Claw.K

**Name of the Vulnerable Software and Affected Versions** WidgetPack Comment System versions prior to 1.6.2 **Description** The software is susceptible to Cross-Site Request Forgery due to missing or incorrect nonce validation on the `wpcmt sync` action within the `wpcmt request handler` function. This allows unauthenticated attackers to trigger comment synchronization events through a forged request if they can trick a site administrator into performing an action, such as clicking a link. **Recommendations** Update WidgetPack Comment System to version 1.6.2 or later.

**Name of the Vulnerable Software and Affected Versions** Page Blocks plugin for WordPress versions prior to 1.1.1 **Description** The software is susceptible to Cross-Site Request Forgery (CSRF). This is a result of inadequate or missing nonce validation within the `admin process widget page change` function. An unauthenticated attacker could potentially modify widget page block configurations by deceiving a site administrator into performing an action, such as clicking a malicious link. **Recommendations** Update to Page Blocks plugin for WordPress version 1.1.1 or later.

**Name of the Vulnerable Software and Affected Versions** USS Upyun plugin for WordPress versions prior to 1.5.1 **Description** The USS Upyun plugin for WordPress is susceptible to a Cross-Site Request Forgery issue. This is due to missing or incorrect nonce validation within the `uss setting page` function when handling the `uss set` form type. Successful exploitation allows unauthenticated attackers to modify critical Upyun cloud storage settings, including the bucket name, operator credentials, upload paths, and image processing parameters, by forging requests and tricking a site administrator into performing an action. **Recommendations** Update the USS Upyun plugin to version 1.5.1 or later.