Jitlada

**Nome do Software Vulnerável e Versões Afetadas** Simple URLs versões anteriores a 152 **Descrição** Cross Site Scripting (XSS) ocorre quando uma aplicação inclui dados não confiáveis em uma página web sem a devida validação ou escape, permitindo que um invasor execute scripts maliciosos no navegador da vítima. **Recomendações** Atualize o Simple URLs para a versão 152 ou posterior.

**Nome do Software Vulnerável e Versões Afetadas** Insert Pages versões anteriores a 3.11.5 **Description** Ocorre Cross-Site Scripting Armazenado quando uma página inserida é renderizada usando o shortcode `[insert page='ID' display='all']`. O problema decorre da escape de saída insuficiente na função `the meta()`, onde a chave do campo personalizado `key` é interpolada no HTML e exibida sem escape, embora o valor do campo seja sanitizado. Isso permite que atacantes autenticados com nível de acesso de autor ou superior injetem scripts web arbitrários em páginas que serão executados sempre que um usuário acessar a página injetada. **Recommendations** Atualize para uma versão posterior à 3.11.4.

**Nome do Software Vulnerável e Versões Afetadas** WpBookingly versões anteriores a 1.2.9 **Description** Uma falha de autorização ausente no WpBookingly permite a exploração de níveis de segurança de controle de acesso configurados incorretamente. **Recommendations** Atualize para uma versão posterior a 1.2.9.

**Name of the Vulnerable Software and Affected Versions** blubrry PowerPress Podcasting versions through 11.15.13 **Description** A flaw exists in blubrry PowerPress Podcasting that allows for Stored Cross-site Scripting (XSS). This issue is due to improper neutralization of input during web page generation. The vulnerability could allow an attacker to inject malicious scripts into web pages viewed by other users. The affected component is PowerPress Podcasting. **Recommendations** Update to a version later than 11.15.13.

**Name of the Vulnerable Software and Affected Versions** Fernando Briano List category posts versions n/a through 0.93.1 **Description** An improper neutralization of input during web page generation issue exists, leading to a DOM-based cross-site scripting condition in the List category posts list-category-posts component. This allows for potential execution of malicious scripts within the context of a user's browser. **Recommendations** Update Fernando Briano List category posts to a version greater than 0.93.1.

**Name of the Vulnerable Software and Affected Versions** immonex Kickstart versions through 1.13.0 **Description** The software contains a flaw related to improper input handling during web page creation, which allows for Stored Cross-site Scripting (XSS). This means that malicious scripts can be injected into web pages viewed by other users. The issue affects immonex Kickstart. **Recommendations** Update immonex Kickstart to a version later than 1.13.0.

**Name of the Vulnerable Software and Affected Versions** Elementor Image Optimizer versions through 1.7.1 **Description** An authorization issue exists in Elementor Image Optimizer. The issue involves incorrectly configured access control security levels, potentially allowing unauthorized access. **Recommendations** Update Elementor Image Optimizer to a version later than 1.7.1.

**Name of the Vulnerable Software and Affected Versions** Live sales notification for WooCommerce versions prior to 2.3.46 **Description** A missing authorization issue exists in Live sales notification for WooCommerce. The issue involves incorrectly configured access control security levels, potentially allowing unauthorized access. **Recommendations** Update Live sales notification for WooCommerce to a version greater than 2.3.46.

**Name of the Vulnerable Software and Affected Versions** KaizenCoders URL Shortify versions through 1.12.3 **Description** A Server-Side Request Forgery (SSRF) vulnerability exists in KaizenCoders URL Shortify. This flaw allows for Server Side Request Forgery. The vulnerability is present in the `url-shortify` component. **Recommendations** Update KaizenCoders URL Shortify to a version later than 1.12.3.

**Name of the Vulnerable Software and Affected Versions** Dynamic Widget Content plugin for WordPress versions through 1.3.6 **Description** The Dynamic Widget Content plugin for WordPress is susceptible to Stored Cross-Site Scripting. This occurs through the widget content field within the Gutenberg editor sidebar, stemming from inadequate input sanitization and output escaping of user-provided attributes. Authenticated attackers possessing Contributor-level access or higher can inject arbitrary web scripts into pages. These scripts will then execute each time a user accesses the affected page. **Recommendations** Update the Dynamic Widget Content plugin to a version beyond 1.3.6.

**Name of the Vulnerable Software and Affected Versions** Smart Appointment & Booking plugin for WordPress versions up to and including 1.0.7 **Description** The Smart Appointment & Booking plugin for WordPress is susceptible to Stored Cross-Site Scripting through the `saab save form data` AJAX action. This is due to inadequate input sanitization and output escaping of user-provided attributes. Authenticated attackers with Subscriber-level access or higher can inject malicious web scripts into pages. These scripts will execute when a user accesses the compromised page. The vulnerable parameter is not specified. **Recommendations** Update the Smart Appointment & Booking plugin to a version newer than 1.0.7.

**Name of the Vulnerable Software and Affected Versions** LogicHunt Logo Slider versions through 4.9.0 **Description** The software contains a flaw related to improper input handling during web page creation, specifically a Stored Cross-site Scripting issue. This allows for the injection of malicious scripts. The issue affects the Logo Slider component. **Recommendations** Update to a version newer than 4.9.0.

**Name of the Vulnerable Software and Affected Versions** artplacer ArtPlacer Widget versions through 2.23.1 **Description** The ArtPlacer Widget contains a flaw related to improper input handling during web page generation, which allows for Stored Cross-site Scripting (XSS). This can potentially allow an attacker to inject malicious scripts into web pages viewed by other users. The affected component is the `artplacer-widget`. **Recommendations** Update to a version of ArtPlacer Widget greater than 2.23.1.

**Name of the Vulnerable Software and Affected Versions** Devsbrain Flex QR Code Generator versions through 1.2.8 **Description** The software contains a flaw related to improper input handling during web page generation, specifically a DOM-Based Cross-site Scripting issue. This allows for the execution of malicious scripts within the context of the affected web page. **Recommendations** Update Devsbrain Flex QR Code Generator to a version later than 1.2.8.

**Name of the Vulnerable Software and Affected Versions** Easy Form Builder versions through 3.9.6 **Description** An authorization issue exists in Easy Form Builder that allows exploitation of incorrectly configured access control security levels. **Recommendations** Update Easy Form Builder to a version later than 3.9.6.

**Name of the Vulnerable Software and Affected Versions** Hakob Re Gallery & Responsive Photo Gallery Plugin versions through 1.17.18 **Description** The Hakob Re Gallery & Responsive Photo Gallery Plugin has a flaw related to incorrectly configured access control security levels, allowing for missing authorization. The issue enables exploitation of these security levels. **Recommendations** Update Hakob Re Gallery & Responsive Photo Gallery Plugin to a version later than 1.17.18.

**Nome do Software Vulnerável e Versões Afetadas** Versões do Ruhul Amin Content Fetcher até 1.1 **Descrição** O software Ruhul Amin Content Fetcher contém uma falha relacionada ao tratamento inadequado de entrada durante a geração de páginas web, especificamente uma vulnerabilidade de Cross-Site Scripting (XSS) baseado em DOM. Isso possibilita a execução potencial de scripts maliciosos dentro da aplicação. A vulnerabilidade existe devido à sanitização insuficiente da entrada fornecida pelo usuário antes de ser incorporada ao Document Object Model (DOM) da página web. Isso poderia permitir que um atacante injetasse código HTML ou JavaScript arbitrário na página, o qual seria então executado pelo navegador da vítima. Os endpoints de API afetados e os parâmetros vulneráveis não foram especificados. **Recomendações** Atualize o Ruhul Amin Content Fetcher para uma versão superior à 1.1.

**Nome do Software Vulnerável e Versões Afetadas** Northern Beaches Websites WP Custom Admin Interface versões até a 7.40 **Descrição** Existe uma falha de autorização na Northern Beaches Websites WP Custom Admin Interface, decorrente de níveis de segurança de controle de acesso configurados incorretamente. Isso permite acesso não autorizado. **Recomendações** Atualize para uma versão posterior à 7.40.

**Name of the Vulnerable Software and Affected Versions** BoomDevs WordPress Coming Soon Plugin versions through 1.0.4 **Description** The BoomDevs WordPress Coming Soon Plugin contains a flaw that allows the retrieval of embedded sensitive data, potentially exposing system information to unauthorized parties. Approximately 20,000 installations of the plugin may be affected. The issue involves an exposure of sensitive system information to an unauthorized control sphere. **Recommendations** At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** Digages Direct Payments WP versions through 1.3.0 **Description** A flaw exists in Digages Direct Payments WP that allows the retrieval of embedded sensitive data, leading to exposure of sensitive system information to an unauthorized control sphere. **Recommendations** Update Digages Direct Payments WP to a version later than 1.3.0.