Abdelkhalek Beraoud

**Name of the Vulnerable Software and Affected Versions** Simple Draft List plugin for WordPress versions up to and including 2.6.2 **Description** The Simple Draft List plugin for WordPress is susceptible to Stored Cross-Site Scripting through the `display name` post meta (Custom Field). This is a result of inadequate input sanitization and output escaping on the author display name when no author URL is available. The plugin retrieves `$draft data->display name`, which triggers `WP Post:: get()` and resolves to `get post meta($post id, 'display name', true)`. When the `user url` meta field is empty, the `$author` value is assigned to `$author link` without any escaping. This unescaped value is then included in the shortcode output via `str replace()`. Authenticated attackers with Contributor-level access or higher can inject arbitrary web scripts into pages, which will execute when a user accesses a page containing the `[drafts]` shortcode with the `{{author+link}}` template tag. **Recommendations** Update the Simple Draft List plugin to a version beyond 2.6.2.

**Name of the Vulnerable Software and Affected Versions** Public Knowledge Project pkp-lib versions 3.4.0-7 and earlier **Description** The issue is related to an Open redirect vulnerability due to a lack of input sanitization in the logout function. **Recommendations** For Public Knowledge Project pkp-lib versions 3.4.0-7 and earlier, consider updating to a newer version to mitigate the risk, however at the moment there is no information about a newer version that contains a fix for this vulnerability. As a temporary workaround, consider restricting access to the logout function until a patch is available.