Longxi

**Name of the Vulnerable Software and Affected Versions** SocialDriver WordPress theme versions prior to 2024 **Description** The issue is related to a prototype pollution vulnerability. This could allow an attacker to inject arbitrary properties, resulting in a cross-site scripting (XSS) attack. **Recommendations** For versions prior to 2024, update to version 2024 or later to resolve the issue. As a temporary workaround, consider restricting access to sensitive areas of the theme to minimize the risk of exploitation.

**Name of the Vulnerable Software and Affected Versions** The Your Journey theme for WordPress versions up to, and including, 1.9.8 **Description** The issue is related to Reflected Cross-Site Scripting via prototype pollution due to insufficient input sanitization and output escaping. This allows unauthenticated attackers to inject arbitrary web scripts in pages that execute if they can successfully trick a user into performing an action such as clicking on a link. **Recommendations** For versions up to, and including, 1.9.8, update to a version later than 1.9.8 to resolve the issue. As a temporary workaround, consider restricting user interactions with potentially vulnerable pages to minimize the risk of exploitation.

**Name of the Vulnerable Software and Affected Versions** Winters theme for WordPress versions up to, and including, 1.4.3 **Description** The issue is related to Reflected Cross-Site Scripting via prototype pollution due to insufficient input sanitization and output escaping. This allows unauthenticated attackers to inject arbitrary web scripts in pages that execute if they can successfully trick a user into performing an action such as clicking on a link. **Recommendations** For versions up to, and including, 1.4.3, update to a version that addresses the insufficient input sanitization and output escaping issue to prevent Reflected Cross-Site Scripting via prototype pollution. As a temporary workaround, consider restricting user interactions with potentially vulnerable pages until a patch is available.

**Name of the Vulnerable Software and Affected Versions** nsc theme for WordPress version 1.0 **Description** The issue is related to Reflected Cross-Site Scripting via prototype pollution due to insufficient input sanitization and output escaping. This allows unauthenticated attackers to inject arbitrary web scripts in pages that execute if they can successfully trick a user into performing an action such as clicking on a link. **Recommendations** For version 1.0, update to a version that addresses the insufficient input sanitization and output escaping issue to prevent Reflected Cross-Site Scripting via prototype pollution.