Genubhau Wayal

**Name of the Vulnerable Software and Affected Versions** Sociable WordPress plugin versions 4.3.4.1 and earlier **Description** The issue allows high privilege users to perform Cross-Site Scripting attacks against other users, even when the unfiltered html capability is disallowed, due to the plugin not sanitizing or escaping some of its settings before outputting them in the admin's dashboard. **Recommendations** For Sociable WordPress plugin versions 4.3.4.1 and earlier, update to a version later than 4.3.4.1 to resolve the issue. As a temporary workaround, consider restricting access to the admin dashboard to minimize the risk of exploitation.

**Name of the Vulnerable Software and Affected Versions** Keyword Meta WordPress plugin versions 3.0 and earlier **Description** The issue arises from the plugin's failure to sanitise or escape its settings before outputting them, leading to Cross-Site Scripting issues. Additionally, the lack of a CSRF check allows attackers to manipulate logged-in high-privilege users into saving arbitrary settings via a CSRF attack. **Recommendations** For versions 3.0 and earlier, update to a version that addresses the sanitisation and CSRF issues. As a temporary workaround, consider restricting access to the plugin's settings page to minimize the risk of exploitation. Avoid using the plugin until a patched version is available.