L33Ch

**Name of the Vulnerable Software and Affected Versions** Auto Attachments plugin for WordPress versions up to, and including, 1.8.5 **Description** The issue is related to Stored Cross-Site Scripting via admin settings due to insufficient input sanitization and output escaping. This allows authenticated attackers with administrator-level permissions to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. The issue only affects multi-site installations and installations where unfiltered html has been disabled. **Recommendations** For versions up to, and including, 1.8.5, update to a version that includes the necessary input sanitization and output escaping fixes to prevent Stored Cross-Site Scripting attacks. As a temporary workaround, consider restricting administrator-level permissions and access to admin settings to minimize the risk of exploitation.

**Name of the Vulnerable Software and Affected Versions** Developer Formatter plugin for WordPress versions up to, and including, 2015.0.2.1 **Description** The issue is related to Stored Cross-Site Scripting via the Custom CSS, caused by insufficient input sanitization and output escaping. This allows authenticated attackers with administrator-level access to inject arbitrary web scripts in pages, which will execute when a user accesses an injected page. The issue only affects multi-site installations and installations where unfiltered html has been disabled. **Recommendations** For versions up to, and including, 2015.0.2.1, update to a version that addresses the insufficient input sanitization and output escaping in the Custom CSS feature to prevent Stored Cross-Site Scripting attacks. As a temporary workaround, consider restricting administrator-level access and disabling the Custom CSS feature until a patch is available.