Alexander Jurkschat

**Name of the Vulnerable Software and Affected Versions** Ecwid by Lightspeed Ecommerce Shopping Cart versions prior to 7.0.9 **Description** The plugin fails to perform a capability check or nonce verification—a security token used to prevent cross-site request forgery—on a store-management action. This allows any authenticated user, including those with subscriber-level privileges, to trigger the `ec disconnect` action to disconnect the store and take the storefront offline until an administrator restores the connection. **Recommendations** Update to version 7.0.9 or later.

**Name of the Vulnerable Software and Affected Versions** Mapster WP Maps versions prior to 1.24.0 **Description** A public REST endpoint fails to perform authorization or post-status checks. This allows unauthenticated users to retrieve the title and full content of any post, including those that are unpublished, such as drafts, pending, private, or trashed posts. **Recommendations** Update Mapster WP Maps to version 1.24.0 or later.

**Name of the Vulnerable Software and Affected Versions** Kali Forms — Contact Form & Drag-and-Drop Builder WordPress plugin versions prior to 2.4.17 **Description** Unauthenticated users can upload files to the WordPress Media Library because the plugin fails to verify if a file upload is associated with an existing form configured with a file-upload field. The system accepts uploads regardless of whether a valid form exists. These uploads are restricted to the default-allowed MIME types (Multipurpose Internet Mail Extensions, which are labels used to identify the nature and format of a document), preventing remote code execution. **Recommendations** Update Kali Forms — Contact Form & Drag-and-Drop Builder WordPress plugin to version 2.4.17 or later.

**Name of the Vulnerable Software and Affected Versions** Frontend File Manager Plugin versions prior to 23.7 **Description** An issue exists where the file download handler does not properly enforce its nonce check. A nonce (number used once) is a security token used to prevent cross-site request forgery. This flaw allows unauthenticated attackers to download files uploaded by any user by iterating identifiers. **Recommendations** Update the plugin to a version newer than 23.6.