Nguyen Ba Khanh

**Name of the Vulnerable Software and Affected Versions** Blocksy Companion Pro plugin for WordPress versions prior to 2.1.47 **Description** An unauthenticated arbitrary file upload issue exists within the Advanced Reviews feature. The `save attachments()` function fails to properly validate file extensions, specifically due to a flawed `strpos()` substring check in the Custom Fonts extension. An attacker can bypass this validation by using double-extension filenames, such as `shell.woff2.php`, allowing the upload of executable files that the web server processes as PHP, leading to remote code execution. **Recommendations** Update Blocksy Companion Pro plugin for WordPress to version 2.1.47 or later.

**Name of the Vulnerable Software and Affected Versions** Survey Maker versions prior to 5.2.2.6 **Description** An unauthenticated Cross Site Scripting (XSS) issue exists, which allows an attacker to execute malicious scripts in the browser of a user without requiring prior authentication. **Recommendations** Update to a version newer than 5.2.2.5.

Unauthenticated Cross Site Scripting (XSS) in WowAddons <= 1.6.14 versions.

Unauthenticated Cross Site Scripting (XSS) in WP Photo Album Plus <= 9.2.02.004 versions.

Unauthenticated Cross Site Scripting (XSS) in Modula - PRO <= 2.10.8 versions.

**Name of the Vulnerable Software and Affected Versions** Admin and Site Enhancements (ASE) Pro versions prior to 8.8.6 **Description** An unauthenticated Cross Site Scripting (XSS) issue exists, which allows an attacker to execute malicious scripts in the browser of a user without requiring prior authentication. **Recommendations** Update Admin and Site Enhancements (ASE) Pro to version 8.8.6 or later.

**Name of the Vulnerable Software and Affected Versions** Sendcloud Shipping versions prior to 1.0.30 **Description** Missing authorization allows for the exploitation of incorrectly configured access control security levels. **Recommendations** Update Sendcloud Shipping to version 1.0.30 or later.

**Name of the Vulnerable Software and Affected Versions** Blocksy Companion Pro versions prior to 2.1.47 **Description** An unauthenticated remote code execution flaw allows an attacker to execute arbitrary code on the site without requiring login credentials. **Recommendations** Update to a version newer than 2.1.46.

**Name of the Vulnerable Software and Affected Versions** Kit (formerly ConvertKit) for WooCommerce versions prior to 2.1.6 **Description** An unauthenticated sensitive data exposure issue exists in the plugin, allowing unauthorized users to access confidential information without providing credentials. **Recommendations** Update the plugin to a version newer than 2.1.5.

**Name of the Vulnerable Software and Affected Versions** wpDataTables versions 6.5.1.1 and earlier **Description** An unauthenticated Cross Site Scripting (XSS) issue exists, allowing an attacker to execute malicious scripts in the browser of a user without requiring prior authentication. **Recommendations** Update wpDataTables to a version later than 6.5.1.1.

**Name of the Vulnerable Software and Affected Versions** WooCommerce Designer Pro versions prior to 1.9.35 **Description** Cross Site Scripting (XSS) allows an attacker with subscriber privileges to execute malicious scripts in the browser of other users. **Recommendations** Update WooCommerce Designer Pro to version 1.9.35 or later.

Unauthenticated Cross Site Scripting (XSS) in weMail <= 2.1.2 versions.

**Name of the Vulnerable Software and Affected Versions** Automatic versions prior to 3.135.1 **Description** An unauthenticated Cross Site Scripting (XSS) issue exists, which allows an attacker to execute malicious scripts in the browser of a user without requiring prior authentication. **Recommendations** Update to version 3.135.1 or later.

**Name of the Vulnerable Software and Affected Versions** JetSmartFilters versions prior to 3.8.4 **Description** An unauthenticated SQL Injection exists in the software. SQL Injection is a type of vulnerability that allows an attacker to interfere with the queries that an application makes to its database, potentially allowing them to view data they are not normally able to retrieve. **Recommendations** Update JetSmartFilters to version 3.8.4 or later.

**Name of the Vulnerable Software and Affected Versions** Exclusive Addons Elementor versions prior to 2.7.9.9 **Description** Improper neutralization of input during web page generation allows for Stored Cross-site Scripting (XSS), a flaw where malicious scripts are permanently stored on the target server and later executed in the browser of an unsuspecting user. **Recommendations** Update Exclusive Addons Elementor to version 2.7.9.9 or later.

Unauthenticated Cross Site Scripting (XSS) in FOX <= 1.4.8 versions.

**Name of the Vulnerable Software and Affected Versions** YMC Filter versions prior to 3.11.5 **Description** Improper neutralization of special elements used in an SQL command allows for SQL Injection. This occurs when the application fails to properly sanitize user-supplied data before incorporating it into a database query, potentially allowing an attacker to manipulate the query logic. **Recommendations** Update YMC Filter to a version newer than 3.11.5.

**Name of the Vulnerable Software and Affected Versions** WorkScout-Core versions prior to 1.7.12 **Description** An issue allows unauthenticated users to perform arbitrary file deletion. This means an attacker can delete files on the server without needing to provide valid login credentials. **Recommendations** Update to a version newer than 1.7.11.

Unauthenticated SQL Injection in JobSearch <= 3.2.9 versions.

**Name of the Vulnerable Software and Affected Versions** Advanced Ads versions prior to 2.0.22 **Description** Improper Control of Generation of Code (Code Injection) allows Remote Code Inclusion, which occurs when an application allows an attacker to include and execute remote code on the server. **Recommendations** Update to version 2.0.22 or later.