Guido Iván García Duva

Name of the Vulnerable Software and Affected Versions: Index WP MySQL For Speed WordPress plugin versions prior to 1.4.18 Description: The issue is related to a Reflected Cross-Site Scripting problem. It occurs because a parameter is not properly sanitised and escaped before being outputted back in the page. This could be exploited against high-privilege users, such as administrators. Recommendations: For versions prior to 1.4.18, update to version 1.4.18 or later to resolve the issue. As a temporary workaround, consider restricting access to the plugin's functionality to minimize the risk of exploitation. Avoid using the vulnerable parameter in the affected page until the issue is resolved.

Name of the Vulnerable Software and Affected Versions: User Submitted Posts WordPress plugin versions prior to 20240516 Description: The issue allows high privilege users, such as admins, to perform Stored Cross-Site Scripting attacks, even when the unfiltered html capability is disallowed, for example, in a multisite setup. This is due to the plugin not sanitizing and escaping some of its settings. Recommendations: For versions prior to 20240516, update to a version that includes the necessary sanitization and escaping of settings to prevent Stored Cross-Site Scripting attacks. As a temporary workaround, consider restricting the ability of high privilege users to modify plugin settings until a patch is available.

**Name of the Vulnerable Software and Affected Versions** SULly WordPress plugin versions prior to 4.3.1 **Description** The issue allows high privilege users, such as admins, to perform Stored Cross-Site Scripting attacks. This can occur even when the unfiltered html capability is disallowed, for example in a multisite setup. **Recommendations** For versions prior to 4.3.1, update to version 4.3.1 or later to resolve the issue.

**Name of the Vulnerable Software and Affected Versions** WP Secure Maintenance WordPress plugin versions prior to 1.7 **Description** The issue allows high privilege users, such as admins, to perform Stored Cross-Site Scripting attacks, even when the unfiltered html capability is disallowed, for example in multisite setups. This is due to the plugin not sanitizing and escaping some of its settings. **Recommendations** For WP Secure Maintenance WordPress plugin versions prior to 1.7, update to version 1.7 or later to resolve the issue. As a temporary workaround, consider restricting access to the plugin's settings for high privilege users to minimize the risk of exploitation.

**Name of the Vulnerable Software and Affected Versions** Expert Invoice WordPress plugin versions 1.0.2 and earlier **Description** The issue allows high privilege users, such as admins, to perform Stored Cross-Site Scripting attacks, even when the unfiltered html capability is disallowed, for example, in a multisite setup. This is due to the plugin not sanitizing and escaping some of its settings. **Recommendations** For Expert Invoice WordPress plugin versions 1.0.2 and earlier, update to a version that addresses the sanitization and escaping of settings to prevent Stored Cross-Site Scripting attacks. At the moment, there is no information about a newer version that contains a fix for this vulnerability.