Đỗ Quang Huy

Name of the Vulnerable Software and Affected Versions: File Manager, Code Editor, and Backup by Managefy plugin for WordPress versions prior to 1.4.9 Description: The File Manager, Code Editor, and Backup by Managefy plugin for WordPress is susceptible to a Path Traversal issue in versions up to and including 1.4.8. Authenticated attackers with Subscriber-level access or higher can potentially perform actions on files outside the intended directory through the `ajax downloadfile()` function. Recommendations: Update the File Manager, Code Editor, and Backup by Managefy plugin for WordPress to version 1.4.9 or later.

**Name of the Vulnerable Software and Affected Versions** Knowledge Base plugin for WordPress versions prior to 2.3.2 **Description** The Knowledge Base plugin for WordPress is susceptible to Stored Cross-Site Scripting via the plugin slug setting due to insufficient input sanitization and output escaping. This allows authenticated attackers with administrator-level access to inject arbitrary web scripts into pages. These scripts will execute when a user accesses the injected page. This issue only affects multi-site installations and installations where unfiltered html has been disabled. **Recommendations** Update the Knowledge Base plugin to version 2.3.2 or later.