Tim Coen

**Name of the Vulnerable Software and Affected Versions** The product name cannot be determined. **Description** No information provided regarding the nature of the issue. **Recommendations** At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** Notification Center versions prior to 1.10.0.3291 **Description** A cross-site request forgery (CSRF) issue exists, which is a type of attack that tricks a victim into submitting a malicious request. Remote attackers can exploit this to gain privileges or hijack user identities. **Recommendations** Update to version 1.10.0.3291 or later.

**Name of the Vulnerable Software and Affected Versions** QuMagie versions prior to 2.8.1 **Description** A cross-site scripting (XSS) issue exists in QuMagie. This allows remote attackers to potentially bypass security measures or access application data. **Recommendations** Update to QuMagie version 2.8.1 or later.

**Name of the Vulnerable Software and Affected Versions** QuLog Center versions prior to 1.8.2.927 **Description** A cross-site request forgery (CSRF) issue affects QuLog Center. Successful exploitation could allow remote attackers to gain privileges or hijack user identities. **Recommendations** Update to QuLog Center version 1.8.2.927 or later.

**Name of the Vulnerable Software and Affected Versions** Download Station versions prior to 5.10.0.304 **Description** A cross-site scripting (XSS) issue exists in Download Station. A remote attacker who has obtained a user account can potentially exploit this issue to circumvent security measures or access application data. **Recommendations** Update Download Station to version 5.10.0.304 or later.

**Name of the Vulnerable Software and Affected Versions** QuMagie versions prior to 2.7.3 **Description** A relative path traversal issue exists in QuMagie. A remote attacker may be able to read the contents of unexpected files or system data by exploiting this issue. **Recommendations** Update to QuMagie version 2.7.3 or later.

**Name of the Vulnerable Software and Affected Versions** Download Station versions prior to 5.10.0.304 Download Station versions prior to 5.10.0.305 **Description** A relative path traversal issue exists in Download Station. Successful exploitation by a remote attacker with administrator privileges could allow reading the contents of unexpected files or system data. **Recommendations** Update Download Station to version 5.10.0.304 or later. Update Download Station to version 5.10.0.305 or later.

Name of the Vulnerable Software and Affected Versions: The Contact Form by Bit Form plugin for WordPress versions up to and including 2.17.4 Description: The issue allows unauthenticated attackers to extract sensitive data, including files uploaded via a form, due to insufficient directory listing prevention and lack of randomization of file names. This is possible through file uploads. Recommendations: For versions up to and including 2.17.4, update to version 2.17.5 or later to partially mitigate the issue. As a temporary workaround, consider restricting access to file uploads until a more comprehensive patch is available.

Name of the Vulnerable Software and Affected Versions: Wise Chat plugin for WordPress versions prior to 3.3.4 Description: The issue allows unauthenticated attackers to extract sensitive data stored insecurely in the `/wp-content/uploads` directory, which can contain file attachments included in chat messages. This is possible due to the exposure of sensitive information in all versions up to, and including, 3.3.3 via the 'uploads' directory. Recommendations: For Wise Chat plugin for WordPress versions prior to 3.3.4, update to version 3.3.4 or later to resolve the issue. As a temporary workaround, consider restricting access to the `/wp-content/uploads` directory to minimize the risk of exploitation.

**Name of the Vulnerable Software and Affected Versions** Contact Form by Supsystic plugin for WordPress versions up to and including 1.7.29 **Description** The issue is due to missing or incorrect nonce validation on the `saveAsCopy` function, making it possible for unauthenticated attackers to update settings and inject malicious web scripts via a forged request. This can be achieved by tricking a site administrator into performing an action, such as clicking on a link. **Recommendations** For versions up to and including 1.7.29, update to a version that includes the fix for the missing or incorrect nonce validation on the `saveAsCopy` function. As a temporary workaround, consider disabling the `saveAsCopy` function until a patch is available.

**Name of the Vulnerable Software and Affected Versions** The KB Support – Customer Support Ticket & Helpdesk Plugin, Knowledge Base Plugin plugin for WordPress versions up to, and including, 1.7.4 **Description** The issue allows unauthenticated attackers to extract sensitive data stored insecurely in the /wp-content/uploads/kbs directory, which can contain file attachments included in support tickets. This is possible due to sensitive information exposure via the 'kbs' directory. **Recommendations** For versions up to, and including, 1.7.4, update to a version that fully addresses the sensitive information exposure issue, as version 1.7.3.2 only partially patches the vulnerability. As a temporary workaround, consider restricting access to the /wp-content/uploads/kbs directory to minimize the risk of exploitation.

**Name of the Vulnerable Software and Affected Versions** The Awesome Support – WordPress HelpDesk & Support Plugin versions up to, and including, 6.3.1 **Description** The issue allows unauthenticated attackers to extract sensitive data stored insecurely in the /wp-content/uploads/awesome-support directory, which can contain file attachments included in support tickets. This is possible via the 'awesome-support' directory. The vulnerability was partially patched in version 6.3.1. **Recommendations** For versions up to, and including, 6.3.1, consider restricting access to the /wp-content/uploads/awesome-support directory to minimize the risk of exploitation. As a temporary workaround, avoid storing sensitive file attachments in support tickets until a full patch is available. Update to a version later than 6.3.1 when available, as version 6.3.1 only partially patches the issue.

**Name of the Vulnerable Software and Affected Versions** NP Quote Request for WooCommerce plugin for WordPress versions up to, and including, 1.9.179 **Description** The issue is related to Insecure Direct Object Reference due to missing validation on a user-controlled key. This allows unauthenticated attackers to read the content of quote requests. **Recommendations** For versions up to, and including, 1.9.179, update to a version that includes the necessary validation to prevent Insecure Direct Object Reference attacks. As a temporary workaround, consider restricting access to quote requests to prevent unauthorized reading of their content.

Name of the Vulnerable Software and Affected Versions: Tripetto plugin for WordPress versions up to, and including, 8.0.9 Description: The issue is related to Stored Cross-Site Scripting via attachment uploads due to insufficient input sanitization and output escaping. This allows unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses the uploaded file. Recommendations: For versions up to, and including, 8.0.9, update to a version later than 8.0.9 to resolve the issue. As a temporary workaround, consider restricting access to attachment uploads to minimize the risk of exploitation.

Name of the Vulnerable Software and Affected Versions: NEX-Forms – Ultimate Form Builder – Contact forms and much more plugin for WordPress versions up to, and including, 8.8.1 Description: The issue allows unauthenticated attackers to extract sensitive data, including files uploaded via a form, due to insufficient directory listing prevention and lack of randomization of file names in the file upload functionality. Recommendations: For versions up to, and including, 8.8.1, update to a version that addresses the Sensitive Information Exposure issue. As a temporary workaround, consider restricting access to file uploads until a patch is available.

**Name of the Vulnerable Software and Affected Versions** Print Invoice & Delivery Notes for WooCommerce plugin for WordPress versions up to and including 5.4.1 **Description** The issue allows unauthenticated attackers to extract sensitive data stored insecurely in the /wp-content/uploads/wcdn/invoice directory. This directory can contain invoice files if an email attachment setting is enabled. The sensitive information exposure occurs via the 'wcdn/invoice' directory. **Recommendations** For versions up to and including 5.4.1, update to a version later than 5.4.1 to resolve the issue. As a temporary workaround, consider restricting access to the /wp-content/uploads/wcdn/invoice directory to minimize the risk of exploitation. Avoid using the email attachment setting in the affected plugin until the issue is resolved.

**Name of the Vulnerable Software and Affected Versions** The Wishlist for WooCommerce: Multi Wishlists Per Customer plugin for WordPress versions up to, and including, 3.1.7 **Description** The issue is related to Cross-Site Request Forgery due to missing or incorrect nonce validation on the `save to multiple wishlist` function. This allows unauthenticated attackers to update settings and inject malicious web scripts via a forged request, provided they can trick a site administrator into performing a specific action, such as clicking on a link. **Recommendations** For versions up to, and including, 3.1.7, update to a version that includes the fix for the nonce validation issue in the `save to multiple wishlist` function. As a temporary workaround, consider restricting access to the `save to multiple wishlist` function to prevent exploitation until a patch is available.

**Name of the Vulnerable Software and Affected Versions** SupportCandy – Helpdesk & Customer Support Ticket System plugin for WordPress versions prior to 3.3.1 **Description** The issue allows authenticated attackers to download attachments for support tickets that do not belong to them due to missing validation on a user-controlled key. If an admin enables tickets for guests, this can be exploited by unauthenticated attackers. **Recommendations** For versions prior to 3.3.1, update to version 3.3.1 or later to resolve the issue. As a temporary workaround, consider disabling the file upload feature until a patch is available. Restrict access to sensitive support tickets and attachments to minimize the risk of exploitation. Avoid enabling tickets for guests unless necessary, and implement additional access controls to mitigate the risk of unauthenticated attackers exploiting this issue.

**Name of the Vulnerable Software and Affected Versions** EventPrime – Events Calendar, Bookings and Tickets plugin for WordPress versions up to, and including, 4.0.7.3 **Description** The issue allows authenticated attackers with Subscriber-level access and above to access data without proper authorization. This is due to missing capability checks on the `export submittion attendees` function, enabling them to download the list of attendees for any event. **Recommendations** For versions up to, and including, 4.0.7.3, consider disabling the `export submittion attendees` function until a patch is available to prevent unauthorized access to event attendee lists.

**Name of the Vulnerable Software and Affected Versions** The Wallet System for WooCommerce – Wallet, Wallet Cashback, Refunds, Partial Payment, Wallet Restriction plugin for WordPress versions up to, and including, 2.6.2 **Description** The issue is related to Cross-Site Request Forgery due to missing or incorrect nonce validation in the class-wallet-user-table.php file. This allows unauthenticated attackers to modify wallet balances by tricking a site administrator into performing a specific action, such as clicking on a link. **Recommendations** For versions up to, and including, 2.6.2, update to a version that includes the fix for the missing or incorrect nonce validation in the class-wallet-user-table.php file. As a temporary workaround, consider restricting access to the wallet balance modification functionality to prevent exploitation.