Broken Access Control in Starter Templates Importer Credential Storage

Skrevet den af i Starter Templates – AI-Powered Templates

The importer routine that stores site-wide credentials did not check the caller’s capability, allowing a lower-privileged user to overwrite credentials used across the site. The routine now requires the manage_options capability before storing anything.

This vulnerability affects the following application versions:

  • Starter Templates – AI-Powered Templates 0.4.4.0
  • Starter Templates – AI-Powered Templates 0.4.4.15
  • Starter Templates – AI-Powered Templates 3.5.0
  • Starter Templates – AI-Powered Templates 3.5.2
  • Starter Templates – AI-Powered Templates 3.5.3
  • Starter Templates – AI-Powered Templates 3.5.4
  • Starter Templates – AI-Powered Templates 3.5.5
  • Starter Templates – AI-Powered Templates 4.0.7
  • Starter Templates – AI-Powered Templates 4.0.8
  • Starter Templates – AI-Powered Templates 4.0.9
  • Starter Templates – AI-Powered Templates 4.1.0
  • Starter Templates – AI-Powered Templates 4.1.1
  • Starter Templates – AI-Powered Templates 4.1.2
  • Starter Templates – AI-Powered Templates 4.1.3
  • Starter Templates – AI-Powered Templates 4.1.4
  • Starter Templates – AI-Powered Templates 4.1.5
  • Starter Templates – AI-Powered Templates 4.3.5
  • Starter Templates – AI-Powered Templates 4.3.6
  • Starter Templates – AI-Powered Templates 4.3.7
  • Starter Templates – AI-Powered Templates 4.3.8
  • Starter Templates – AI-Powered Templates 4.3.9
  • Starter Templates – AI-Powered Templates 4.4.0
  • Starter Templates – AI-Powered Templates 4.4.1
  • Starter Templates – AI-Powered Templates 4.4.2
  • Starter Templates – AI-Powered Templates 4.4.3
  • Starter Templates – AI-Powered Templates 4.4.4
  • Starter Templates – AI-Powered Templates 4.4.5
  • Starter Templates – AI-Powered Templates 4.4.6
  • Starter Templates – AI-Powered Templates 4.4.7
  • Starter Templates – AI-Powered Templates 4.4.8
  • Starter Templates – AI-Powered Templates 4.4.9
  • Starter Templates – AI-Powered Templates 4.4.10
  • Starter Templates – AI-Powered Templates 4.4.11
  • Starter Templates – AI-Powered Templates 4.4.12
  • Starter Templates – AI-Powered Templates 4.4.13
  • Starter Templates – AI-Powered Templates 4.4.14
  • Starter Templates – AI-Powered Templates 4.4.16
  • Starter Templates – AI-Powered Templates 4.4.17
  • Starter Templates – AI-Powered Templates 4.4.18
  • Starter Templates – AI-Powered Templates 4.4.19
  • Starter Templates – AI-Powered Templates 4.4.20
  • Starter Templates – AI-Powered Templates 4.4.21
  • Starter Templates – AI-Powered Templates 4.4.22
  • Starter Templates – AI-Powered Templates 4.4.23
  • Starter Templates – AI-Powered Templates 4.4.24
  • Starter Templates – AI-Powered Templates 4.4.25
  • Starter Templates – AI-Powered Templates 4.4.26
  • Starter Templates – AI-Powered Templates 4.4.27
  • Starter Templates – AI-Powered Templates 4.4.28
  • Starter Templates – AI-Powered Templates 4.4.29
  • Starter Templates – AI-Powered Templates 4.4.30
  • Starter Templates – AI-Powered Templates 4.4.31
  • Starter Templates – AI-Powered Templates 4.4.32
  • Starter Templates – AI-Powered Templates 4.4.33
  • Starter Templates – AI-Powered Templates 4.4.34
  • Starter Templates – AI-Powered Templates 4.4.35
  • Starter Templates – AI-Powered Templates 4.4.36
  • Starter Templates – AI-Powered Templates 4.4.37
  • Starter Templates – AI-Powered Templates 4.4.38
  • Starter Templates – AI-Powered Templates 4.4.39
  • Starter Templates – AI-Powered Templates 4.4.40
  • Starter Templates – AI-Powered Templates 4.4.41
  • Starter Templates – AI-Powered Templates 4.4.42
  • Starter Templates – AI-Powered Templates 4.4.43
  • Starter Templates – AI-Powered Templates 4.4.44
  • Starter Templates – AI-Powered Templates 4.4.45
  • Starter Templates – AI-Powered Templates 4.4.46
  • Starter Templates – AI-Powered Templates 4.4.47
  • Starter Templates – AI-Powered Templates 4.4.48
  • Starter Templates – AI-Powered Templates 4.4.49
  • Starter Templates – AI-Powered Templates 4.4.50
  • Starter Templates – AI-Powered Templates 4.4.51
  • Starter Templates – AI-Powered Templates 4.4.52
  • Starter Templates – AI-Powered Templates 4.5.0
  • Starter Templates – AI-Powered Templates 4.5.1
  • Starter Templates – AI-Powered Templates 4.5.2
  • Starter Templates – AI-Powered Templates 4.5.3
  • Starter Templates – AI-Powered Templates 4.5.4
  • Starter Templates – AI-Powered Templates 4.6.0
  • Starter Templates – AI-Powered Templates 4.6.1
  • Starter Templates – AI-Powered Templates 4.6.2
  • Starter Templates – AI-Powered Templates 4.6.3
  • Starter Templates – AI-Powered Templates 4.7.0
  • Starter Templates – AI-Powered Templates 4.7.1
  • Starter Templates – AI-Powered Templates 4.7.2
  • Starter Templates – AI-Powered Templates 4.7.3
  • Starter Templates – AI-Powered Templates 4.7.4

Stored Cross-Site Scripting in Starter Templates SVG Upload

Skrevet den af i Starter Templates – AI-Powered Templates

Starter Templates through 4.2.1 registers an upload_mimes filter that permits SVG uploads, but never sanitizes the uploaded SVG contents. An authenticated attacker with contributor-level access or above could upload an SVG carrying arbitrary script, which then executes for any user who opens the file. The fix sanitizes SVG uploads on the wp_check_filetype_and_ext path, stripping disallowed tags, attributes and script-bearing attribute values.

This vulnerability affects the following application versions:

  • Starter Templates – AI-Powered Templates 2.5.0
  • Starter Templates – AI-Powered Templates 2.5.1
  • Starter Templates – AI-Powered Templates 2.6.0
  • Starter Templates – AI-Powered Templates 2.6.1
  • Starter Templates – AI-Powered Templates 2.6.2
  • Starter Templates – AI-Powered Templates 2.6.3
  • Starter Templates – AI-Powered Templates 2.6.4
  • Starter Templates – AI-Powered Templates 2.6.5
  • Starter Templates – AI-Powered Templates 2.6.6
  • Starter Templates – AI-Powered Templates 2.6.7
  • Starter Templates – AI-Powered Templates 2.6.8
  • Starter Templates – AI-Powered Templates 2.6.9
  • Starter Templates – AI-Powered Templates 2.6.10
  • Starter Templates – AI-Powered Templates 2.6.11
  • Starter Templates – AI-Powered Templates 2.6.12
  • Starter Templates – AI-Powered Templates 2.6.13
  • Starter Templates – AI-Powered Templates 2.6.14
  • Starter Templates – AI-Powered Templates 2.6.15
  • Starter Templates – AI-Powered Templates 2.6.16
  • Starter Templates – AI-Powered Templates 2.6.17
  • Starter Templates – AI-Powered Templates 2.6.18
  • Starter Templates – AI-Powered Templates 2.6.19
  • Starter Templates – AI-Powered Templates 2.6.20
  • Starter Templates – AI-Powered Templates 2.6.21
  • Starter Templates – AI-Powered Templates 2.6.22
  • Starter Templates – AI-Powered Templates 2.7.0
  • Starter Templates – AI-Powered Templates 2.7.1
  • Starter Templates – AI-Powered Templates 2.7.2
  • Starter Templates – AI-Powered Templates 2.7.3
  • Starter Templates – AI-Powered Templates 2.7.4
  • Starter Templates – AI-Powered Templates 2.7.5
  • Starter Templates – AI-Powered Templates 3.0.0
  • Starter Templates – AI-Powered Templates 3.0.1
  • Starter Templates – AI-Powered Templates 3.0.2
  • Starter Templates – AI-Powered Templates 3.0.3
  • Starter Templates – AI-Powered Templates 3.0.4
  • Starter Templates – AI-Powered Templates 3.0.5
  • Starter Templates – AI-Powered Templates 3.0.6
  • Starter Templates – AI-Powered Templates 3.0.7
  • Starter Templates – AI-Powered Templates 3.0.8
  • Starter Templates – AI-Powered Templates 3.0.9
  • Starter Templates – AI-Powered Templates 3.0.10
  • Starter Templates – AI-Powered Templates 3.0.11
  • Starter Templates – AI-Powered Templates 3.0.12
  • Starter Templates – AI-Powered Templates 3.0.13
  • Starter Templates – AI-Powered Templates 3.0.14
  • Starter Templates – AI-Powered Templates 3.0.15
  • Starter Templates – AI-Powered Templates 3.0.16
  • Starter Templates – AI-Powered Templates 3.0.17
  • Starter Templates – AI-Powered Templates 3.0.18
  • Starter Templates – AI-Powered Templates 3.0.19
  • Starter Templates – AI-Powered Templates 3.0.20
  • Starter Templates – AI-Powered Templates 3.0.21
  • Starter Templates – AI-Powered Templates 3.0.22
  • Starter Templates – AI-Powered Templates 3.0.23
  • Starter Templates – AI-Powered Templates 3.0.24
  • Starter Templates – AI-Powered Templates 3.0.25
  • Starter Templates – AI-Powered Templates 3.1.0
  • Starter Templates – AI-Powered Templates 3.1.1
  • Starter Templates – AI-Powered Templates 3.1.2
  • Starter Templates – AI-Powered Templates 3.1.3
  • Starter Templates – AI-Powered Templates 3.1.4
  • Starter Templates – AI-Powered Templates 3.1.5
  • Starter Templates – AI-Powered Templates 3.1.6
  • Starter Templates – AI-Powered Templates 3.1.7
  • Starter Templates – AI-Powered Templates 3.1.8
  • Starter Templates – AI-Powered Templates 3.1.9
  • Starter Templates – AI-Powered Templates 3.1.10
  • Starter Templates – AI-Powered Templates 3.1.11
  • Starter Templates – AI-Powered Templates 3.1.12
  • Starter Templates – AI-Powered Templates 3.1.13
  • Starter Templates – AI-Powered Templates 3.1.14
  • Starter Templates – AI-Powered Templates 3.1.15
  • Starter Templates – AI-Powered Templates 3.1.16
  • Starter Templates – AI-Powered Templates 3.1.17
  • Starter Templates – AI-Powered Templates 3.1.18
  • Starter Templates – AI-Powered Templates 3.1.19
  • Starter Templates – AI-Powered Templates 3.1.20
  • Starter Templates – AI-Powered Templates 3.1.21
  • Starter Templates – AI-Powered Templates 3.1.22
  • Starter Templates – AI-Powered Templates 3.1.23
  • Starter Templates – AI-Powered Templates 3.1.24
  • Starter Templates – AI-Powered Templates 3.1.25
  • Starter Templates – AI-Powered Templates 3.1.26
  • Starter Templates – AI-Powered Templates 3.1.27
  • Starter Templates – AI-Powered Templates 3.2.0
  • Starter Templates – AI-Powered Templates 3.2.1
  • Starter Templates – AI-Powered Templates 3.2.2
  • Starter Templates – AI-Powered Templates 3.2.3
  • Starter Templates – AI-Powered Templates 3.2.4
  • Starter Templates – AI-Powered Templates 3.2.5
  • Starter Templates – AI-Powered Templates 3.2.6
  • Starter Templates – AI-Powered Templates 3.3.0
  • Starter Templates – AI-Powered Templates 3.4.0
  • Starter Templates – AI-Powered Templates 3.4.1
  • Starter Templates – AI-Powered Templates 3.4.2
  • Starter Templates – AI-Powered Templates 3.4.3
  • Starter Templates – AI-Powered Templates 3.4.4
  • Starter Templates – AI-Powered Templates 3.4.5
  • Starter Templates – AI-Powered Templates 3.4.6
  • Starter Templates – AI-Powered Templates 3.5.0
  • Starter Templates – AI-Powered Templates 3.5.1
  • Starter Templates – AI-Powered Templates 3.5.2
  • Starter Templates – AI-Powered Templates 3.5.3
  • Starter Templates – AI-Powered Templates 3.5.4
  • Starter Templates – AI-Powered Templates 3.5.5
  • Starter Templates – AI-Powered Templates 3.5.6
  • Starter Templates – AI-Powered Templates 3.5.7
  • Starter Templates – AI-Powered Templates 4.0.0
  • Starter Templates – AI-Powered Templates 4.0.1
  • Starter Templates – AI-Powered Templates 4.0.2
  • Starter Templates – AI-Powered Templates 4.0.3
  • Starter Templates – AI-Powered Templates 4.0.4
  • Starter Templates – AI-Powered Templates 4.0.5
  • Starter Templates – AI-Powered Templates 4.0.6
  • Starter Templates – AI-Powered Templates 4.0.7
  • Starter Templates – AI-Powered Templates 4.0.8
  • Starter Templates – AI-Powered Templates 4.0.9
  • Starter Templates – AI-Powered Templates 4.0.10
  • Starter Templates – AI-Powered Templates 4.0.11
  • Starter Templates – AI-Powered Templates 4.0.12
  • Starter Templates – AI-Powered Templates 4.0.13
  • Starter Templates – AI-Powered Templates 4.1.0
  • Starter Templates – AI-Powered Templates 4.1.1
  • Starter Templates – AI-Powered Templates 4.1.2
  • Starter Templates – AI-Powered Templates 4.1.3
  • Starter Templates – AI-Powered Templates 4.1.4
  • Starter Templates – AI-Powered Templates 4.1.5
  • Starter Templates – AI-Powered Templates 4.1.6
  • Starter Templates – AI-Powered Templates 4.1.7
  • Starter Templates – AI-Powered Templates 4.2.0
  • Starter Templates – AI-Powered Templates 4.2.1

Authenticated (Author+) Arbitrary File Upload in Starter Templates

Skrevet den af i Starter Templates – AI-Powered Templates

An Author-level user can bypass the WXR importer’s filename check to upload arbitrary files (including PHP) into wp-content/uploads, enabling remote code execution. Affects Starter Templates plugin versions up to 4.4.41; fixed in 4.4.42 by enforcing wp_check_filetype-based extension and MIME validation in the importer’s allow-list.

This vulnerability affects the following application versions:

  • Starter Templates – AI-Powered Templates 0.4.4.0
  • Starter Templates – AI-Powered Templates 0.4.4.15
  • Starter Templates – AI-Powered Templates 4.2.2
  • Starter Templates – AI-Powered Templates 4.2.3
  • Starter Templates – AI-Powered Templates 4.2.4
  • Starter Templates – AI-Powered Templates 4.2.5
  • Starter Templates – AI-Powered Templates 4.2.6
  • Starter Templates – AI-Powered Templates 4.3.0
  • Starter Templates – AI-Powered Templates 4.3.1
  • Starter Templates – AI-Powered Templates 4.3.2
  • Starter Templates – AI-Powered Templates 4.3.3
  • Starter Templates – AI-Powered Templates 4.3.4
  • Starter Templates – AI-Powered Templates 4.3.5
  • Starter Templates – AI-Powered Templates 4.3.6
  • Starter Templates – AI-Powered Templates 4.3.7
  • Starter Templates – AI-Powered Templates 4.3.8
  • Starter Templates – AI-Powered Templates 4.3.9
  • Starter Templates – AI-Powered Templates 4.4.0
  • Starter Templates – AI-Powered Templates 4.4.1
  • Starter Templates – AI-Powered Templates 4.4.2
  • Starter Templates – AI-Powered Templates 4.4.3
  • Starter Templates – AI-Powered Templates 4.4.4
  • Starter Templates – AI-Powered Templates 4.4.5
  • Starter Templates – AI-Powered Templates 4.4.6
  • Starter Templates – AI-Powered Templates 4.4.7
  • Starter Templates – AI-Powered Templates 4.4.8
  • Starter Templates – AI-Powered Templates 4.4.9
  • Starter Templates – AI-Powered Templates 4.4.10
  • Starter Templates – AI-Powered Templates 4.4.11
  • Starter Templates – AI-Powered Templates 4.4.12
  • Starter Templates – AI-Powered Templates 4.4.13
  • Starter Templates – AI-Powered Templates 4.4.14
  • Starter Templates – AI-Powered Templates 4.4.16
  • Starter Templates – AI-Powered Templates 4.4.17
  • Starter Templates – AI-Powered Templates 4.4.18
  • Starter Templates – AI-Powered Templates 4.4.19
  • Starter Templates – AI-Powered Templates 4.4.20
  • Starter Templates – AI-Powered Templates 4.4.21
  • Starter Templates – AI-Powered Templates 4.4.22
  • Starter Templates – AI-Powered Templates 4.4.23
  • Starter Templates – AI-Powered Templates 4.4.24
  • Starter Templates – AI-Powered Templates 4.4.25
  • Starter Templates – AI-Powered Templates 4.4.26
  • Starter Templates – AI-Powered Templates 4.4.27
  • Starter Templates – AI-Powered Templates 4.4.28
  • Starter Templates – AI-Powered Templates 4.4.29
  • Starter Templates – AI-Powered Templates 4.4.30
  • Starter Templates – AI-Powered Templates 4.4.31
  • Starter Templates – AI-Powered Templates 4.4.32
  • Starter Templates – AI-Powered Templates 4.4.33
  • Starter Templates – AI-Powered Templates 4.4.34
  • Starter Templates – AI-Powered Templates 4.4.35
  • Starter Templates – AI-Powered Templates 4.4.36
  • Starter Templates – AI-Powered Templates 4.4.37
  • Starter Templates – AI-Powered Templates 4.4.38
  • Starter Templates – AI-Powered Templates 4.4.39
  • Starter Templates – AI-Powered Templates 4.4.40
  • Starter Templates – AI-Powered Templates 4.4.41

Unrestricted Zip AI token overwrite via GET parameters (missing nonce)

Skrevet den af i Starter Templates – AI-Powered Templates

The Starter Templates (Astra Sites) plugin saved Zip AI auth tokens (token, credit_token, email) from URL query parameters when an admin visited the Starter Templates page (themes.php?page=starter-templates). The handler did not check a nonce or other CSRF protection. An attacker could send a logged-in admin a link containing crafted token, credit_token, and email values; if the admin opened it, the plugin would overwrite the site’s Zip AI settings with the attacker’s values, leading to authentication takeover or abuse of the Zip AI integration.

This vulnerability affects the following application versions:

  • Starter Templates – AI-Powered Templates 0.4.4.0
  • Starter Templates – AI-Powered Templates 4.0.0
  • Starter Templates – AI-Powered Templates 4.0.1
  • Starter Templates – AI-Powered Templates 4.0.2
  • Starter Templates – AI-Powered Templates 4.0.3
  • Starter Templates – AI-Powered Templates 4.0.4
  • Starter Templates – AI-Powered Templates 4.0.5
  • Starter Templates – AI-Powered Templates 4.0.6
  • Starter Templates – AI-Powered Templates 4.0.7
  • Starter Templates – AI-Powered Templates 4.0.8
  • Starter Templates – AI-Powered Templates 4.0.9
  • Starter Templates – AI-Powered Templates 4.0.10
  • Starter Templates – AI-Powered Templates 4.0.11
  • Starter Templates – AI-Powered Templates 4.0.12
  • Starter Templates – AI-Powered Templates 4.0.13
  • Starter Templates – AI-Powered Templates 4.1.0
  • Starter Templates – AI-Powered Templates 4.1.1
  • Starter Templates – AI-Powered Templates 4.1.2
  • Starter Templates – AI-Powered Templates 4.1.3
  • Starter Templates – AI-Powered Templates 4.1.4
  • Starter Templates – AI-Powered Templates 4.1.5
  • Starter Templates – AI-Powered Templates 4.1.6
  • Starter Templates – AI-Powered Templates 4.1.7
  • Starter Templates – AI-Powered Templates 4.2.0
  • Starter Templates – AI-Powered Templates 4.2.1
  • Starter Templates – AI-Powered Templates 4.2.2
  • Starter Templates – AI-Powered Templates 4.2.3
  • Starter Templates – AI-Powered Templates 4.2.4
  • Starter Templates – AI-Powered Templates 4.2.5
  • Starter Templates – AI-Powered Templates 4.2.6
  • Starter Templates – AI-Powered Templates 4.3.0
  • Starter Templates – AI-Powered Templates 4.3.1
  • Starter Templates – AI-Powered Templates 4.3.2
  • Starter Templates – AI-Powered Templates 4.3.3
  • Starter Templates – AI-Powered Templates 4.3.4
  • Starter Templates – AI-Powered Templates 4.3.5
  • Starter Templates – AI-Powered Templates 4.3.6
  • Starter Templates – AI-Powered Templates 4.3.7
  • Starter Templates – AI-Powered Templates 4.3.8
  • Starter Templates – AI-Powered Templates 4.3.9
  • Starter Templates – AI-Powered Templates 4.4.0
  • Starter Templates – AI-Powered Templates 4.4.1
  • Starter Templates – AI-Powered Templates 4.4.2
  • Starter Templates – AI-Powered Templates 4.4.3
  • Starter Templates – AI-Powered Templates 4.4.4
  • Starter Templates – AI-Powered Templates 4.4.5
  • Starter Templates – AI-Powered Templates 4.4.6
  • Starter Templates – AI-Powered Templates 4.4.7
  • Starter Templates – AI-Powered Templates 4.4.8
  • Starter Templates – AI-Powered Templates 4.4.9

Authenticated (author+) stored cross-site scripting in importer

Skrevet den af i Starter Templates – AI-Powered Templates

A vulnerability allowed authenticated users (Author+) to upload malicious SVG files or inject scripts during site imports, leading to stored XSS. Attackers could execute JavaScript in visitors’ browsers.

This vulnerability affects the following application versions:

  • Starter Templates – AI-Powered Templates 0.4.4.0
  • Starter Templates – AI-Powered Templates 4.2.2
  • Starter Templates – AI-Powered Templates 4.2.3
  • Starter Templates – AI-Powered Templates 4.2.4
  • Starter Templates – AI-Powered Templates 4.2.5
  • Starter Templates – AI-Powered Templates 4.2.6
  • Starter Templates – AI-Powered Templates 4.3.0
  • Starter Templates – AI-Powered Templates 4.3.1
  • Starter Templates – AI-Powered Templates 4.3.2
  • Starter Templates – AI-Powered Templates 4.3.3
  • Starter Templates – AI-Powered Templates 4.3.4
  • Starter Templates – AI-Powered Templates 4.3.5
  • Starter Templates – AI-Powered Templates 4.3.6
  • Starter Templates – AI-Powered Templates 4.3.7
  • Starter Templates – AI-Powered Templates 4.3.8
  • Starter Templates – AI-Powered Templates 4.3.9
  • Starter Templates – AI-Powered Templates 4.4.0