Ananda Dhakal

**Name of the Vulnerable Software and Affected Versions** ووسلام – همگام سازی ووکامرس و باسلام versions prior to 1.9.2 **Description** A Cross-Site Request Forgery (CSRF) issue exists in the hamsalam ووسلام – همگام سازی ووکامرس و باسلام sync-basalam plugin. This flaw allows an attacker to induce a victim into performing unwanted actions on the affected system. **Recommendations** Update to a version newer than 1.9.1.

Exposure of Sensitive System Information to an Unauthorized Control Sphere vulnerability in EDGARROJAS WooCommerce PDF Invoice Builder woo-pdf-invoice-builder allows Retrieve Embedded Sensitive Data.This issue affects WooCommerce PDF Invoice Builder: from n/a through <= 2.0.8.

**Name of the Vulnerable Software and Affected Versions** persian-gravity-forms versions prior to 3.0.3 **Description** An improper neutralization of special elements used in an SQL command allows for Blind SQL Injection. Blind SQL Injection is a technique where an attacker asks the database true or false questions and determines the answer based on the application's response. **Recommendations** Update persian-gravity-forms to a version newer than 3.0.2.

**Name of the Vulnerable Software and Affected Versions** Themeisle Auto Featured Image (Auto Post Thumbnail) versions prior to 5.0.5 **Description** Server-Side Request Forgery (SSRF) occurs in the auto-post-thumbnail component, which allows an attacker to induce the server-side application to make requests to an unintended location. **Recommendations** Update Themeisle Auto Featured Image (Auto Post Thumbnail) to version 5.0.5 or later.

Incorrect Privilege Assignment vulnerability in favethemes Houzez Login Register houzez-login-register allows Privilege Escalation.This issue affects Houzez Login Register: from n/a through <= 3.3.3.

**Name of the Vulnerable Software and Affected Versions** Real Testimonials versions prior to 3.1.16 **Description** Deserialization of untrusted data in the testimonial-free component allows for Object Injection. This occurs when the application deserializes data from an untrusted source without sufficient validation, potentially allowing an attacker to inject malicious PHP objects into the application state. **Recommendations** Update to a version newer than 3.1.15.

**Name of the Vulnerable Software and Affected Versions** User Profile Picture versions prior to 2.6.4 **Description** An authorization bypass exists due to a user-controlled key, allowing the exploitation of incorrectly configured access control security levels. This issue is characterized as an Insecure Direct Object Reference (IDOR), which occurs when an application provides direct access to objects based on user-supplied input without sufficient authorization checks. **Recommendations** Update User Profile Picture to version 2.6.4 or later.

**Name of the Vulnerable Software and Affected Versions** Crocoblock JetSearch versions prior to 3.6.1.3 **Description** An issue in the jet-search component allows the retrieval of embedded sensitive system information by an unauthorized control sphere. **Recommendations** Update Crocoblock JetSearch to version 3.6.1.3 or later.

**Name of the Vulnerable Software and Affected Versions** JetBlocks For Elementor versions prior to 1.5.1 **Description** An issue in the Crocoblock JetBlocks For Elementor plugin allows the retrieval of embedded sensitive system information by an unauthorized party. **Recommendations** Update JetBlocks For Elementor to a version newer than 1.5.0.

**Name of the Vulnerable Software and Affected Versions** JetReviews versions prior to 3.0.2 **Description** An issue in the Crocoblock JetReviews plugin allows the retrieval of embedded sensitive system information by an unauthorized control sphere. **Recommendations** Update JetReviews to version 3.0.2 or later.

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in themifyme Themify Builder themify-builder allows Reflected XSS.This issue affects Themify Builder: from n/a through <= 7.7.4.

**Name of the Vulnerable Software and Affected Versions** WooCommerce Bulk Edit Products – WP Sheet Editor versions prior to 1.8.22 **Description** Broken access control occurs due to missing authorization, which allows the exploitation of incorrectly configured access control security levels within the `woo-bulk-edit-products` component. **Recommendations** Update WooCommerce Bulk Edit Products – WP Sheet Editor to version 1.8.22 or later.

**Name of the Vulnerable Software and Affected Versions** CrawlWP SEO versions prior to 3.0.17 **Description** A Cross-Site Request Forgery (CSRF) flaw exists in the CrawlWP SEO plugin. This issue allows an attacker to induce a victim into performing unwanted actions on the affected application. **Recommendations** Update CrawlWP SEO to version 3.0.17 or later.

**Name of the Vulnerable Software and Affected Versions** FormLayer versions prior to 1.0.7 **Description** An issue in Softaculous FormLayer allows for the insertion of sensitive information into sent data, which can lead to the retrieval of embedded sensitive data. **Recommendations** Update FormLayer to version 1.0.7 or later.

**Name of the Vulnerable Software and Affected Versions** Exclusive Addons Elementor versions prior to 2.7.10 **Description** An issue involving the insertion of sensitive information into sent data allows for the retrieval of embedded sensitive data. **Recommendations** Update Exclusive Addons Elementor to version 2.7.10 or later.

**Name of the Vulnerable Software and Affected Versions** WP Debugging versions prior to 2.12.3 **Description** An unauthenticated Cross Site Scripting (XSS) issue exists, which allows an attacker to execute malicious scripts in the browser of a user without requiring prior authentication. **Recommendations** Update to a version newer than 2.12.2.

Unauthenticated Cross Site Request Forgery (CSRF) in Werkstatt <= 4.7.2 versions.

Contributor Cross Site Scripting (XSS) in TheFox <= 3.9.70 versions.

**Name of the Vulnerable Software and Affected Versions** W3 Total Cache versions prior to 2.9.5 **Description** An issue allows unauthenticated users to perform arbitrary code execution, which is the ability to run unauthorized commands or software on the target system. **Recommendations** Update to a version newer than 2.9.4.

Subscriber Broken Access Control in Martfury - WooCommerce Marketplace WordPress Theme <= 3.2.8 versions.