy enforcer uses that flag to decide whether an element needs checking, so it stops evaluating SignedParts and SignedElements for the rest of the message. A policy requiring the SOAP Body to be signed is then satisfied even when the Body carries no signature, removing the protection against XML Signature Wrapping. Signature verification itself is unaffected. The DOM code is not affected.  Users are recommended to upgrade to versions 4.0.2 or 3.0.6 or 2.4.4 which fix this issue.

WSS4J EncryptedHeader child confusion could promote an attacker-controlled plaintext element as the decrypted header, leading to incorrect confidentiality coverage and possible policy bypass. Users are recommended to upgrade to versions 4.0.2 or 3.0.6 or 2.4.4, which fix this issue.