Thinhnguyen1337

**Name of the Vulnerable Software and Affected Versions** HUSKY WordPress plugin versions prior to 1.3.2 **Description** The issue allows high privilege users, such as admins, to perform PHP Object Injection when a suitable gadget is present, due to the unserialize of user input provided via the settings. **Recommendations** For HUSKY WordPress plugin versions prior to 1.3.2, update to version 1.3.2 or later to resolve the issue. As a temporary workaround, consider restricting access to the settings page to minimize the risk of exploitation.

**Name of the Vulnerable Software and Affected Versions** The Analyticator WordPress plugin versions prior to 6.5.6 **Description** The issue allows high privilege users, such as admins, to perform PHP Object Injection when a suitable gadget is present. This is due to the plugin unserializing user input provided via the settings. **Recommendations** For versions prior to 6.5.6, update to version 6.5.6 or later to resolve the issue. As a temporary workaround, consider restricting access to the settings page to minimize the risk of exploitation.

**Name of the Vulnerable Software and Affected Versions** WP Custom Admin Interface WordPress plugin versions prior to 7.29 **Description** The issue allows high privilege users, such as admins, to perform PHP Object Injection when a suitable gadget is present. This is due to the plugin unserializing user input provided via the settings. **Recommendations** For WP Custom Admin Interface WordPress plugin versions prior to 7.29, update to version 7.29 or later to resolve the issue.

**Name of the Vulnerable Software and Affected Versions** White Label CMS WordPress plugin versions prior to 2.5 **Description** The issue allows high-privilege users, such as admins, to perform PHP Object Injection when a suitable gadget is present. This is due to the plugin unserializing user input provided via the settings. **Recommendations** For versions prior to 2.5, update to version 2.5 or later to resolve the issue. As a temporary workaround, consider restricting access to the settings page to minimize the risk of exploitation.

**Name of the Vulnerable Software and Affected Versions** Custom Field Template WordPress plugin versions prior to 2.5.8 **Description** The issue arises from the unserialization of the content of an imported file, potentially leading to PHP object injections when a high-privilege user imports a malicious Customizer Styling file and a suitable gadget chain is present on the blog. **Recommendations** For versions prior to 2.5.8, update to version 2.5.8 or later to resolve the issue. As a temporary workaround, consider restricting the import of Customizer Styling files to trusted sources and users until the update is applied.