Nh4Tvd

**Name of the Vulnerable Software and Affected Versions** WP Photo Album Plus versions prior to 9.3.03.003 **Description** Insufficient input sanitization and output escaping allow unauthenticated attackers to perform Stored Cross-Site Scripting (XSS) via the REQUEST URI Session History. This occurs because the `esc url raw()` function removes literal angle brackets but keeps HTML entities, which are then converted back into active HTML tags by the `wppaEntityDecode()` function before being rendered by the `jQuery('#wppa-modal-container').html()` method. This enables the injection of arbitrary web scripts that execute when a user visits an affected page. **Recommendations** Update WP Photo Album Plus to a version newer than 9.3.03.002.

**Name of the Vulnerable Software and Affected Versions** Premium Addons for Elementor versions prior to 4.11.110 **Description** Improper neutralization of input during web page generation allows for Stored Cross-site Scripting (XSS), a condition where malicious scripts are permanently stored on the target server and executed in the browser of users visiting the affected page. **Recommendations** Update Premium Addons for Elementor to version 4.11.110 or later.

**Name of the Vulnerable Software and Affected Versions** Unlimited Elements For Elementor (Free Widgets, Addons, Templates) versions prior to 2.0.21 **Description** An issue involving improper neutralization of input during web page generation allows for Reflected Cross-site Scripting (XSS), a technique where malicious scripts are injected into trusted websites and reflected back to the user. **Recommendations** Update Unlimited Elements For Elementor (Free Widgets, Addons, Templates) to version 2.0.21 or later.

**Name of the Vulnerable Software and Affected Versions** ThemeREX Addons versions prior to 2.46.0 **Description** A Server-Side Request Forgery (SSRF) issue exists in the ThemeREX Group ThemeREX Addons `trx addons` component. This flaw allows an attacker to induce the server-side application to make requests to an unintended location. **Recommendations** Update ThemeREX Addons to a version later than 2.46.0.

**Name of the Vulnerable Software and Affected Versions** ThemeREX Addons versions prior to 2.46.0 **Description** ThemeREX Addons `trx addons` contains a stored cross-site scripting (XSS) flaw, which occurs when an application includes untrusted data in a web page without proper validation or encoding, allowing a malicious script to be permanently stored on the server and executed in the browser of other users. **Recommendations** Update ThemeREX Addons to a version newer than 2.46.0.

**Name of the Vulnerable Software and Affected Versions** ElementsKit Elementor addons Lite versions prior to 4.0.7 **Description** Improper neutralization of input during web page generation allows for Stored Cross-site Scripting (XSS), a condition where malicious scripts are permanently stored on the target server and later executed in the browser of a user visiting the affected page. **Recommendations** Update ElementsKit Elementor addons Lite to version 4.0.7 or later.

Subscriber Cross Site Scripting (XSS) in ThemeREX Addons < 2.45.0 versions.

Unauthenticated Cross Site Scripting (XSS) in JetEngine <= 3.8.14.3 versions.

Subscriber Cross Site Scripting (XSS) in JetEngine <= 3.8.14.3 versions.

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Crocoblock. Jetimpex Inc. JetEngine allows Stored XSS. This issue affects JetEngine: from n/a through 3.8.15.3.

**Name of the Vulnerable Software and Affected Versions** Premium Addons for Elementor versions prior to 4.11.106 **Description** Cross Site Scripting (XSS) allows an attacker with contributor-level permissions to execute malicious scripts in the browser of other users. **Recommendations** Update Premium Addons for Elementor to version 4.11.106 or later.

**Name of the Vulnerable Software and Affected Versions** Qi Addons For Elementor versions prior to 1.12 **Description** An issue exists that allows contributors to perform Cross Site Scripting (XSS), a technique where malicious scripts are injected into trusted websites. **Recommendations** Update to a version newer than 1.11.

**Name of the Vulnerable Software and Affected Versions** Happy Addons for Elementor versions prior to 3.23.2 **Description** Cross Site Scripting (XSS) allows an attacker with contributor-level permissions to execute malicious scripts in the browser of other users. **Recommendations** Update Happy Addons for Elementor to version 3.23.2 or later.

Contributor Cross Site Scripting (XSS) in The Plus Addons for Elementor Page Builder Lite <= 6.5.1 versions.

Contributor Cross Site Scripting (XSS) in King Addons for Elementor <= 51.1.85 versions.

Unauthenticated Cross Site Scripting (XSS) in ThemeREX Addons < 2.45.0 versions.

Contributor Cross Site Scripting (XSS) in JetBlog <= 2.4.10 versions.

Contributor Cross Site Scripting (XSS) in JetBlocks For Elementor <= 1.5.2 versions.

Contributor Cross Site Scripting (XSS) in JetSearch <= 3.6.3 versions.

**Name of the Vulnerable Software and Affected Versions** JetElements For Elementor versions prior to 2.9.2.2 **Description** An issue exists that allows a user with contributor privileges to perform Cross Site Scripting (XSS), a technique where malicious scripts are injected into trusted websites. **Recommendations** Update JetElements For Elementor to version 2.9.2.2 or later.