Jonghwan Shin

**Name of the Vulnerable Software and Affected Versions** Meta Box versions prior to 5.11.2 **Description** The Meta Box plugin for WordPress is susceptible to arbitrary file deletion. This is due to inadequate file path validation within the `ajax delete file` function. Authenticated attackers possessing Contributor-level access or higher can delete arbitrary files on the server. Deletion of specific files, such as `wp-config.php`, could lead to remote code execution. **Recommendations** Update Meta Box to version 5.11.2 or later.

**Name of the Vulnerable Software and Affected Versions** Advanced Custom Fields: Font Awesome Field plugin for WordPress versions up to and including 5.0.1 **Description** The Advanced Custom Fields: Font Awesome Field plugin for WordPress is susceptible to Cross-Site Scripting due to inadequate input sanitization and output escaping. This allows authenticated attackers with Contributor-level access or higher to inject arbitrary web scripts that will execute in a victim’s browser. **Recommendations** Update the Advanced Custom Fields: Font Awesome Field plugin to a version later than 5.0.1.

**Name of the Vulnerable Software and Affected Versions** Ivory Search – WordPress Search Plugin versions prior to 5.5.14 **Description** The Ivory Search – WordPress Search Plugin for WordPress is susceptible to Stored Cross-Site Scripting through admin settings. Insufficient input sanitization and output escaping allows authenticated attackers with administrator-level permissions or higher to inject arbitrary web scripts into pages. These scripts will execute when a user accesses the injected page. This issue specifically impacts multi-site installations and those where unfiltered html has been disabled. **Recommendations** Update Ivory Search – WordPress Search Plugin to version 5.5.14 or later.

**Name of the Vulnerable Software and Affected Versions** Image Photo Gallery Final Tiles Grid plugin for WordPress versions up to and including 3.6.7 **Description** The Image Photo Gallery Final Tiles Grid plugin for WordPress does not properly verify user authorization for gallery management functions. This allows authenticated attackers with Contributor-level access or higher to delete, modify, or clone galleries created by any user, including administrators. **Recommendations** Update the Image Photo Gallery Final Tiles Grid plugin to a version later than 3.6.7.