Timomangcut

Subscriber Broken Access Control in Advanced Contact form 7 DB <= 2.0.9 versions.

**Name of the Vulnerable Software and Affected Versions** Livemesh Addons for WPBakery Page Builder versions prior to 3.9.5 **Description** Cross Site Scripting (XSS) allows an attacker with contributor privileges to execute malicious scripts in the browser of other users. This occurs when the application fails to properly sanitize user-supplied input before rendering it on the page. **Recommendations** Update Livemesh Addons for WPBakery Page Builder to version 3.9.5 or later.

**Name of the Vulnerable Software and Affected Versions** Shortcodes and extra features for Phlox theme versions prior to 2.17.17 **Description** Improper neutralization of input during web page generation allows for DOM-Based Cross-site Scripting (XSS), a flaw where a script is executed in the victim's browser due to the application's failure to properly sanitize data before it is processed by the Document Object Model (DOM). **Recommendations** Update Shortcodes and extra features for Phlox theme to version 2.17.17 or later.

**Name of the Vulnerable Software and Affected Versions** StatCounter versions prior to 2.1.2 **Description** StatCounter is subject to Cross Site Scripting (XSS), a flaw that allows an attacker to inject malicious scripts into web pages viewed by other users, specifically affecting the contributor role. **Recommendations** Update StatCounter to version 2.1.2 or later.

**Name of the Vulnerable Software and Affected Versions** Advanced Custom Fields: Font Awesome Field versions prior to 5.0.3 **Description** Improper neutralization of input during web page generation allows for stored Cross-site Scripting (XSS), a condition where malicious scripts are permanently stored on the target server and executed in the browser of users who view the affected page. **Recommendations** Update to a version later than 5.0.2.

**Name of the Vulnerable Software and Affected Versions** Facebook for WooCommerce versions prior to 3.7.1 **Description** An Open Redirect issue exists, which is a type of vulnerability that allows an application to redirect a user to an untrusted external site. This can be leveraged to facilitate phishing attacks. **Recommendations** Update to a version later than 3.7.0.

**Name of the Vulnerable Software and Affected Versions** Adminimize versions prior to 1.11.12 **Description** A missing authorization issue in WP Media Adminimize allows for the exploitation of incorrectly configured access control security levels. This is a broken access control flaw where the system fails to properly verify if a user has the necessary permissions to perform an action. **Recommendations** Update to a version later than 1.11.11.

**Name of the Vulnerable Software and Affected Versions** Duplicate Page and Post versions prior to 2.9.6 **Description** Improper neutralization of special elements used in an SQL command allows for Blind SQL Injection. Blind SQL Injection is a type of attack where the application does not return the results of the SQL query directly in the HTTP response, but the attacker can still infer data by observing the application's response to specific queries. **Recommendations** Update to a version newer than 2.9.5.

**Name of the Vulnerable Software and Affected Versions** DearFlip versions prior to 2.4.28 **Description** A missing authorization issue in DearHive DearFlip allows for the exploitation of incorrectly configured access control security levels. This is a broken access control flaw where the system fails to properly verify if a user has the necessary permissions to perform an action. **Recommendations** Update to a version newer than 2.4.27.

**Name of the Vulnerable Software and Affected Versions** The Post Grid versions prior to 7.9.3 **Description** A missing authorization issue allows for the exploitation of incorrectly configured access control security levels. **Recommendations** Update to a version newer than 7.9.2.

**Name of the Vulnerable Software and Affected Versions** TaxoPress versions prior to 3.44.1 **Description** Improper neutralization of special elements used in an SQL command allows for Blind SQL Injection. This occurs within the simple-tags component, where an attacker can send specially crafted SQL queries to the database to retrieve information without the application returning the results directly in the response. **Recommendations** Update to a version newer than 3.44.0.

**Name of the Vulnerable Software and Affected Versions** StellarWP Image Widget versions prior to 4.4.12 **Description** Improper neutralization of input during web page generation in the image-widget allows for Stored Cross-site Scripting (XSS), a flaw where malicious scripts are permanently stored on the target server and executed in the browser of users who view the affected page. **Recommendations** Update to a version later than 4.4.11.

**Name of the Vulnerable Software and Affected Versions** Extend Themes Kubio AI Page Builder versions through 2.7.0 **Description** The software contains a flaw related to improper input handling during web page generation, leading to a potential Cross-site Scripting (XSS) issue. Specifically, the vulnerability allows for Stored XSS attacks. The issue impacts the way user-supplied data is processed and displayed, potentially enabling an attacker to inject malicious scripts into web pages viewed by other users. **Recommendations** Update Extend Themes Kubio AI Page Builder to a version later than 2.7.0.

**Name of the Vulnerable Software and Affected Versions** Advanced Product Fields (Product Addons) for WooCommerce versions through 1.6.18 **Description** An incorrect access control configuration can be exploited, leading to a missing authorization issue in Advanced Product Fields (Product Addons) for WooCommerce. This allows unauthorized access. **Recommendations** Update Advanced Product Fields (Product Addons) for WooCommerce to a version newer than 1.6.18.

**Name of the Vulnerable Software and Affected Versions** Janis Elsts Admin Menu Editor versions through 1.14.1 **Description** A Cross-Site Request Forgery (CSRF) issue exists in Janis Elsts Admin Menu Editor. This allows attackers to potentially perform actions on behalf of authenticated users without their knowledge. The issue affects the `admin-menu-editor` component. **Recommendations** Versions prior to and including 1.14.1 are affected. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** WP Abstracts versions through 2.7.4 **Description** The software contains a flaw related to improper control of filename for include/require statements, specifically a PHP Local File Inclusion issue. This allows for the inclusion of local files. **Recommendations** Update WP Abstracts to a version newer than 2.7.4.

Name of the Vulnerable Software and Affected Versions: Cloud SAML SSO - Single Sign On Login versions through 1.0.18 Description: The software contains an Improper Control of Filename for Include/Require Statement, also known as a PHP Remote File Inclusion issue. This allows for PHP Local File Inclusion. Recommendations: Update Cloud SAML SSO - Single Sign On Login to a version later than 1.0.18.

Name of the Vulnerable Software and Affected Versions: WP Links Page versions through 4.9.6 Description: The software contains an improper neutralization of special elements used in an SQL command, which allows for SQL injection. Recommendations: Update WP Links Page to a version later than 4.9.6.

Name of the Vulnerable Software and Affected Versions: Content Egg versions n/a through 7.0.0 Description: Deserialization of untrusted data in keywordrush Content Egg allows object injection. Recommendations: At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Name of the Vulnerable Software and Affected Versions: Printcart Web to Print Product Designer for WooCommerce versions prior to 2.4.0 Description: The issue is related to an SQL Injection vulnerability due to improper neutralization of special elements used in an SQL command. This allows for SQL Injection, which can be exploited by attackers. Immediate action is required to secure against cyber threats. Recommendations: For versions prior to 2.4.0, update to version 2.4.0 or later to resolve the SQL Injection issue. As a temporary workaround, consider restricting access to sensitive database elements to minimize the risk of exploitation. Avoid using user-inputted data in SQL commands until the issue is resolved.