0Xb9

**Name of the Vulnerable Software and Affected Versions** MyBB Timeline Plugin version 1.0 **Description** Cross-site scripting issues allow the injection of malicious scripts via thread titles, post content, and user profile fields such as `Location` and `Bio`. Additionally, a cross-site request forgery flaw exists in the 'timeline.php' profile action, enabling attackers to change a user's cover picture by crafting malicious forms that execute when victims visit affected profiles. **Recommendations** At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** GSearch version 1.0.1.0 **Description** A denial of service issue allows local attackers to crash the application by inputting an excessively long string in the search bar. The crash is triggered when an attacker pastes a buffer of 2000 characters into the search field, executes a search, and selects any result. **Recommendations** At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** MyBB Delete Account Plugin version 1.4 **Description** The MyBB Delete Account Plugin contains a cross-site scripting issue in the account deletion reason input field. An attacker can inject malicious scripts that will execute in the admin interface when viewing delete account reasons. The vulnerable input allows for the injection of scripts that impact the admin interface. **Recommendations** Update the MyBB Delete Account Plugin to a newer version that addresses this issue. As a temporary workaround, sanitize all input to the account deletion reason field to prevent script injection.

**Name of the Vulnerable Software and Affected Versions** Herd Effects plugin versions <= 5.2 **Description** The issue is an Authenticated Local File Inclusion (LFI) vulnerability. This means that an attacker with admin or higher user role privileges can potentially include and execute local files on the system, which could lead to sensitive information disclosure or code execution. The estimated number of potentially affected devices worldwide is not specified. There is no information provided about real-world incidents where this issue was exploited. **Recommendations** For Herd Effects plugin versions <= 5.2, update to a version higher than 5.2 to resolve the issue. At the moment, there is no information about additional mitigation measures.

**Name of the Vulnerable Software and Affected Versions** Hover Effects plugin versions <= 2.1 **Description** The issue is related to an Authenticated Local File Inclusion (LFI) vulnerability. This means that an attacker with administrator or higher user role privileges can potentially include and execute local files on the system. **Recommendations** For Hover Effects plugin versions <= 2.1, update to a version higher than 2.1 to resolve the issue.

**Name of the Vulnerable Software and Affected Versions** Wow-Company's Popup Box plugin versions <= 2.1.2 **Description** The issue is related to an Authenticated Local File Inclusion (LFI) vulnerability. This means that an attacker with administrator or higher role privileges can potentially include and execute local files on the server. The estimated number of potentially affected devices worldwide is not specified. There is no information provided about real-world incidents where this issue was exploited. **Recommendations** For Wow-Company's Popup Box plugin versions <= 2.1.2, update to a version higher than 2.1.2 to resolve the issue. As a temporary workaround, consider restricting access to the plugin's functionality for users with administrator or higher roles until a patch is available.

**Name of the Vulnerable Software and Affected Versions** Easy Google Maps WordPress plugin versions prior to 1.9.32 **Description** The issue is related to a Reflected Cross-Site Scripting problem. It occurs because the `tab` parameter is not properly escaped before being outputted back in an attribute in the admin dashboard. This can lead to malicious script execution. **Recommendations** For versions prior to 1.9.32, update to version 1.9.32 or later to resolve the issue. As a temporary workaround, consider restricting access to the admin dashboard to minimize the risk of exploitation.

**Name of the Vulnerable Software and Affected Versions** Coming Soon by Supsystic WordPress plugin versions prior to 1.7.6 **Description** The issue is related to a Reflected Cross-Site Scripting problem. It occurs because the `tab` parameter is not properly sanitised and escaped before being outputted back in an attribute in the admin dashboard. **Recommendations** For versions prior to 1.7.6, update to version 1.7.6 or later to resolve the issue.

**Name of the Vulnerable Software and Affected Versions** The Pricing Table by Supsystic WordPress plugin versions prior to 1.9.5 **Description** The issue is related to a Reflected Cross-Site Scripting problem. It occurs because the `tab` parameter is not properly escaped before being outputted back in an attribute in the admin dashboard. **Recommendations** For versions prior to 1.9.5, update to version 1.9.5 or later to resolve the issue.

**Name of the Vulnerable Software and Affected Versions** Post Grid WordPress plugin versions prior to 2.1.8 **Description** The issue arises from the improper sanitization of the slider import search feature and the `tab` parameter in the plugin's settings, which can lead to Reflected Cross-Site Scripting issues. **Recommendations** For versions prior to 2.1.8, update to version 2.1.8 or later to resolve the issue.

**Name of the Vulnerable Software and Affected Versions** Easy Cookies Policy WordPress plugin versions 1.6.2 and earlier **Description** The issue allows any authenticated users, such as subscribers, to change settings due to a lack of capability and CSRF checks. This can also be exploited through CSRF if user registration is not possible. Additionally, the cookie banner setting is not properly sanitized or validated before being output on all frontend and backend pages, leading to a Stored Cross-Site Scripting issue. **Recommendations** For versions 1.6.2 and earlier, update to a version that includes the necessary capability and CSRF checks for saving settings, and ensure proper sanitization and validation of the cookie banner setting to prevent Stored Cross-Site Scripting. As a temporary workaround, consider restricting access to the settings page to prevent unauthorized changes until a patch is available. Avoid using the vulnerable cookie banner setting in the affected API endpoints until the issue is resolved.

**Name of the Vulnerable Software and Affected Versions** PickPlugins Product Slider for WooCommerce WordPress plugin versions prior to 1.13.22 **Description** The issue is related to the slider import search feature, which did not properly sanitize the `keyword` GET parameter, leading to a reflected Cross-Site Scripting issue. **Recommendations** For versions prior to 1.13.22, update to version 1.13.22 or later to resolve the issue. As a temporary workaround, consider restricting access to the slider import search feature until the update is applied. Avoid using the `keyword` parameter in the affected search endpoint until the issue is resolved.

**Name of the Vulnerable Software and Affected Versions** Select All Categories and Taxonomies, Change Checkbox to Radio Buttons WordPress plugin versions prior to 1.3.2 **Description** The issue is related to a reflected Cross-Site Scripting problem. It occurs because the settings page of the plugin did not properly sanitise the `tab` parameter before outputting it back. **Recommendations** For versions prior to 1.3.2, update to version 1.3.2 or later to resolve the issue.

**Name of the Vulnerable Software and Affected Versions** Redirect 404 to parent WordPress plugin versions prior to 1.3.1 **Description** The issue is related to a reflected Cross-Site Scripting problem. The settings page of the plugin did not properly sanitise the `tab` parameter before outputting it back. **Recommendations** For versions prior to 1.3.1, update to version 1.3.1 or later to resolve the issue. As a temporary workaround, consider restricting access to the settings page to minimize the risk of exploitation. Avoid using the `tab` parameter in the affected settings page until the issue is resolved.

**Name of the Vulnerable Software and Affected Versions** The Popup by Supsystic WordPress plugin versions prior to 1.10.5 **Description** The issue is related to a reflected Cross-Site Scripting problem. It occurs because the `tab` parameter of the plugin's options page is not properly sanitized before being output in an attribute. This allows for malicious scripts to be injected. **Recommendations** For versions prior to 1.10.5, update to version 1.10.5 or later to resolve the issue. As a temporary workaround, consider restricting access to the plugin's options page to minimize the risk of exploitation.

Name of the Vulnerable Software and Affected Versions: The Business Directory Plugin – Easy Listing Directories for WordPress versions prior to 5.11.1 Description: The issue allows an attacker to perform Cross-Site Request Forgery, enabling them to make a logged-in administrator add, edit, or delete form fields. This could also lead to Stored Cross-Site Scripting issues. Recommendations: For versions prior to 5.11.1, update to version 5.11.1 or later to resolve the issue.

**Name of the Vulnerable Software and Affected Versions** The Business Directory Plugin – Easy Listing Directories for WordPress versions prior to 5.11.2 **Description** The issue allows an attacker to perform a Cross-Site Request Forgery, enabling them to make a logged-in administrator update arbitrary payment history. This can include changing the status of payments, for example, from pending to completed. **Recommendations** For versions prior to 5.11.2, update to version 5.11.2 or later to resolve the issue. As a temporary workaround, consider restricting access to payment history update functionality until the update is applied.

Name of the Vulnerable Software and Affected Versions: The Business Directory Plugin – Easy Listing Directories for WordPress versions prior to 5.11 Description: The issue allows an attacker to make a logged-in administrator import files due to a Cross-Site Request Forgery problem. Additionally, the plugin's failure to validate uploaded files could lead to Remote Code Execution (RCE). Recommendations: For versions prior to 5.11, update to version 5.11 or later to resolve the issue. As a temporary workaround, consider restricting file import functionality to minimize the risk of exploitation. Avoid using the file import feature until the issue is resolved.

**Name of the Vulnerable Software and Affected Versions** The Ultimate Maps by Supsystic WordPress plugin versions prior to 1.2.5 **Description** The issue is related to a reflected Cross-Site Scripting problem. It occurs because the `tab` parameter of the plugin's options page is not properly sanitized before being output in an attribute. This allows for malicious scripts to be injected. **Recommendations** For versions prior to 1.2.5, update to version 1.2.5 or later to resolve the issue. As a temporary workaround, consider restricting access to the plugin's options page to minimize the risk of exploitation. Avoid using the `tab` parameter in the affected API endpoint until the issue is resolved.

**Name of the Vulnerable Software and Affected Versions** Contact Form Check Tester WordPress plugin versions prior to 1.0.3 **Description** The issue allows any registered user to leave an XSS payload in the plugin settings, which can be triggered by any user visiting them. This could potentially allow for privilege escalation. The estimated number of potentially affected devices is not specified. **Recommendations** For Contact Form Check Tester WordPress plugin versions prior to 1.0.3, consider uninstalling the plugin as the vendor has decided to close it, and there is no available update to fix the issue. As a temporary workaround, consider restricting access to the plugin settings to minimize the risk of exploitation.