Rin Miyachi

**Name of the Vulnerable Software and Affected Versions** Checkout Files Upload for WooCommerce plugin for WordPress versions up to and including 2.2.1 **Description** The plugin is susceptible to Stored Cross-Site Scripting through file uploads. Insufficient input sanitization and output escaping allow unauthenticated attackers to inject arbitrary web scripts into image files. These scripts execute when a user accesses the affected page. **Recommendations** Update to a version later than 2.2.1.

**Name of the Vulnerable Software and Affected Versions** Drag and Drop Multiple File Upload for WooCommerce plugin for WordPress versions up to, and including, 1.1.6 **Description** The issue allows unauthenticated attackers to upload arbitrary files on the affected site's server, which may make remote code execution possible. This is due to the plugin accepting a user-supplied `supported type` string and the uploaded filename without enforcing real extension or MIME checks within the `upload()` function. **Recommendations** For versions up to, and including, 1.1.6, consider disabling the `upload()` function until a patch is available. Restrict access to the upload functionality to minimize the risk of exploitation. Avoid using the `supported type` string and uploaded filename without proper validation and sanitization. Update to a version that includes a fix for this issue when available. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** YOP Poll plugin for WordPress versions up to, and including, 6.5.26 **Description** The issue is due to a race condition caused by improper restrictions on the `add()` function. This allows unauthenticated attackers to place multiple votes on a single poll, even when the poll is set to one vote per person. **Recommendations** For versions up to, and including, 6.5.26, update to a version higher than 6.5.26 to resolve the issue. As a temporary workaround, consider disabling the `add()` function until a patch is available.