Taufique Noorani

Name of the Vulnerable Software and Affected Versions: Nokaut Offers Box WordPress plugin versions 1.4.0 and earlier Description: The issue allows high-privilege users, such as admins, to perform Stored Cross-Site Scripting attacks. This is possible because the plugin does not properly sanitize and escape some of its settings. The attack can occur even when the unfiltered html capability is disallowed, for example, in a multisite setup. Recommendations: For Nokaut Offers Box WordPress plugin versions 1.4.0 and earlier, update to a version that properly sanitizes and escapes its settings to prevent Stored Cross-Site Scripting attacks. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Name of the Vulnerable Software and Affected Versions: jwp-a11y WordPress plugin versions 4.1.7 and earlier Description: The issue allows high privilege users, such as admins, to perform Stored Cross-Site Scripting attacks. This is possible because some settings are not properly sanitised and escaped, and the attack can occur even when the unfiltered html capability is disallowed, for example in a multisite setup. Recommendations: For jwp-a11y WordPress plugin versions 4.1.7 and earlier, update to a version later than 4.1.7 to resolve the issue.

**Name of the Vulnerable Software and Affected Versions** Zalomení WordPress plugin versions 1.5 and earlier **Description** The issue allows high privilege users, such as admins, to perform Stored Cross-Site Scripting attacks, even when the unfiltered html capability is disallowed, for example, in a multisite setup. This occurs because the plugin does not properly sanitise and escape some of its settings. **Recommendations** For Zalomení WordPress plugin versions 1.5 and earlier, consider disabling the plugin until a patch is available to prevent potential Stored Cross-Site Scripting attacks. Restrict access to the plugin's settings for high privilege users to minimize the risk of exploitation.