Pavak Tiwari

**Nome do software vulnerável e versões afetadas** NetTantra WP Roles at Registration, versões 0.23 e anteriores **Descrição** O problema está relacionado à neutralização inadequada de entradas durante a geração de páginas da Web, também conhecida como Cross-site Scripting (XSS). Isso permite o Stored XSS, em que um invasor pode injetar scripts maliciosos em um site, afetando potencialmente os usuários que acessam a página comprometida. **Recomendações** Para o NetTantra WP Roles at Registration nas versões 0.23 e anteriores, atualize para uma versão que corrija a vulnerabilidade de Stored XSS. No momento, não há informações sobre uma versão mais recente que contenha uma correção para essa vulnerabilidade.

**Name of the Vulnerable Software and Affected Versions** NotifyVisitors plugin versions 1.0 and earlier **Description** The issue is related to a Stored Cross-Site Scripting (XSS) vulnerability that requires authentication with admin+ privileges. This vulnerability affects the NotifyVisitors plugin. **Recommendations** For versions 1.0 and earlier, update to a version later than 1.0 to resolve the issue. As a temporary workaround, consider restricting access to the plugin's administrative interface to minimize the risk of exploitation.

**Name of the Vulnerable Software and Affected Versions** John Newcombe eBecas plugin versions <= 3.1.3 **Description** The issue is related to a Stored Cross-Site Scripting (XSS) vulnerability that requires authentication with admin+ privileges. **Recommendations** For John Newcombe eBecas plugin versions <= 3.1.3, update to a version higher than 3.1.3 to resolve the issue.

**Name of the Vulnerable Software and Affected Versions** Themeqx LetterPress plugin versions 1.1.2 and earlier **Description** The issue is related to a Stored Cross-Site Scripting (XSS) vulnerability that requires authentication with admin+ privileges. **Recommendations** For Themeqx LetterPress plugin versions 1.1.2 and earlier, update to a version later than 1.1.2 to resolve the issue.

**Name of the Vulnerable Software and Affected Versions** MonitorClick Forms Ada – Form Builder plugin versions <= 1.0 **Description** The issue is related to an Unauth. Reflected Cross-Site Scripting (XSS) vulnerability. This type of vulnerability allows an attacker to inject malicious scripts into a website, potentially leading to unauthorized actions on behalf of the user. **Recommendations** For MonitorClick Forms Ada – Form Builder plugin versions <= 1.0, update to a version greater than 1.0 to resolve the issue. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** Ian Haycox Motor Racing League plugin versions prior to 1.9.9 **Description** The issue is related to an Authenticated (admin+) Cross-Site Scripting (XSS) vulnerability. This means that an attacker who has administrative access to the system can inject malicious scripts into the website, potentially leading to unauthorized actions. **Recommendations** For Ian Haycox Motor Racing League plugin versions prior to 1.9.9, update to a version 1.9.9 or later to resolve the issue.

**Name of the Vulnerable Software and Affected Versions** The Modern Events Calendar Lite WordPress plugin versions prior to 6.5.2 **Description** The issue allows high privilege users, such as admins, to perform Stored Cross-Site Scripting attacks, even when the unfiltered html capability is disallowed, for example, in a multisite setup. This is due to the plugin not sanitizing and escaping some of its settings. **Recommendations** For versions prior to 6.5.2, update to version 6.5.2 or later to resolve the issue. As a temporary workaround, consider restricting the ability of high privilege users to access and modify the plugin's settings until a patch is applied.