Konagash

**Nome do Software Vulnerável e Versões Afetadas** Versões do CodePeople Appointment Hour Booking anteriores à 1.4.23 **Descrição** A questão está relacionada a uma vulnerabilidade de falta de autorização no CodePeople Appointment Hour Booking, que permite a exploração de níveis de segurança de controle de acesso configurados incorretamente. **Recomendações** Para versões anteriores à 1.4.23, atualize para a versão 1.4.23 ou posterior para resolver o problema. Como medida temporária, considere revisar e corrigir a configuração dos níveis de segurança de controle de acesso para minimizar o risco de exploração.

**Nome do software vulnerável e versões afetadas** Versões do Hide My WP Ghost até a 5.0.25 **Descrição** O problema está relacionado a uma vulnerabilidade de restrição inadequada de tentativas excessivas de autenticação no Hide My WP Ghost, um plugin de segurança para WordPress. Essa vulnerabilidade permite a contornamento de funcionalidades. **Recomendações** Para versões até 5.0.25, atualize para uma versão posterior à 5.0.25 para resolver o problema. Como solução temporária, considere restringir o acesso aos pontos de autenticação para minimizar o risco de exploração.

**Name of the Vulnerable Software and Affected Versions** Arshid Easy Hide Login versions 1.0.8 and earlier **Description** The issue is a Cross-Site Request Forgery (CSRF) vulnerability. This means an attacker can trick a user into performing unintended actions on a web application that the user is authenticated to. **Recommendations** For versions 1.0.8 and earlier, update to a version that contains a fix for this issue. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** ReCorp Export WP Page to Static HTML/CSS plugin versions <= 2.1.9 **Description** The issue is a Cross-Site Request Forgery (CSRF) vulnerability. This means an attacker can trick a user into performing unintended actions on a web application that the user is authenticated to. No information is provided about the estimated number of potentially affected devices or real-world incidents where this issue was exploited. **Recommendations** For ReCorp Export WP Page to Static HTML/CSS plugin versions <= 2.1.9, update to a version higher than 2.1.9 to resolve the issue. As a temporary workaround, consider implementing additional CSRF protection measures, such as token-based validation, to minimize the risk of exploitation.

**Name of the Vulnerable Software and Affected Versions** LWS Hide Login plugin versions <= 2.1.6 **Description** The issue is related to a Cross-Site Request Forgery (CSRF) vulnerability. This type of vulnerability allows an attacker to trick a user into performing unintended actions on a web application that the user is authenticated to. **Recommendations** For LWS Hide Login plugin versions <= 2.1.6, update to a version higher than 2.1.6 to resolve the issue.

**Name of the Vulnerable Software and Affected Versions** ShortPixel Adaptive Images – WebP, AVIF, CDN, Image Optimization plugin versions <= 3.7.1 **Description** The issue is a Cross-Site Request Forgery (CSRF) vulnerability. This type of vulnerability allows an attacker to trick a user into performing unintended actions on a web application that the user is authenticated to. **Recommendations** For versions <= 3.7.1, update to a version higher than 3.7.1 to resolve the issue.

**Name of the Vulnerable Software and Affected Versions** ReCorp AI Content Writing Assistant (Content Writer, GPT 3 & 4, ChatGPT, Image Generator) All in One plugin versions <= 1.1.5 **Description** The issue is related to a Cross-Site Request Forgery (CSRF) vulnerability. This means an attacker could potentially trick a user into performing unintended actions on a web application that the user is authenticated to. **Recommendations** For versions <= 1.1.5, update to a version greater than 1.1.5 to resolve the issue. As a temporary workaround, consider implementing additional CSRF protection measures, such as token-based validation, to minimize the risk of exploitation.

**Name of the Vulnerable Software and Affected Versions** LWS Cleaner plugin versions prior to 2.3.0 **Description** The issue is related to a Cross-Site Request Forgery (CSRF) vulnerability. This type of vulnerability allows an attacker to trick a user into performing unintended actions on a web application that the user is authenticated to. **Recommendations** For versions prior to 2.3.0, update to version 2.3.0 or later to resolve the issue.

**Name of the Vulnerable Software and Affected Versions** LWS LWS Tools plugin versions <= 2.4.1 **Description** The issue is related to a Cross-Site Request Forgery (CSRF) vulnerability. This type of vulnerability allows an attacker to trick a user into performing unintended actions on a web application that the user is authenticated to. **Recommendations** For versions <= 2.4.1, update to a version higher than 2.4.1 to resolve the issue.

**Name of the Vulnerable Software and Affected Versions** unFocus Projects Scripts n Styles plugin versions <= 3.5.7 **Description** The issue is related to a Stored Cross-Site Scripting (XSS) vulnerability that requires authentication with admin+ privileges. **Recommendations** For unFocus Projects Scripts n Styles plugin versions <= 3.5.7, update to a version higher than 3.5.7 to resolve the issue.