Uko

**Name of the Vulnerable Software and Affected Versions** PyMuPDF version 1.26.5 **Description** A path traversal and arbitrary file write issue exists in the `get` function within the ' main .py' file. The issue allows unauthorized access and modification of files. **Recommendations** At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** Nested Pages versions 3.2.9 and earlier **Description** The issue is related to Improper Neutralization of Input During Web Page Generation, also known as Cross-site Scripting, which allows Stored XSS. This means that an attacker can inject malicious scripts into the website, potentially affecting users who access the compromised page. **Recommendations** For Nested Pages versions 3.2.9 and earlier, update to a version later than 3.2.9 to resolve the issue. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** Octrace Studio WordPress HelpDesk & Support Ticket System Plugin – Octrace Support versions 1.2.7 and earlier **Description** The issue is related to improper neutralization of input during web page generation, which allows stored Cross-site Scripting (XSS). This means an attacker can inject malicious scripts into the website, potentially affecting users who access the compromised pages. The estimated number of potentially affected devices worldwide is not specified. There is no information provided about real-world incidents where this issue was exploited. **Recommendations** For versions 1.2.7 and earlier, update to a version later than 1.2.7 to resolve the issue. At the moment, there is no information about other specific mitigation measures for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** Sanil Shakya Sticky Social Icons versions 1.2.1 and earlier **Description** The issue is related to improper neutralization of input during web page generation, also known as 'Cross-site Scripting', which allows stored XSS. **Recommendations** For Sanil Shakya Sticky Social Icons versions 1.2.1 and earlier, at the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** Udi Dollberg Add Chat App Button versions 2.1.5 and earlier **Description** The issue is related to improper neutralization of input during web page generation, also known as 'Cross-site Scripting', which allows stored XSS. This enables potential attackers to inject malicious scripts into the application. **Recommendations** For versions 2.1.5 and earlier, update to a version later than 2.1.5 to resolve the issue. As a temporary workaround, consider restricting user input to minimize the risk of exploitation.

**Name of the Vulnerable Software and Affected Versions** Gopi Ramasamy Image horizontal reel scroll slideshow versions prior to 13.4 **Description** The issue is related to improper neutralization of input during web page generation, also known as 'Cross-site Scripting'. This allows for Stored XSS. **Recommendations** For versions prior to 13.4, update to a version that includes a fix for this issue. As a temporary workaround, consider restricting user input to minimize the risk of exploitation. Avoid using potentially vulnerable features in the slideshow until the issue is resolved. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** Meteor Slides versions 1.5.7 and earlier **Description** The issue is related to improper neutralization of input during web page generation, which allows for Stored Cross-site Scripting (XSS). This means that an attacker can inject malicious code into the website, which will be stored and executed when other users access the site. The estimated number of potentially affected devices worldwide is not available. There is no information about real-world incidents where this issue was exploited. **Recommendations** For versions 1.5.7 and earlier, update to a version later than 1.5.7 to resolve the issue. As a temporary workaround, consider restricting user input to minimize the risk of exploitation. Avoid using potentially vulnerable API endpoints until the issue is resolved. At the moment, there is no additional information about other mitigation measures.

**Name of the Vulnerable Software and Affected Versions** Dynamic "To Top" versions 3.5.2 through n/a **Description** The issue is related to improper neutralization of input during web page generation, also known as 'Cross-site Scripting'. This allows for Stored XSS. **Recommendations** For versions 3.5.2 through n/a, as a temporary workaround, consider disabling the dynamic functionality until a patch is available. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Name of the Vulnerable Software and Affected Versions: codection Import and export users and customers versions 1.27.5 and earlier Description: The issue is related to Improper Neutralization of Input During Web Page Generation, also known as Cross-site Scripting (XSS). This allows for Stored XSS attacks. Recommendations: For versions 1.27.5 and earlier, update to a version that contains a fix for this issue to prevent Stored XSS attacks.

Name of the Vulnerable Software and Affected Versions: Conditional Fields for Contact Form 7 versions through 2.4.15 Description: The issue is related to Improper Neutralization of Input During Web Page Generation, also known as Cross-site Scripting (XSS). This allows for Stored XSS attacks. Recommendations: For versions through 2.4.15, update to a version later than 2.4.15 to resolve the issue.

Name of the Vulnerable Software and Affected Versions: Button contact VR versions n/a through 4.7.9.1 Description: The issue is related to Improper Neutralization of Input During Web Page Generation, also known as Cross-site Scripting (XSS). This allows for Stored XSS attacks. Recommendations: For versions n/a through 4.7.9.1, update to a version later than 4.7.9.1 to resolve the issue.

Name of the Vulnerable Software and Affected Versions: Pagup Ads.Txt & App-ads.Txt Manager for WordPress versions 1.1.7.1 and earlier Description: The issue is related to Improper Neutralization of Input During Web Page Generation, also known as Cross-site Scripting (XSS). This allows for Stored XSS, which can be exploited by attackers. Recommendations: For versions 1.1.7.1 and earlier, update to a version that contains a fix for this issue. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Name of the Vulnerable Software and Affected Versions: WP Abstracts versions n/a through 2.7.1 Description: The issue is related to Improper Neutralization of Input During Web Page Generation, also known as Cross-site Scripting (XSS). This allows for Stored XSS attacks. Recommendations: For WP Abstracts versions n/a through 2.7.1, update to a version later than 2.7.1 to resolve the issue.

**Name of the Vulnerable Software and Affected Versions** Contact Form by Supsystic versions 1.7.28 and earlier **Description** The issue is related to Improper Neutralization of Input During Web Page Generation, also known as Cross-site Scripting (XSS). This allows for Stored XSS attacks. **Recommendations** For versions 1.7.28 and earlier, update to a version later than 1.7.28 to resolve the issue.