Anurag Bhoir

**Name of the Vulnerable Software and Affected Versions** The Slider, Gallery, and Carousel by MetaSlider WordPress plugin versions prior to 3.27.9 **Description** The issue concerns the lack of sanitization and escaping of certain Gallery Image parameters, which could allow high-privilege users, such as administrators, to perform Stored Cross-Site Scripting attacks. This is possible even when the unfiltered html capability is disallowed, for example, in a multisite setup. **Recommendations** For versions prior to 3.27.9, update to version 3.27.9 or later to resolve the issue. As a temporary workaround, consider restricting access to the Gallery Image parameters to minimize the risk of exploitation.

**Name of the Vulnerable Software and Affected Versions** WordLift WordPress plugin versions prior to 3.37.2 **Description** The issue allows high privilege users, such as admins, to perform cross-Site Scripting attacks. This is possible because the plugin does not properly sanitise and escape its settings, even when the unfiltered html capability is disallowed. **Recommendations** For versions prior to 3.37.2, update to version 3.37.2 or later to resolve the issue.

**Name of the Vulnerable Software and Affected Versions** Generate PDF WordPress plugin versions prior to 3.6 **Description** The issue allows high privilege users, such as admins, to perform cross-Site Scripting attacks due to the lack of sanitization and escaping of its settings, even when the unfiltered html capability is disallowed. **Recommendations** For versions prior to 3.6, update to version 3.6 or later to resolve the issue. As a temporary workaround, consider restricting access to the plugin's settings for high privilege users until the update is applied.