Vincematsui

**Name of the Vulnerable Software and Affected Versions** Connections Business Directory plugin for WordPress versions up to, and including, 10.4.66 **Description** The issue is related to insufficient file path validation when deleting a connections image directory, allowing authenticated attackers with Administrator-level access and above to delete arbitrary folders on the server and all their content. **Recommendations** For versions up to, and including, 10.4.66, update to a version higher than 10.4.66 to resolve the issue. As a temporary workaround, consider restricting access to the directory deletion functionality to minimize the risk of exploitation.

**Name of the Vulnerable Software and Affected Versions** AutomatorWP – Automator plugin for WordPress versions up to, and including, 5.0.9 **Description** The AutomatorWP plugin is vulnerable to Reflected Cross-Site Scripting via the `a-0-o-search field value` parameter due to insufficient input sanitization and output escaping. This allows unauthenticated attackers to inject arbitrary web scripts in pages that execute if they can successfully trick a user into performing an action such as clicking on a link. The vulnerability can be leveraged to execute arbitrary code when used in conjunction with the plugin's import and code action feature. The issue is actively exploited in the wild. **Recommendations** For versions up to, and including, 5.0.9, update to a version higher than 5.0.9 to resolve the issue. As a temporary workaround, consider restricting access to the `a-0-o-search field value` parameter to minimize the risk of exploitation. Avoid using the `a-0-o-search field value` parameter in affected pages until the issue is resolved.

**Name of the Vulnerable Software and Affected Versions** The Simple Ajax Chat – Add a Fast, Secure Chat Box plugin for WordPress versions up to, and including, 20231101 **Description** The issue is related to Stored Cross-Site Scripting via admin settings due to insufficient input sanitization and output escaping. This allows authenticated attackers with administrator-level permissions and above to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. The issue only affects multi-site installations and installations where unfiltered html has been disabled. **Recommendations** For versions up to, and including, 20231101, update to a version later than 20231101 to resolve the issue. As a temporary workaround, consider restricting access to admin settings to minimize the risk of exploitation. Additionally, ensure that unfiltered html is enabled, if possible, to reduce the vulnerability's impact.