supercleanse vulnerabilities and threats

The ThirstyAffiliates WordPress plugin up to version 3.12.1 is vulnerable to stored cross-site scripting (XSS) via the 'comment' parameter. This vulnerability arises from insufficient input sanitization and output escaping, allowing unauthenticated attackers to inject malicious scripts. Exploitation requires the site to use block themes where comment content is processed through a specific rendering function, and the attacker must have one prior approved comment to enable auto-approval of subsequent crafted comments. The vulnerability has a high severity rating with a CVSS score of 7.2.

The PrettyLinks WordPress plugin up to version 3.6.20 contains an SQL Injection vulnerability in the 's' (search) parameter on the Pretty Links listing page. This flaw allows authenticated users with Administrator-level access or higher to inject additional SQL queries due to insufficient escaping and lack of proper query preparation in the search_links_table() function. The vulnerability can lead to unauthorized disclosure of sensitive database information.

The Members – Membership & User Role Editor Plugin plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 3.2.22 via the members_filter_protected_posts_for_rest. This makes it possible for unauthenticated attackers to extract determine the existence and exact count of access-restricted posts, and use per-page pagination as a boolean oracle to infer keywords and content contained within those hidden restricted posts.

The Buy Now Plus – Buy Now buttons for Stripe plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'buynowplus' shortcode in all versions up to, and including, 1.0.2 due to insufficient input sanitization and output escaping on shortcode attributes. This makes it possible for authenticated attackers, with Contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.

The Members – Membership & User Role Editor Plugin plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 3.2.10 via the WordPress core search feature. This makes it possible for unauthenticated attackers to extract sensitive data from posts that have been restricted to higher-level roles such as administrator.

The Pretty Links – Affiliate Links, Link Branding, Link Tracking & Marketing Plugin plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 3.6.3. This is due to missing or incorrect nonce validation when saving plugin settings. This makes it possible for unauthenticated attackers to change the plugin's configuration including stripe integration via a forged request granted they can trick a site administrator into performing an action such as clicking on a link.