0X34Rth

**Name of the Vulnerable Software and Affected Versions** Extended Random Number Generator versions prior to 1.2 **Description** The Extended Random Number Generator plugin for WordPress is susceptible to Stored Cross-Site Scripting through the plugin settings. Insufficient input sanitization and output escaping allow authenticated attackers with administrator-level access to inject arbitrary web scripts into pages. These scripts will execute when a user accesses the injected page. This issue specifically impacts multi-site installations and those where unfiltered html has been disabled. **Recommendations** Update Extended Random Number Generator to version 1.2 or later.

**Name of the Vulnerable Software and Affected Versions** All push notification for WP versions up to and including 1.5.3 **Description** The All push notification for WP plugin for WordPress is susceptible to time-based SQL Injection via the `delete id` parameter. This is due to inadequate escaping of user-supplied input and insufficient preparation of the existing SQL query. Successful exploitation allows authenticated attackers with administrator-level access or higher to inject additional SQL queries into existing queries, potentially enabling the extraction of sensitive information from the database. **Recommendations** Versions prior to and including 1.5.3 should be updated to a newer, fixed version when available.

**Nome do Software Vulnerável e Versões Afetadas** Versões do WP Content Permission anteriores à 1.3 **Descrição** O plugin WP Content Permission para WordPress é suscetível a Cross-Site Scripting Armazenado. Isso ocorre devido à sanitização insuficiente de entradas e escape de saída no parâmetro `ohmem-message`. Um atacante autenticado com acesso de nível Administrador ou superior pode injetar scripts web arbitrários em páginas. Esses scripts serão executados quando um usuário acessar a página injetada. O endpoint da API envolvido não é explicitamente mencionado. O parâmetro vulnerável é `ohmem-message`. **Recomendações** Atualize o WP Content Permission para a versão 1.3 ou superior.