Revan Arifio

Name of the Vulnerable Software and Affected Versions: Tutor LMS versions n/d through 3.4.0 Description: The issue is related to an improper neutralization of script-related HTML tags in a web page, which can lead to a basic Cross-Site Scripting (XSS) attack. This allows an attacker to inject malicious scripts into a webpage, potentially affecting users who visit the page. Recommendations: For versions prior to 3.4.0, update to a version that includes the fix for this issue. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** wpForo Forum versions 2.4.2 and earlier **Description** The issue is related to an Incorrect Privilege Assignment, which allows Privilege Escalation in the wpForo Forum. **Recommendations** For versions 2.4.2 and earlier, update to a version that contains a fix for this issue, however at the moment there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** Dimitri Grassi Salon booking system versions from n/a through 10.11 **Description** The issue is related to an Incorrect Privilege Assignment vulnerability, which allows Privilege Escalation in the Dimitri Grassi Salon booking system. **Recommendations** For versions from n/a through 10.11, update to a version that fixes the Incorrect Privilege Assignment vulnerability. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** Rustaurius Five Star Restaurant Reservations versions 2.6.29 and earlier **Description** The issue is related to a Missing Authorization vulnerability, which allows exploiting incorrectly configured access control security levels. **Recommendations** For versions 2.6.29 and earlier, update to a version that fixes the Missing Authorization vulnerability. As a temporary workaround, consider restricting access to sensitive features to minimize the risk of exploitation.

**Name of the Vulnerable Software and Affected Versions** Events Manager versions through 6.6.4.1 **Description** The issue is related to a Missing Authorization vulnerability in Pixelite Events Manager, which allows exploitation due to incorrectly configured access control security levels. **Recommendations** For versions through 6.6.4.1, update to a version that contains a fix for this issue, as the current version is affected by the Missing Authorization vulnerability.

**Name of the Vulnerable Software and Affected Versions** Amelia versions 1.2.16 and earlier **Description** The issue affects Amelia due to an Authorization Bypass Through User-Controlled Key vulnerability, which exploits incorrectly configured access control security levels. **Recommendations** For versions 1.2.16 and earlier, update to a version that fixes the Authorization Bypass Through User-Controlled Key vulnerability to prevent exploitation of incorrectly configured access control security levels.

**Name of the Vulnerable Software and Affected Versions** Strong Testimonials versions prior to 3.2.4 **Description** A Missing Authorization issue in WP Chill Strong Testimonials allows accessing functionality not properly constrained by ACLs. **Recommendations** For versions prior to 3.2.4, update to version 3.2.4 or later to resolve the issue.

**Name of the Vulnerable Software and Affected Versions** Ninja Team Filebird versions 6.4.2.1 and earlier **Description** The issue is related to an Authorization Bypass Through User-Controlled Key, which can be exploited due to incorrectly configured access control security levels. **Recommendations** For versions 6.4.2.1 and earlier, update to a version that contains a fix for this issue.

**Name of the Vulnerable Software and Affected Versions** Poll Maker versions n/a through 4.7.1 **Description** The issue is related to a Missing Authorization vulnerability in Poll Maker, which allows exploiting incorrectly configured access control security levels. **Recommendations** For versions n/a through 4.7.1, update to a version later than 4.7.1 to resolve the issue. As a temporary workaround, consider restricting access to sensitive areas of Poll Maker to minimize the risk of exploitation.

**Name of the Vulnerable Software and Affected Versions** Kali Forms versions 2.3.27 and earlier **Description** The issue is related to a Missing Authorization vulnerability in Kali Forms Contact Form builder with drag & drop, which allows exploiting incorrectly configured access control security levels. **Recommendations** For versions 2.3.27 and earlier, update to a version later than 2.3.27 to resolve the issue. As a temporary workaround, consider restricting access to the Contact Form builder with drag & drop feature until a patch is available.

**Name of the Vulnerable Software and Affected Versions** Simple Job Board versions prior to 2.10.5 **Description** The issue is related to a missing authorization vulnerability in Simple Job Board, which allows the exploitation of incorrectly configured access control security levels. **Recommendations** For versions prior to 2.10.5, update to a version that contains a fix for this issue. As a temporary workaround, consider restricting access to sensitive areas of the application to minimize the risk of exploitation.

**Name of the Vulnerable Software and Affected Versions** GiveWP versions through 2.33.1 **Description** The issue is related to a Missing Authorization vulnerability, which allows exploiting incorrectly configured access control security levels. **Recommendations** For versions through 2.33.1, update to a version later than 2.33.1 to resolve the issue.

**Name of the Vulnerable Software and Affected Versions** FeedbackWP kk Star Ratings versions through 5.4.5 **Description** The issue is related to a Missing Authorization vulnerability, which allows exploiting incorrectly configured access control security levels. **Recommendations** For versions through 5.4.5, update to a version that contains a fix for this issue. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** MW WP Form versions n/a through 4.4.5 **Description** The issue is related to a Missing Authorization vulnerability in MW WP Form, which allows exploiting incorrectly configured access control security levels. **Recommendations** For MW WP Form versions n/a through 4.4.5, update to a version later than 4.4.5 to resolve the issue. As a temporary workaround, consider restricting access to sensitive areas of the application to minimize the risk of exploitation.

**Name of the Vulnerable Software and Affected Versions** WP Job Openings versions 3.4.1 and earlier **Description** The issue is related to a Missing Authorization vulnerability in WP Job Openings, which allows exploiting incorrectly configured access control security levels. **Recommendations** For WP Job Openings versions 3.4.1 and earlier, update to a version later than 3.4.1 to resolve the issue.

**Name of the Vulnerable Software and Affected Versions** Yet Another Stars Rating versions 3.4.3 and below **Description** The issue is related to a Missing Authorization vulnerability, which allows exploiting incorrectly configured access control security levels due to broken access control. This can be exploited in the Yet Another Stars Rating plugin for WordPress. **Recommendations** Update to the latest version to secure your site and protect against this issue.

**Name of the Vulnerable Software and Affected Versions** FluentForm versions through 5.0.8 **Description** The issue is related to a Missing Authorization vulnerability in the Contact Form, allowing exploitation of incorrectly configured access control security levels. **Recommendations** For versions through 5.0.8, update to a version later than 5.0.8 to resolve the issue.

**Name of the Vulnerable Software and Affected Versions** All-in-one Floating Contact Form – My Sticky Elements versions 2.1.3 and earlier **Description** The issue is related to a Missing Authorization vulnerability, which allows exploiting incorrectly configured access control security levels. This vulnerability can be exploited due to missing authorization in the Premio All-in-one Floating Contact Form – My Sticky Elements plugin. **Recommendations** For All-in-one Floating Contact Form – My Sticky Elements versions 2.1.3 and earlier, update to a version later than 2.1.3 to resolve the issue. At the moment, there is no information about additional mitigation measures for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** ProfilePress versions n/a through 4.13.2 **Description** The issue is related to a Missing Authorization vulnerability in ProfilePress Membership Team, allowing exploitation of incorrectly configured access control security levels. **Recommendations** For versions n/a through 4.13.2, update to a version later than 4.13.2 to resolve the issue. As a temporary workaround, consider restricting access to sensitive areas of the ProfilePress Membership Team to minimize the risk of exploitation.

**Name of the Vulnerable Software and Affected Versions** Metform Elementor Contact Form Builder versions prior to 3.4.0 **Description** The issue is related to a Missing Authorization vulnerability in Metform Elementor Contact Form Builder, which allows exploiting incorrectly configured access control security levels. **Recommendations** For versions prior to 3.4.0, update to version 3.4.0 or later to resolve the issue.