Sérgio Charruadas

**Name of the Vulnerable Software and Affected Versions** MW WP Form versions prior to 5.1.4 **Description** Stored Cross-Site Scripting occurs due to insufficient input sanitization and output escaping. Authenticated attackers with editor-level access or higher can inject arbitrary web scripts into pages. This is possible because the `memo` parameter is stored using the `update post meta()` function instead of `wp insert post()`, which bypasses WordPress's built-in kses and unfiltered html protections. Consequently, attackers can use injected closing tags to break out of the textarea element, regardless of role-based content filtering. **Recommendations** Update to a version later than 5.1.3. As a temporary workaround, restrict access to the `memo` parameter for users with editor-level permissions until the update is applied.

**Name of the Vulnerable Software and Affected Versions** PIX-LINK LV-WR22 version RE3002-P1-01 V117.0 **Description** The issue concerns Improper Access Control, where the TELNET service is enabled with weak credentials for a root-level account, and these credentials cannot be changed. **Recommendations** For PIX-LINK LV-WR22 version RE3002-P1-01 V117.0, consider disabling the TELNET service as a temporary workaround to minimize the risk of exploitation. Restrict access to the root-level account to prevent unauthorized access until a patch or fix is available. At the moment, there is no information about a newer version that contains a fix for this vulnerability.