Thiennv

**Name of the Vulnerable Software and Affected Versions** Make Email Customizer for WooCommerce versions 1.0.0 through 1.0.5 **Description** The issue is related to Improper Neutralization of Input During Web Page Generation, also known as Cross-site Scripting, allowing Reflected XSS. This enables potential attackers to inject malicious scripts into web pages. **Recommendations** For Make Email Customizer for WooCommerce versions 1.0.0 through 1.0.5, update to a version later than 1.0.5 to resolve the issue. At the moment, there is no information about additional mitigation measures for this specific vulnerability.

**Name of the Vulnerable Software and Affected Versions** Akadrama Shipping with Venipak for WooCommerce versions 1.22.3 and earlier **Description** The issue is related to Improper Neutralization of Input During Web Page Generation, also known as Cross-site Scripting, allowing Reflected XSS. **Recommendations** For versions 1.22.3 and earlier, update to a version that contains a fix for this issue. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** Revamp CRM for WooCommerce versions 1.1.2 and earlier **Description** The issue is related to Improper Neutralization of Input During Web Page Generation, also known as Cross-site Scripting (XSS), which allows Reflected XSS. This means an attacker can inject malicious scripts into a website, potentially stealing user data or taking control of user sessions. **Recommendations** For Revamp CRM for WooCommerce versions 1.1.2 and earlier, update to a version later than 1.1.2 to resolve the issue. At the moment, there is no information about other mitigation measures for this specific issue.

**Name of the Vulnerable Software and Affected Versions** bitsstech Shipment Tracker for Woocommerce versions 1.4.23 and earlier **Description** The issue is related to Improper Neutralization of Input During Web Page Generation, also known as Cross-site Scripting, allowing Reflected XSS. This means an attacker can inject malicious scripts into the website, potentially stealing user data or taking control of user sessions. **Recommendations** For bitsstech Shipment Tracker for Woocommerce versions 1.4.23 and earlier, update to a version later than 1.4.23 to resolve the issue. At the moment, there is no information about additional mitigation measures for this specific vulnerability.

**Name of the Vulnerable Software and Affected Versions** Terminal Africa versions 1.13.17 and earlier **Description** The issue is related to Improper Neutralization of Input During Web Page Generation, also known as Cross-site Scripting (XSS), which allows Reflected XSS. This means that an attacker can inject malicious scripts into the website, potentially stealing user data or taking control of user sessions. **Recommendations** For versions 1.13.17 and earlier, update to a version that fixes the Improper Neutralization of Input During Web Page Generation issue to prevent Reflected XSS attacks. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Name of the Vulnerable Software and Affected Versions: SCAND MultiMailer versions 1.0.3 and earlier Description: The issue is related to improper neutralization of input during web page generation, which allows for Reflected Cross-site Scripting (XSS). This enables attackers to inject malicious scripts into web pages, potentially leading to unauthorized actions or data theft. No information is provided about the estimated number of potentially affected devices worldwide or real-world incidents where this issue was exploited. Recommendations: For SCAND MultiMailer versions 1.0.3 and earlier, update to a version that includes a fix for this issue, as no specific workaround or mitigation measures are provided in the input descriptions. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Name of the Vulnerable Software and Affected Versions: Easy Post Duplicator versions 1.0.1 and earlier Description: The issue is related to an SQL Injection vulnerability due to improper neutralization of special elements used in an SQL command. This allows for SQL Injection attacks. Recommendations: For Easy Post Duplicator versions 1.0.1 and earlier, update to a version that includes a fix for this issue, as no specific workaround is provided for these versions. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Name of the Vulnerable Software and Affected Versions: Simple Post Meta Manager versions 1.0.9 and earlier Description: The issue is a Cross-Site Request Forgery (CSRF) vulnerability that allows Reflected XSS. Recommendations: For versions 1.0.9 and earlier, update to a version that contains a fix for this issue. As a temporary workaround, consider restricting access to sensitive operations to minimize the risk of exploitation.

**Name of the Vulnerable Software and Affected Versions** 6Storage Rentals versions n/a through 2.18.0 **Description** The issue is related to a Missing Authorization vulnerability, which allows exploiting incorrectly configured access control security levels. **Recommendations** For versions n/a through 2.18.0, update to a version that fixes the Missing Authorization vulnerability. As a temporary workaround, consider restricting access to sensitive areas of 6Storage Rentals to minimize the risk of exploitation.

**Name of the Vulnerable Software and Affected Versions** coothemes Easy WP Optimizer versions 1.1.0 and earlier **Description** The issue is related to a Missing Authorization vulnerability, which allows exploitation of incorrectly configured access control security levels. **Recommendations** For versions 1.1.0 and earlier, update to a version that includes the necessary security patches to fix the Missing Authorization vulnerability. As a temporary workaround, consider restricting access to sensitive areas of the application to minimize the risk of exploitation.

**Name of the Vulnerable Software and Affected Versions** DirectoryPress versions n/a through 3.6.19 **Description** The issue is a Cross-Site Request Forgery (CSRF) vulnerability, which allows an attacker to perform unauthorized actions on a user's account. **Recommendations** For versions n/a through 3.6.19, update to a version later than 3.6.19 to resolve the issue.

**Name of the Vulnerable Software and Affected Versions** Rich Text Editor versions 1.0.1 and earlier **Description** The issue is related to a Missing Authorization vulnerability in the Rich Text Editor, which allows exploitation of incorrectly configured access control security levels. **Recommendations** For versions 1.0.1 and earlier, update to a version that includes a fix for this issue, as no specific workaround is provided for these versions. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** Support Helpdesk Ticket System Lite versions through 4.5.2 **Description** The issue is related to Improper Neutralization of Input During Web Page Generation, also known as Cross-site Scripting. This allows for Reflected XSS attacks. **Recommendations** For versions through 4.5.2, update to a version that contains a fix for this issue. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** iNET Webkit versions 1.2.2 and earlier **Description** The issue is related to a Missing Authorization vulnerability, which allows accessing functionality not properly constrained by ACLs. **Recommendations** For iNET Webkit versions 1.2.2 and earlier, consider restricting access to sensitive functionality until a proper fix is available. As a temporary workaround, review and enforce ACLs to minimize the risk of unauthorized access.

**Name of the Vulnerable Software and Affected Versions** azurecurve Floating Featured Image versions 2.2.0 and earlier **Description** The issue is related to Improper Neutralization of Input During Web Page Generation, also known as Cross-site Scripting, allowing Reflected XSS in the azurecurve Floating Featured Image. **Recommendations** For versions 2.2.0 and earlier, update to a version later than 2.2.0 to resolve the issue.

**Name of the Vulnerable Software and Affected Versions** Tax Report for WooCommerce versions prior to 2.2 **Description** The issue is related to improper neutralization of input during web page generation, which leads to a Cross-site Scripting (XSS) vulnerability. Specifically, it allows for Reflected XSS attacks. **Recommendations** For versions prior to 2.2, update to version 2.2 or later to resolve the issue.

**Name of the Vulnerable Software and Affected Versions** Sale with Razorpay versions n/a through 1.0 **Description** The issue is related to Improper Neutralization of Input During Web Page Generation, also known as Cross-site Scripting, allowing Reflected XSS. **Recommendations** For versions n/a through 1.0, update to a version that fixes the Improper Neutralization of Input During Web Page Generation issue to prevent Reflected XSS attacks.

**Name of the Vulnerable Software and Affected Versions** Ui Slider Filter By Price versions n/a through 1.1 **Description** The issue is related to Improper Neutralization of Input During Web Page Generation, also known as Cross-site Scripting, which allows Reflected XSS. **Recommendations** For versions n/a through 1.1, update to a version that fixes the Improper Neutralization of Input During Web Page Generation issue to prevent Reflected XSS attacks.

Name of the Vulnerable Software and Affected Versions: Intro Tour Tutorial DeepPresentation versions n/a through 6.5.2 Description: The issue is related to Improper Neutralization of Input During Web Page Generation, also known as Cross-site Scripting. This allows for Reflected XSS attacks. Recommendations: For versions n/a through 6.5.2, update to a version later than 6.5.2 to resolve the issue.

**Name of the Vulnerable Software and Affected Versions** eMarksheet versions prior to 5.0 **Description** The issue is related to improper neutralization of input during web page generation, which allows for reflected Cross-site Scripting (XSS). This means that an attacker can inject malicious scripts into the website, potentially affecting users who access the compromised page. The estimated number of potentially affected devices worldwide is not available. **Recommendations** For versions prior to 5.0, update to a version that includes the fix for this issue, as no specific workaround is provided for these versions. At the moment, there is no information about a newer version that contains a fix for this vulnerability.