Maksim Kosenko

**Name of the Vulnerable Software and Affected Versions** UkrSolution Barcode Scanner with Inventory & Order Manager versions through 1.5.3 **Description** A missing authorization flaw exists in UkrSolution Barcode Scanner with Inventory & Order Manager. The issue allows unauthorized access due to insufficient authorization checks. **Recommendations** Update UkrSolution Barcode Scanner with Inventory & Order Manager to a version newer than 1.5.3.

**Name of the Vulnerable Software and Affected Versions** WPvivid Backup & Migration Plugin for WordPress versions up to, and including, 0.9.99 **Description** The issue arises from insufficient path validation on the `tree node[node][id]` parameter, allowing authenticated attackers with admin-level access and above to deserialize untrusted input at the "wpvividstg get custom exclude path free" action. This could enable attackers to call files using a PHAR wrapper, potentially leading to the deserialization of data and the calling of arbitrary PHP Objects. If a POP chain is present via an additional plugin or theme, it could facilitate the deletion of arbitrary files, retrieval of sensitive data, or execution of code. **Recommendations** For WPvivid Backup & Migration Plugin for WordPress versions up to, and including, 0.9.99, consider disabling the `wpvividstg get custom exclude path free` action until a patch is available. Restrict access to the `tree node[node][id]` parameter to minimize the risk of exploitation. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** UkrSolution Barcode Scanner with Inventory & Order Manager versions 1.5.3 and earlier **Description** The issue is related to Improper Neutralization of Input During Web Page Generation, also known as Cross-site Scripting. This allows for Reflected XSS. **Recommendations** For UkrSolution Barcode Scanner with Inventory & Order Manager versions 1.5.3 and earlier, update to a version later than 1.5.3 to resolve the issue. At the moment, there is no information about additional mitigation measures.

**Name of the Vulnerable Software and Affected Versions** The WP Event Manager – Events Calendar, Registrations, Sell Tickets with WooCommerce plugin for WordPress versions up to, and including, 3.1.41 **Description** The issue is related to Reflected Cross-Site Scripting due to insufficient input sanitization and output escaping. This allows unauthenticated attackers to inject arbitrary web scripts in pages that execute if they can successfully trick a user into performing an action such as clicking on a link. **Recommendations** For versions up to, and including, 3.1.41, update to a version later than 3.1.41 to resolve the issue. As a temporary workaround, consider restricting access to the plugin parameter to minimize the risk of exploitation.

**Name of the Vulnerable Software and Affected Versions** The Conversios – Google Analytics 4 (GA4), Meta Pixel & more Via Google Tag Manager For WooCommerce plugin for WordPress versions up to, and including, 6.9.1 **Description** The issue is related to a time-based SQL Injection vulnerability. It affects the `ee syncProductCategory` function, utilizing parameters such as `conditionData`, `valueData`, `productArray`, `exclude`, and `include`. This vulnerability is caused by insufficient escaping of user-supplied parameters and a lack of preparation in the existing SQL query. As a result, authenticated attackers with subscriber access or higher can append additional SQL queries to extract sensitive information from the database. **Recommendations** For versions up to, and including, 6.9.1, consider disabling the `ee syncProductCategory` function until a patch is available to prevent exploitation. Restrict access to the parameters `conditionData`, `valueData`, `productArray`, `exclude`, and `include` to minimize the risk of SQL injection attacks. At the moment, there is no information about a newer version that contains a fix for this vulnerability.