Click2Shell is a cross-site request forgery (CSRF) vulnerability in WordPress Core up to version 7.1.0 that allows unauthenticated attackers to execute arbitrary PHP code on the server by forcing the installation of a theme from the official WordPress.org catalog. The attack requires a logged-in administrator to visit a crafted URL, which triggers the execution of PHP code via an inactive theme during a Customizer preview. This vulnerability was fixed in WordPress version 7.1.1 by escaping the theme slug and restricting jQuery selectors. The flaw enables remote code execution that could lead to file manipulation, data access, and creation of rogue admin accounts.
elFinder is an open-source file manager for web, written in JavaScript using jQuery UI. Prior to 2.1.70, the netmount command is omitted from elFinderConnector::$csrfProtectedCmds in php/elFinderConnector.class.php, so validateCsrfToken() is not called for this state-changing operation. In the shipped php/connector.minimal.php-dist configuration, FTP network mounts are enabled by default, and attacker-controlled protocol, host, path, port, user, pass, alias, and options arguments flow through elFinder::netmount() in php/elFinder.class.php to php/elFinderVolumeFTP.class.php. A cross-site request can therefore persist an attacker-chosen FTP mount in the victim's session, cause the PHP server to connect to an attacker-chosen FTP host and port, and send supplied credentials without an X-elFinder-CSRF token. This issue is fixed in version 2.1.70.
elFinder is an open-source file manager for web, written in JavaScript using jQuery UI. Prior to 2.1.70, elFinder URL uploads in php/elFinder.class.php can bypass server-side request forgery protections when PHP cURL is unavailable because validate_address() validates $info['ip'], but get_remote_contents() selects fsock_get_contents(), which connects to $arr['host'] and performs a second DNS resolution. An attacker able to submit a URL upload can use DNS rebinding to have the first resolution return a public address and the connection resolution return a loopback or private address, causing the internal HTTP response body to be stored as an uploaded file and made readable through elFinder. After a successful fetch, get_headers($url, true) separately requests the original hostname without reusing the validated and pinned connection, creating an additional blind server-side request forgery path even when curl_get_contents() is selected. This issue is fixed in version 2.1.70.
A malicious package named jquery.ui.tabs@9999.0.0 was published to the npm registry as a dependency confusion attack. This package contains an empty runtime but executes a preinstall script that collects sensitive environment information such as hostnames, usernames, working directories, npm registry URLs, and CI repository identifiers. It then sends this data unencrypted to an attacker-controlled IP address. This package appears designed to detect organizations that resolve the public package name internally, potentially exposing internal details to attackers.
The jQuery Hover Footnotes WordPress plugin versions up to and including 1.4 contain a Cross-Site Request Forgery (CSRF) vulnerability due to missing or incorrect nonce validation. This flaw allows unauthenticated attackers to update plugin settings with arbitrary values via a forged request. Because these settings are output unescaped on the frontend, successful exploitation can lead to persistent Cross-Site Scripting (XSS) affecting all site visitors if an administrator is tricked into performing an action like clicking a malicious link.
CVE-2023-53892 is a high-severity remote code execution vulnerability in Blackcat CMS version 1.4. Authenticated administrators can exploit this flaw via the jquery plugin manager by uploading a malicious zip file containing PHP shell scripts. The vulnerability allows execution of arbitrary system commands by accessing the uploaded PHP file with a crafted 'code' parameter. No user interaction or additional authentication beyond admin privileges is required. This vulnerability poses a significant risk to the confidentiality, integrity, and availability of affected systems. Although no known exploits are currently reported in the wild, the ease of exploitation and high impact make timely remediation critical. European organizations using Blackcat CMS 1.4 should prioritize patching or mitigating this vulnerability to prevent potential compromise. Countries with higher adoption of Blackcat CMS or critical infrastructure relying on it are at greater risk.
Cross-Site Request Forgery (CSRF) vulnerability in Sana Ullah jQuery Dropdown Menu jquery-drop-down-menu-plugin allows Stored XSS.This issue affects jQuery Dropdown Menu: from n/a through <= 3.0.
Cross-Site Request Forgery (CSRF) vulnerability in Mark Stockton Quicksand Post Filter jQuery Plugin.This issue affects Quicksand Post Filter jQuery Plugin: from n/a through 3.1.1.