Vaibhav Rajput

**Name of the Vulnerable Software and Affected Versions** Slider Revolution WordPress plugin versions prior to 6.6.19 **Description** The issue allows users with at least the Author role to unserialize arbitrary content when importing sliders, potentially leading to Remote Code Execution. **Recommendations** For versions prior to 6.6.19, update to version 6.6.19 or later to resolve the issue. As a temporary workaround, consider restricting the import slider functionality to users with higher roles than Author until the update is applied.

**Name of the Vulnerable Software and Affected Versions** Contact Form Plugin WordPress plugin versions prior to 4.3.25 **Description** The issue allows a logged-in user with roles as low as contributor to inject arbitrary JavaScript into a form. This can be achieved by exploiting the improper sanitization and escaping of the `srcdoc` attribute in iframes within the plugin's custom HTML field type. The injected JavaScript will trigger for any visitor to the form or for admins previewing or editing the form. **Recommendations** For versions prior to 4.3.25, update to version 4.3.25 or later to resolve the issue. As a temporary workaround, consider restricting access to the custom HTML field type in the Contact Form Plugin to prevent potential exploitation until the update can be applied.

**Name of the Vulnerable Software and Affected Versions** FluentSMTP WordPress plugin versions prior to 2.2.3 **Description** The issue arises from the plugin's failure to sanitize or escape email content, making it susceptible to stored cross-site scripting attacks (XSS) when an administrator views the email logs. This exploit requires the presence of other plugins that enable users to send emails with unfiltered HTML. **Recommendations** For versions prior to 2.2.3, update to version 2.2.3 or later to resolve the issue. As a temporary workaround, consider disabling the viewing of email logs until a patch is applied. Restrict access to the email logs to minimize the risk of exploitation. Avoid using plugins that enable users to send emails with unfiltered HTML in the affected versions until the issue is resolved.