Timomangcut

**Name of the Vulnerable Software and Affected Versions** Facebook for WooCommerce versions prior to 3.7.1 **Description** An Open Redirect issue exists, which is a type of vulnerability that allows an application to redirect a user to an untrusted external site. This can be leveraged to facilitate phishing attacks. **Recommendations** Update to a version later than 3.7.0.

**Name of the Vulnerable Software and Affected Versions** Duplicate Page and Post versions prior to 2.9.6 **Description** Improper neutralization of special elements used in an SQL command allows for Blind SQL Injection. Blind SQL Injection is a type of attack where the application does not return the results of the SQL query directly in the HTTP response, but the attacker can still infer data by observing the application's response to specific queries. **Recommendations** Update to a version newer than 2.9.5.

**Name of the Vulnerable Software and Affected Versions** Advanced Custom Fields: Font Awesome Field versions prior to 5.0.3 **Description** Improper neutralization of input during web page generation allows for stored Cross-site Scripting (XSS), a condition where malicious scripts are permanently stored on the target server and executed in the browser of users who view the affected page. **Recommendations** Update to a version later than 5.0.2.

**Name of the Vulnerable Software and Affected Versions** Adminimize versions prior to 1.11.12 **Description** A missing authorization issue in WP Media Adminimize allows for the exploitation of incorrectly configured access control security levels. This is a broken access control flaw where the system fails to properly verify if a user has the necessary permissions to perform an action. **Recommendations** Update to a version later than 1.11.11.

**Name of the Vulnerable Software and Affected Versions** DearFlip versions prior to 2.4.28 **Description** A missing authorization issue in DearHive DearFlip allows for the exploitation of incorrectly configured access control security levels. This is a broken access control flaw where the system fails to properly verify if a user has the necessary permissions to perform an action. **Recommendations** Update to a version newer than 2.4.27.

**Name of the Vulnerable Software and Affected Versions** The Post Grid versions prior to 7.9.3 **Description** A missing authorization issue allows for the exploitation of incorrectly configured access control security levels. **Recommendations** Update to a version newer than 7.9.2.

**Name of the Vulnerable Software and Affected Versions** TaxoPress versions prior to 3.44.1 **Description** Improper neutralization of special elements used in an SQL command allows for Blind SQL Injection. This occurs within the simple-tags component, where an attacker can send specially crafted SQL queries to the database to retrieve information without the application returning the results directly in the response. **Recommendations** Update to a version newer than 3.44.0.

**Name of the Vulnerable Software and Affected Versions** StellarWP Image Widget versions prior to 4.4.12 **Description** Improper neutralization of input during web page generation in the image-widget allows for Stored Cross-site Scripting (XSS), a flaw where malicious scripts are permanently stored on the target server and executed in the browser of users who view the affected page. **Recommendations** Update to a version later than 4.4.11.

**Name of the Vulnerable Software and Affected Versions** Extend Themes Kubio AI Page Builder versions through 2.7.0 **Description** The software contains a flaw related to improper input handling during web page generation, leading to a potential Cross-site Scripting (XSS) issue. Specifically, the vulnerability allows for Stored XSS attacks. The issue impacts the way user-supplied data is processed and displayed, potentially enabling an attacker to inject malicious scripts into web pages viewed by other users. **Recommendations** Update Extend Themes Kubio AI Page Builder to a version later than 2.7.0.

**Name of the Vulnerable Software and Affected Versions** Advanced Product Fields (Product Addons) for WooCommerce versions through 1.6.18 **Description** An incorrect access control configuration can be exploited, leading to a missing authorization issue in Advanced Product Fields (Product Addons) for WooCommerce. This allows unauthorized access. **Recommendations** Update Advanced Product Fields (Product Addons) for WooCommerce to a version newer than 1.6.18.

**Name of the Vulnerable Software and Affected Versions** Janis Elsts Admin Menu Editor versions through 1.14.1 **Description** A Cross-Site Request Forgery (CSRF) issue exists in Janis Elsts Admin Menu Editor. This allows attackers to potentially perform actions on behalf of authenticated users without their knowledge. The issue affects the `admin-menu-editor` component. **Recommendations** Versions prior to and including 1.14.1 are affected. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** WP Abstracts versions through 2.7.4 **Description** The software contains a flaw related to improper control of filename for include/require statements, specifically a PHP Local File Inclusion issue. This allows for the inclusion of local files. **Recommendations** Update WP Abstracts to a version newer than 2.7.4.

Name of the Vulnerable Software and Affected Versions: Cloud SAML SSO - Single Sign On Login versions through 1.0.18 Description: The software contains an Improper Control of Filename for Include/Require Statement, also known as a PHP Remote File Inclusion issue. This allows for PHP Local File Inclusion. Recommendations: Update Cloud SAML SSO - Single Sign On Login to a version later than 1.0.18.

Name of the Vulnerable Software and Affected Versions: WP Links Page versions through 4.9.6 Description: The software contains an improper neutralization of special elements used in an SQL command, which allows for SQL injection. Recommendations: Update WP Links Page to a version later than 4.9.6.

Name of the Vulnerable Software and Affected Versions: Content Egg versions n/a through 7.0.0 Description: Deserialization of untrusted data in keywordrush Content Egg allows object injection. Recommendations: At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Name of the Vulnerable Software and Affected Versions: Printcart Web to Print Product Designer for WooCommerce versions prior to 2.4.0 Description: The issue is related to an SQL Injection vulnerability due to improper neutralization of special elements used in an SQL command. This allows for SQL Injection, which can be exploited by attackers. Immediate action is required to secure against cyber threats. Recommendations: For versions prior to 2.4.0, update to version 2.4.0 or later to resolve the SQL Injection issue. As a temporary workaround, consider restricting access to sensitive database elements to minimize the risk of exploitation. Avoid using user-inputted data in SQL commands until the issue is resolved.

Name of the Vulnerable Software and Affected Versions: WP Optimize By xTraffic versions through 5.1.6 Description: The issue is related to Deserialization of Untrusted Data, which allows Object Injection. Recommendations: For versions through 5.1.6, update to a version later than 5.1.6 to resolve the issue. At the moment, there is no information about other mitigation measures.

Name of the Vulnerable Software and Affected Versions: SERPed.net versions n/a through 4.6 Description: The issue is related to an Improper Control of Filename for Include/Require Statement in PHP Program, also known as 'PHP Remote File Inclusion', which allows PHP Local File Inclusion. This is a type of security vulnerability that can be exploited by manipulating the filename parameter in include or require statements in PHP programs, potentially leading to the execution of arbitrary code or the disclosure of sensitive information. Recommendations: For SERPed.net versions n/a through 4.6, consider restricting access to the include or require statements to minimize the risk of exploitation until a patch is available. As a temporary workaround, review and validate all filenames used in include or require statements to prevent potential manipulation. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** wpdistillery Navigation Tree Elementor versions 1.0.1 and earlier **Description** The issue is related to an SQL Injection vulnerability, specifically Improper Neutralization of Special Elements used in an SQL Command. This allows for Blind SQL Injection, which can be exploited. No information is provided about the estimated number of potentially affected devices worldwide or real-world incidents where this issue was exploited. **Recommendations** For wpdistillery Navigation Tree Elementor versions 1.0.1 and earlier, update to a version that contains a fix for this issue, as no specific workaround or mitigation measures are provided in the input descriptions. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** WpExperts Hub Woocommerce Partial Shipment versions n/a through 3.2 **Description** The issue is related to an SQL Injection vulnerability due to improper neutralization of special elements used in an SQL command. This allows for SQL Injection attacks. **Recommendations** For versions n/a through 3.2, update to a version that contains a fix for this issue to prevent SQL Injection attacks. At the moment, there is no information about a newer version that contains a fix for this vulnerability.