Akshat Parikh

**Name of the Vulnerable Software and Affected Versions** JetBackup WordPress plugin versions prior to 3.1.23.5 **Description** Insufficient multisite authorization checks occur before serving backup archives and job logs. This allows an administrator of the network's main site, who lacks Super Admin privileges, to download a full backup of the entire network, including the shared webroot and data from every site. **Recommendations** Update JetBackup WordPress plugin to version 3.1.23.5 or later.

**Name of the Vulnerable Software and Affected Versions** Ray Enterprise Translation versions prior to 1.7.4 **Description** The Ray Enterprise Translation WordPress plugin fails to perform capability or nonce checks on an AJAX action. This allows any authenticated user, such as those with Subscriber privileges, to overwrite the translation API token configured by the administrator with an arbitrary value. A nonce is a unique token used to protect against cross-site request forgery. **Recommendations** Update the plugin to version 1.7.4 or later.

**Name of the Vulnerable Software and Affected Versions** Ray Enterprise Translation versions prior to 1.7.4 **Description** The Ray Enterprise Translation WordPress plugin fails to perform capability or nonce checks on an AJAX action. This allows any authenticated user, such as those with Subscriber privileges, to add or delete the configured languages of the site. A nonce is a unique token used to protect against cross-site request forgery (CSRF) by ensuring that the request was intentionally sent by the user. **Recommendations** Update the plugin to version 1.7.4 or later.

**Name of the Vulnerable Software and Affected Versions** PhonePe Payment Solutions WordPress plugin versions prior to 3.1.0 **Description** Insufficient verification of incoming payment callbacks occurs because the secret used to validate the callback signature remains empty during the standard setup flow. Consequently, the expected signature becomes an unkeyed hash of the request body, which can be calculated by any party. This allows unauthenticated attackers to forge payment-success notifications to mark unpaid WooCommerce orders as paid without actual payment. **Recommendations** Update PhonePe Payment Solutions WordPress plugin to version 3.1.0 or later.

**Name of the Vulnerable Software and Affected Versions** Ability, Inc Web Accessibility with Max Access versions through 2.1.0 **Description** The software contains a flaw due to improper neutralization of input during web page generation, specifically a Stored Cross-site Scripting issue. This allows for the injection of malicious scripts. The vulnerability exists within the accessibility-toolbar component. **Recommendations** Update to a version newer than 2.1.0.

**Name of the Vulnerable Software and Affected Versions** Apache Traffic Server versions 9.0.0 through 9.2.2 **Description** The issue is related to an Improper Input Validation vulnerability in Apache Traffic Server, specifically with malformed HTTP/2 frames. Users are recommended to upgrade to a fixed version. **Recommendations** For Apache Traffic Server versions 9.0.0 through 9.2.2, upgrade to version 9.2.3, which fixes the issue.