Pascal Sun

**Name of the Vulnerable Software and Affected Versions** Frontend Admin by DynamiApps versions prior to 3.28.29 **Description** The plugin is subject to generic SQL Injection, which occurs when an application fails to properly sanitize or escape user-supplied data before including it in a database query. Authenticated attackers with administrator-level access or higher can append additional SQL queries to extract sensitive information from the database. This is possible via the `order` parameter, provided that a valid `orderby` parameter is also supplied in the same request to reach the vulnerable code path. **Recommendations** Update the plugin to a version later than 3.28.28. As a temporary mitigation, restrict access to the `order` parameter in the affected functionality.

The WP Contact Form 7 DB Handler plugin for WordPress is vulnerable to Cross-Site Request Forgery leading to Arbitrary File Deletion via SQL Injection and PHP Object Injection in versions up to and including 3.0. This is due to a missing nonce verification in the process bulk action() function, the nonce check is only executed when wpnonce is present in the POST body, allowing it to be trivially bypassed by omitting the field, combined with the use of an unsanitized, unparameterized user-supplied value in a numeric SQL context (WHERE ID = $ID) and the unsafe deserialization of the query result's post content field. An attacker can craft a CSRF page that tricks a logged-in administrator into triggering a UNION-based SQL injection payload (using CHAR() to avoid esc sql quote-escaping) that returns a malicious serialized PHP array as post content; upon deserialization, array values associated with keys containing 'ys cfdbh file' are used as file paths appended to the uploads directory path without any path traversal validation, and then passed to wp delete file(), allowing the attacker to delete arbitrary files on the server (e.g., wp-config.php, system files).

**Name of the Vulnerable Software and Affected Versions** User Registration & Membership versions prior to 5.1.5 **Description** The User Registration & Membership plugin for WordPress contains an open redirect issue. This occurs because user-supplied URLs provided through the 'redirect to on logout' GET parameter are not sufficiently validated before being processed by the `wp redirect()` function. Although `esc url raw()` is used to sanitize malformed URLs, it fails to restrict the destination to the local domain. This allows an attacker to create a link that redirects users to external malicious websites after they log out, which can be used to facilitate phishing attacks. **Recommendations** Update the plugin to a version later than 5.1.4. As a temporary workaround, restrict access to the 'redirect to on logout' parameter until the update is applied.