David Gallagher

**Name of the Vulnerable Software and Affected Versions** Phlox theme plugin for WordPress versions up to, and including, 2.16.4 **Description** The issue is related to Stored Cross-Site Scripting via the plugin's `aux contact box` and `aux gmaps` shortcodes due to insufficient input sanitization and output escaping on user-supplied attributes. This allows authenticated attackers with contributor-level access and above to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. **Recommendations** For versions up to, and including, 2.16.4, update to a version that fixes the insufficient input sanitization and output escaping issue. As a temporary workaround, consider restricting access to the `aux contact box` and `aux gmaps` shortcodes to minimize the risk of exploitation.

**Name of the Vulnerable Software and Affected Versions** AMP for WP – Accelerated Mobile Pages plugin for WordPress versions up to, and including, 1.0.99.1 **Description** The issue is related to Cross-Site Request Forgery due to missing or incorrect nonce validation on the `proxy` function. This allows unauthenticated attackers to send the logged-in user's cookies to their own server via a forged request if they can trick a site administrator into performing an action such as clicking on a link. **Recommendations** For versions up to, and including, 1.0.99.1, consider disabling the `proxy` function until a patch is available to prevent exploitation. Restrict access to the `proxy` function to minimize the risk of sending the logged-in user's cookies to unauthorized servers. Avoid using the `proxy` function in situations where a site administrator may be tricked into performing an action that could lead to a forged request.

**Name of the Vulnerable Software and Affected Versions** Transients Manager plugin for WordPress version 2.0.6 and earlier **Description** The issue is due to missing or incorrect nonce validation on the `process actions` function, making it possible for unauthenticated attackers to delete transients via a forged request if they can trick a site administrator into performing an action such as clicking on a link. **Recommendations** For Transients Manager plugin for WordPress version 2.0.6 and earlier, update to a version later than 2.0.6 to resolve the issue. As a temporary workaround, consider disabling the `process actions` function until a patch is available.

Name of the Vulnerable Software and Affected Versions: WP Booking Calendar plugin for WordPress versions up to, and including, 10.5 Description: The issue is related to Reflected Cross-Site Scripting via several parameters from `timeline obj` due to insufficient input sanitization and output escaping. This allows unauthenticated attackers to inject arbitrary web scripts in pages that execute if they can successfully trick a user into performing an action such as clicking on a link. Recommendations: For versions up to, and including, 10.5, consider disabling the `timeline obj` parameter until a patch is available to prevent exploitation. Restrict access to pages that utilize the `timeline obj` parameter to minimize the risk of arbitrary web script injection. Avoid using the `timeline obj` parameter in affected pages until the issue is resolved. At the moment, there is no information about a newer version that contains a fix for this vulnerability.