Het Kalariya

The Visual Form Builder WordPress plugin through 3.1 does not perform an authorization check before displaying recent form submission data in a dashboard widget, allowing any authenticated user (Subscriber and above) to read other users' submitted contact information, including names, email addresses, form titles and timestamps.

The Subscribe to Comments WordPress plugin before 2.3.3 does not sign or validate a cookie it trusts to identify a commenter, allowing unauthenticated attackers to disclose a subscriber's management key and silently alter that subscriber's subscriptions.

**اسم البرنامج المصاب والإصدارات المتأثرة** Subscribe to Comments الإصدارات السابقة لـ 2.3.3 **Description** توجد مشكلة حيث يفشل البرنامج في التحقق بشكل صحيح من صحة معلمة قبل عكسها في هدف الرابط. يسمح هذا للمهاجمين غير المصرح لهم بتنفيذ Reflected Cross-Site Scripting (XSS)—وهي تقنية يتم من خلالها حقن نصوص برمجية خبيثة في مواقع موثوقة—عبر رابط مصمم خصيصاً ضد أي مستخدم ينقر عليه، بما في ذلك المسؤولون. المعلمة المصابة هي `ref`. **Recommendations** تحديث Subscribe to Comments إلى الإصدار 2.3.3 أو أحدث. تجنب استخدام المعلمة `ref` في روابط URL حتى يتم تطبيق التحديث.

**Name of the Vulnerable Software and Affected Versions** Loco Translate WordPress plugin versions prior to 2.8.9 **Description** Insufficient sanitization and escaping of bundle configuration values before they are output on an admin page allows users with translator capabilities or higher to execute Stored Cross-Site Scripting (XSS) attacks against high-privilege users, such as administrators. Stored Cross-Site Scripting is a type of attack where malicious scripts are permanently stored on the target server. **Recommendations** Update the plugin to version 2.8.9 or later.

**Name of the Vulnerable Software and Affected Versions** WP Mobile Menu versions prior to 2.9 **Description** Insufficient nonce verification during the settings import process allows an attacker to perform a cross-site request within an administrator's session to import arbitrary settings. Because these imported values are output unescaped to all visitors, this leads to Stored Cross-Site Scripting (XSS), a condition where malicious scripts are permanently stored on the server and executed in the browsers of users visiting the site. **Recommendations** Update WP Mobile Menu to version 2.9 or later.