Lorenzo Franchini

**Name of the Vulnerable Software and Affected Versions** Demo Importer Plus plugin for WordPress versions up to and including 2.0.9 **Description** The software is susceptible to XML External Entity Injection (XXE) through the SVG file upload functionality. This allows authenticated attackers with Author-level access or higher to potentially achieve code execution in vulnerable configurations. This issue only impacts sites using PHP versions older than 8.0. **Recommendations** Update the Demo Importer Plus plugin to a version newer than 2.0.9. For sites using PHP versions older than 8.0, consider alternative methods for importing demos that do not involve SVG file uploads.

**Name of the Vulnerable Software and Affected Versions** Download Plugins and Themes in ZIP from Dashboard plugin for WordPress versions through 1.9.6 **Description** The software is susceptible to a Cross-Site Request Forgery (CSRF) issue. This is due to inadequate or missing nonce validation within the `download plugin bulk` and `download theme bulk` functions. An unauthenticated attacker could potentially archive all site plugins and themes, placing them in the `wp-content/uploads/` directory, by forging a request and tricking a site administrator into performing an action. **Recommendations** Update the Download Plugins and Themes in ZIP from Dashboard plugin for WordPress to a version later than 1.9.6.