POSIMYTH

{
    "slug": "nexter-extension",
    "previous_version": "4.6.10",
    "current_version": "4.6.11",
    "new_findings": [
        {
            "pattern": "unserialize_after_remote_call",
            "kind": "builtin",
            "file": "include/panel-settings/class-nxt-panel-ajax-router.php",
            "line": 782,
            "snippet": "L772: $response = wp_remote_post($theme_api_url, $args);  \u2192  L782: $theme_info = @unserialize( $body );",
            "confidence": "high"
        },
        {
            "pattern": "unserialize_after_remote_call",
            "kind": "builtin",
            "file": "include/panel-settings/class-nxt-panel-ajax-router.php",
            "line": 874,
            "snippet": "L873: $body = wp_remote_retrieve_body( $response );  \u2192  L874: $plugin_info = @unserialize( $body );",
            "confidence": "high"
        }
    ],
    "new_finding_count": 2
}

{
    "slug": "nexter-extension",
    "pattern": "unserialize_after_remote_call",
    "kind": "builtin",
    "version": "4.6.8",
    "hit_count": 2,
    "first_hit": {
        "file": "include/panel-settings/class-nxt-panel-ajax-router.php",
        "line": 779,
        "snippet": "L769: $response = wp_remote_post($theme_api_url, $args);  \u2192  L779: $theme_info = @unserialize( $body );"
    },
    "explanation": "a remote HTTP fetch (`wp_remote_*` / `curl_exec`) is followed by `@unserialize` within the same file \u2014 classic PHP Object Injection C2 gadget. The error-suppressed form is the tell: legit code wants to know when deserialize fails; attackers suppress so malformed gadgets do not leak. A real finding regardless of author intent: any plugin that deserializes remote responses without validation is a latent RCE chain if the remote endpoint is ever compromised."
}

{
    "slug": "nexter-extension",
    "finding_count": 3,
    "findings": [
        {
            "pattern": "unserialize_after_remote_call",
            "kind": "builtin",
            "file": "include/panel-settings/class-nxt-panel-ajax-router.php",
            "line": 779,
            "snippet": "L769: $response = wp_remote_post($theme_api_url, $args);  \u2192  L779: $theme_info = @unserialize( $body );",
            "confidence": "high"
        },
        {
            "pattern": "unserialize_after_remote_call",
            "kind": "builtin",
            "file": "include/panel-settings/class-nxt-panel-ajax-router.php",
            "line": 871,
            "snippet": "L870: $body = wp_remote_retrieve_body( $response );  \u2192  L871: $plugin_info = @unserialize( $body );",
            "confidence": "high"
        },
        {
            "pattern": "remote_enqueue",
            "kind": "builtin",
            "file": "include/panel-settings/extensions/nexter-ext-adobe-font.php",
            "line": 190,
            "snippet": "wp_enqueue_style( 'nexter-adobe-typekit','https://use.typekit.net/'.esc_attr($font_val['project_id']).'.css', [], NEXTER_EXT_VER );",
            "confidence": "medium",
            "details": {
                "url": "https://use.typekit.net/",
                "url_host": "use.typekit.net"
            }
        }
    ],
    "resolved_sha": "20dc3c2b4ca1db5173676e40fea3b86880ee9bb2"
}

{
    "slug": "the-plus-addons-for-elementor-page-builder",
    "previous_version": "6.4.14",
    "current_version": "6.4.16",
    "new_findings": [
        {
            "pattern": "remote_enqueue",
            "kind": "builtin",
            "file": "modules/widgets/tp_social_embed.php",
            "line": 3471,
            "snippet": "wp_enqueue_script( 'tpae-fb-sdk', 'https://connect.facebook.net/en_US/sdk.js#xfbml=1&version=v3.2', array(), L_THEPLUS_VERSION, true );",
            "confidence": "medium",
            "details": {
                "url": "https://connect.facebook.net/en_US/sdk.js#xfbml=1&version=v3.2",
                "url_host": "connect.facebook.net"
            }
        },
        {
            "pattern": "remote_enqueue",
            "kind": "builtin",
            "file": "modules/widgets/tp_social_embed.php",
            "line": 3533,
            "snippet": "wp_enqueue_script( 'tpae-fb-sdk', 'https://connect.facebook.net/en_US/sdk.js#xfbml=1&version=v3.2', array(), L_THEPLUS_VERSION, true );",
            "confidence": "medium",
            "details": {
                "url": "https://connect.facebook.net/en_US/sdk.js#xfbml=1&version=v3.2",
                "url_host": "connect.facebook.net"
            }
        },
        {
            "pattern": "remote_enqueue",
            "kind": "builtin",
            "file": "modules/widgets/tp_social_embed.php",
            "line": 3619,
            "snippet": "wp_enqueue_script( 'tpae-twitter-widgets', 'https://platform.twitter.com/widgets.js', array(), L_THEPLUS_VERSION, true );",
            "confidence": "medium",
            "details": {
                "url": "https://platform.twitter.com/widgets.js",
                "url_host": "platform.twitter.com"
            }
        },
        {
            "pattern": "remote_enqueue",
            "kind": "builtin",
            "file": "modules/widgets/tp_social_embed.php",
            "line": 3661,
            "snippet": "wp_enqueue_script( 'tpae-instagram-embed', 'https://www.instagram.com/embed.js', array(), L_THEPLUS_VERSION, true );",
            "confidence": "medium",
            "details": {
                "url": "https://www.instagram.com/embed.js",
                "url_host": "www.instagram.com"
            }
        },
        {
            "pattern": "remote_enqueue",
            "kind": "builtin",
            "file": "modules/widgets/tp_meeting_scheduler.php",
            "line": 629,
            "snippet": "wp_enqueue_script( 'tpae-calendly-widget', 'https://assets.calendly.com/assets/external/widget.js', array(), L_THEPLUS_VERSION, true );",
            "confidence": "medium",
            "details": {
                "url": "https://assets.calendly.com/assets/external/widget.js",
                "url_host": "assets.calendly.com"
            }
        }
    ],
    "new_finding_count": 5
}

{
    "slug": "nexter-extension",
    "previous_version": "4.6.7",
    "current_version": "4.6.8",
    "new_findings": [
        {
            "pattern": "remote_enqueue",
            "kind": "builtin",
            "file": "include/panel-settings/extensions/nexter-ext-adobe-font.php",
            "line": 190,
            "snippet": "wp_enqueue_style( 'nexter-adobe-typekit','https://use.typekit.net/'.esc_attr($font_val['project_id']).'.css', [], NEXTER_EXT_VER );",
            "confidence": "medium",
            "details": {
                "url": "https://use.typekit.net/",
                "url_host": "use.typekit.net"
            }
        },
        {
            "pattern": "unserialize_after_remote_call",
            "kind": "builtin",
            "file": "include/panel-settings/class-nxt-panel-ajax-router.php",
            "line": 779,
            "snippet": "L769: $response = wp_remote_post($theme_api_url, $args);  \u2192  L779: $theme_info = @unserialize( $body );",
            "confidence": "high"
        },
        {
            "pattern": "unserialize_after_remote_call",
            "kind": "builtin",
            "file": "include/panel-settings/class-nxt-panel-ajax-router.php",
            "line": 871,
            "snippet": "L870: $body = wp_remote_retrieve_body( $response );  \u2192  L871: $plugin_info = @unserialize( $body );",
            "confidence": "high"
        }
    ],
    "new_finding_count": 3
}