Rafasashi
Monthly
Authentication bypass and full account takeover in the User Session Synchronizer WordPress plugin (versions ≤1.4.0) lets unauthenticated attackers log in as any user, including administrators, by abusing the init-hooked synchronize_session() handler. Because an unregistered ussync-key slot makes get_option() return false, the AES-256-CBC key silently degrades to the predictable md5('') and the referer allowlist collapses to an empty match, while the IV is hard-coded, so an attacker who knows or guesses a target email can forge a valid ussync-ref token. No public exploit is identified at time of analysis and the flaw is not in CISA KEV, but the CVSS 9.8 rating and trivial cryptographic prerequisites make weaponization straightforward.
Stored Cross-Site Scripting (XSS) in Custom New User Notification plugin for WordPress versions up to 1.2.0 allows authenticated administrators to inject arbitrary JavaScript into plugin settings pages via unescaped admin form fields (User Mail Subject, User From Name, User From Email, Admin Mail Subject, Admin From Name, Admin From Email). When any user accesses the plugin settings page, the injected scripts execute in their browser context, enabling privilege escalation in WordPress multisite environments where subsite administrators target super administrators. No public exploit code or active exploitation has been identified; the attack requires Administrator-level credentials, limiting real-world risk despite moderate CVSS score.
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in rafasashi Todo Custom Field todo-custom-field allows Reflected XSS.0.4. Rated high severity (CVSS 7.1), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.
Authentication bypass and full account takeover in the User Session Synchronizer WordPress plugin (versions ≤1.4.0) lets unauthenticated attackers log in as any user, including administrators, by abusing the init-hooked synchronize_session() handler. Because an unregistered ussync-key slot makes get_option() return false, the AES-256-CBC key silently degrades to the predictable md5('') and the referer allowlist collapses to an empty match, while the IV is hard-coded, so an attacker who knows or guesses a target email can forge a valid ussync-ref token. No public exploit is identified at time of analysis and the flaw is not in CISA KEV, but the CVSS 9.8 rating and trivial cryptographic prerequisites make weaponization straightforward.
Stored Cross-Site Scripting (XSS) in Custom New User Notification plugin for WordPress versions up to 1.2.0 allows authenticated administrators to inject arbitrary JavaScript into plugin settings pages via unescaped admin form fields (User Mail Subject, User From Name, User From Email, Admin Mail Subject, Admin From Name, Admin From Email). When any user accesses the plugin settings page, the injected scripts execute in their browser context, enabling privilege escalation in WordPress multisite environments where subsite administrators target super administrators. No public exploit code or active exploitation has been identified; the attack requires Administrator-level credentials, limiting real-world risk despite moderate CVSS score.
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in rafasashi Todo Custom Field todo-custom-field allows Reflected XSS.0.4. Rated high severity (CVSS 7.1), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.