Mariam Tariq

**Name of the Vulnerable Software and Affected Versions** WP-Invoice WordPress plugin versions 4.3.1 and earlier **Description** The issue is related to the lack of CSRF check when updating settings and insufficient sanitization and escaping in some settings, allowing an attacker to make a logged-in admin change them and add an XSS payload. **Recommendations** For WP-Invoice WordPress plugin versions 4.3.1 and earlier, update to a version that includes the necessary CSRF checks and proper sanitization and escaping of settings to prevent exploitation.

**Name of the Vulnerable Software and Affected Versions** The Coru LFMember WordPress plugin versions 1.0.2 and earlier **Description** The issue is related to the lack of CSRF check when adding a new game and insufficient sanitization and escaping in the settings. This allows an attacker to make a logged-in admin add an arbitrary game with XSS payloads. **Recommendations** For versions 1.0.2 and earlier, update to a version that includes proper CSRF checks and sanitization to prevent exploitation. As a temporary workaround, consider restricting access to the game addition feature to minimize the risk of exploitation.

**Name of the Vulnerable Software and Affected Versions** GetYourGuide Ticketing WordPress plugin versions prior to 1.0.4 **Description** The issue allows high privilege users, such as admins, to perform Stored Cross-Site Scripting attacks, even when the unfiltered html capability is disallowed, for example in multisite setups. This is due to the plugin not sanitizing and escaping some parameters. **Recommendations** For versions prior to 1.0.4, update to version 1.0.4 or later to resolve the issue. As a temporary workaround, consider restricting the use of the plugin in multisite setups to minimize the risk of exploitation.

**Name of the Vulnerable Software and Affected Versions** Jeeng Push Notifications WordPress plugin versions prior to 2.0.4 **Description** The issue allows high privilege users, such as admins, to perform Stored Cross-Site Scripting attacks, even when the unfiltered html capability is disallowed, for example, in a multisite setup. This is due to the plugin not sanitizing and escaping some of its settings. **Recommendations** For versions prior to 2.0.4, update to version 2.0.4 or later to resolve the issue. As a temporary workaround, consider restricting access to the plugin's settings for high privilege users until the update is applied.

**Name of the Vulnerable Software and Affected Versions** Highlight Focus WordPress plugin versions 1.1 and earlier **Description** The issue allows high privilege users, such as admins, to perform Stored Cross-Site Scripting attacks, even when the unfiltered html capability is disallowed, for example, in a multisite setup. This is due to the plugin not sanitizing and escaping some of its settings. **Recommendations** For Highlight Focus WordPress plugin versions 1.1 and earlier, update to a version that addresses the sanitization and escaping of settings to prevent Stored Cross-Site Scripting attacks. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** The Simple Page Transition WordPress plugin versions 1.4.1 and earlier **Description** The issue allows high privilege users, such as admins, to perform Stored Cross-Site Scripting attacks when the unfiltered html capability is disallowed, for example in a multisite setup. This is due to the plugin not sanitizing and escaping some of its settings. **Recommendations** For The Simple Page Transition WordPress plugin versions 1.4.1 and earlier, update to a version that addresses the sanitization and escaping of settings to prevent Stored Cross-Site Scripting attacks.

**Name of the Vulnerable Software and Affected Versions** W-DALIL WordPress plugin versions 2.0 and earlier **Description** The issue allows high privilege users, such as admins, to perform Stored Cross-Site Scripting attacks when the unfiltered html capability is disallowed, for example in a multisite setup. This is due to the plugin not sanitizing and escaping some of its fields. **Recommendations** For W-DALIL WordPress plugin versions 2.0 and earlier, update to a version that addresses the sanitization and escaping of fields to prevent Stored Cross-Site Scripting attacks. As a temporary workaround, consider restricting the unfiltered html capability to minimize the risk of exploitation.

**Name of the Vulnerable Software and Affected Versions** ScrollReveal.js Effects WordPress plugin versions 1.2 and earlier **Description** The issue allows high privilege users to perform Cross-Site Scripting attacks due to the lack of sanitization and escaping of its settings, even when unfiltered html is disallowed. **Recommendations** For versions 1.2 and earlier, update to a version that properly sanitizes and escapes settings to prevent Cross-Site Scripting attacks.