Majed Refaea

**Name of the Vulnerable Software and Affected Versions** Hamid Alinia versions n/a through 1.6.93 **Description** A missing authorization issue exists in the Login with phone number functionality. **Recommendations** Update to a version later than 1.6.93.

Name of the Vulnerable Software and Affected Versions: Nitesh Singh Ultimate Auction versions through 4.2.5 Description: The issue is a Cross-Site Request Forgery (CSRF) vulnerability, which allows an attacker to perform unauthorized actions on a user's account. This can be achieved by tricking the user into performing an unintended action, such as making a request to a specific API endpoint, for example, "/api/v1/bid" or "/users/{id}/bid". Recommendations: For versions through 4.2.5, update to a version that includes a fix for this issue, as no specific mitigation measures are provided for these versions. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Name of the Vulnerable Software and Affected Versions: MasterStudy LMS versions prior to 3.2.1 Description: The issue is a Cross-Site Request Forgery (CSRF) vulnerability, which allows an attacker to perform unauthorized actions on a user's account. This is a type of attack where an attacker tricks a user into performing an unintended action on a web application that the user is authenticated to. Recommendations: For versions prior to 3.2.1, update to a version that includes a fix for this issue. As a temporary workaround, consider implementing additional validation for requests to prevent unauthorized actions. Restrict access to sensitive functionality to minimize the risk of exploitation.

Name of the Vulnerable Software and Affected Versions: Labib Ahmed Animated Rotating Words versions through 5.6 Description: A Cross-Site Request Forgery (CSRF) issue affects the software, allowing unauthorized requests. Recommendations: For versions through 5.6, update to a version that includes a fix for this issue, however at the moment, there is no information about a newer version that contains a fix for this vulnerability.

Name of the Vulnerable Software and Affected Versions: Marco Milesi Telegram Bot & Channel versions n/a through 3.8.2 Description: The issue is a Cross-Site Request Forgery (CSRF) vulnerability, which allows for Cross Site Request Forgery. This means an attacker can trick a user into performing unintended actions on a web application that the user is authenticated to. Recommendations: For versions n/a through 3.8.2, update to a version that contains a fix for this issue, as no specific mitigation measures are provided for these versions. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Name of the Vulnerable Software and Affected Versions: Taggbox versions n/a through 3.3 Description: A Cross-Site Request Forgery (CSRF) issue affects Taggbox, allowing unauthorized requests. Recommendations: For versions n/a through 3.3, update to a version that includes a fix for this issue, as no specific mitigation measures are provided for these versions. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Name of the Vulnerable Software and Affected Versions: Epsiloncool WP Fast Total Search versions 1.69.234 and earlier Description: The issue is a Cross-Site Request Forgery (CSRF) vulnerability. This type of vulnerability allows an attacker to trick a user into performing unintended actions on a web application that the user is authenticated to. Recommendations: For Epsiloncool WP Fast Total Search versions 1.69.234 and earlier, update to a version that is not affected by this issue. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Name of the Vulnerable Software and Affected Versions: Metorik – Reports & Email Automation for WooCommerce versions 1.7.1 and earlier Description: A Cross-Site Request Forgery (CSRF) issue affects the software, allowing unauthorized actions. The estimated number of potentially affected devices worldwide is not specified. There is no information about real-world incidents where this issue was exploited. Recommendations: For Metorik – Reports & Email Automation for WooCommerce versions 1.7.1 and earlier, update to a version later than 1.7.1 to resolve the issue. As a temporary workaround, consider implementing additional CSRF protection measures, such as token-based validation, to minimize the risk of exploitation.

Name of the Vulnerable Software and Affected Versions: WPAdverts – Classifieds Plugin versions n/a through 2.1.2 Description: The issue is a Cross-Site Request Forgery (CSRF) vulnerability, which allows an attacker to perform unauthorized actions on a user's account. This can be achieved by tricking the user into performing an unintended action, such as submitting a form or clicking a link. Recommendations: For WPAdverts – Classifieds Plugin versions n/a through 2.1.2, update to a version later than 2.1.2 to resolve the issue. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Name of the Vulnerable Software and Affected Versions: Magazine3 Google Adsense & Banner Ads by AdsforWP versions 1.9.28 and earlier Description: The issue is a Cross-Site Request Forgery (CSRF) vulnerability, which allows an attacker to perform unauthorized actions on a user's account. This can be achieved by tricking the user into performing an unintended action, such as clicking on a malicious link. Recommendations: For versions 1.9.28 and earlier, update to a version later than 1.9.28 to resolve the issue. As a temporary workaround, consider restricting access to sensitive features of the Magazine3 Google Adsense & Banner Ads by AdsforWP plugin until a patch is available.

**Name of the Vulnerable Software and Affected Versions** WpTravelly versions 1.7.7 and earlier **Description** The issue is related to a Missing Authorization vulnerability, which allows accessing functionality not properly constrained by ACLs. **Recommendations** For versions 1.7.7 and earlier, update to a version that properly constrains functionality with ACLs to prevent unauthorized access. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** Jordy Meow Photo Engine versions n/a through 6.4.0 **Description** The issue is related to a Missing Authorization vulnerability, which allows exploiting incorrectly configured access control security levels. **Recommendations** For versions n/a through 6.4.0, update to a version that contains a fix for this issue, as the current version is affected by the Missing Authorization vulnerability. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** Epsiloncool WP Fast Total Search versions 1.68.232 and earlier **Description** The issue is related to a Missing Authorization vulnerability, which allows exploiting incorrectly configured access control security levels. **Recommendations** For Epsiloncool WP Fast Total Search versions 1.68.232 and earlier, update to a version that contains a fix for this issue, as no specific workaround or mitigation measures are provided.

**Name of the Vulnerable Software and Affected Versions** MasterStudy LMS versions 3.2.12 and earlier **Description** The issue is related to missing authorization, allowing exploitation due to incorrectly configured access control security levels. **Recommendations** For MasterStudy LMS versions 3.2.12 and earlier, at the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** WP GoToWebinar versions through 15.6 **Description** The issue is related to a Missing Authorization vulnerability, allowing the exploitation of incorrectly configured access control security levels. **Recommendations** For versions through 15.6, update to a version that contains a fix for this issue. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** WP Sunshine Sunshine Photo Cart versions prior to 3.2.9 **Description** The issue is related to a Missing Authorization vulnerability, which allows exploiting incorrectly configured access control security levels. **Recommendations** For versions prior to 3.2.9, update to a version that contains a fix for this issue. As a temporary workaround, consider restricting access to sensitive areas of the application to minimize the risk of exploitation.

**Name of the Vulnerable Software and Affected Versions** User Rights Access Manager versions 1.1.2 and earlier **Description** The issue is related to an Access Control vulnerability in the User Rights Access Manager. This vulnerability allows unauthorized access. **Recommendations** For versions 1.1.2 and earlier, update to a version that contains a fix for this issue, if available. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** Dropshipping Guru Ali2Woo Lite versions n/a through 3.3.5 **Description** The issue is related to a Missing Authorization vulnerability, which involves exploiting incorrectly configured access control security levels. It also includes a Stored XSS vulnerability. **Recommendations** For versions n/a through 3.3.5, update to a version later than 3.3.5 to resolve the issue. As a temporary workaround, consider restricting access to sensitive areas of the application to minimize the risk of exploitation. Avoid using the application until the issue is resolved, if possible. At the moment, there is no information about additional mitigation measures.

**Name of the Vulnerable Software and Affected Versions** Meks Video Importer versions 1.0.12 and earlier **Description** The issue is related to a Missing Authorization vulnerability, which allows exploitation of incorrectly configured access control security levels. **Recommendations** For Meks Video Importer versions 1.0.12 and earlier, update to a version that contains a fix for this issue. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** MyBookTable Bookstore versions 3.3.9 and earlier **Description** The issue is a Cross-Site Request Forgery (CSRF) vulnerability that allows Cross-Site Scripting (XSS) in the MyBookTable Bookstore plugin for WordPress. Users are advised to upgrade to the latest version to mitigate risks. **Recommendations** For MyBookTable Bookstore versions 3.3.9 and earlier, upgrade to the latest version to resolve the issue. As a temporary workaround, consider restricting access to the plugin until the issue is resolved.