Ananda Dhakal

**Name of the Vulnerable Software and Affected Versions** Automattic WooCommerce versions prior to 11.0 **Description** An issue involving improper neutralization of special elements used in an SQL command allows for Blind SQL Injection. Blind SQL Injection is a technique where an attacker asks the database true or false questions and determines the answer based on the application's response. **Recommendations** Update to version 11.0 or later.

**Name of the Vulnerable Software and Affected Versions** bbPress versions prior to 2.6.15 **Description** A missing authorization issue exists that allows the exploitation of incorrectly configured access control security levels. **Recommendations** Update to version 2.6.15 or later.

**Name of the Vulnerable Software and Affected Versions** ACF Extended versions prior to 0.9.2.7 **Description** Broken access control allows users with contributor privileges to perform unauthorized actions within the plugin. **Recommendations** Update ACF Extended to version 0.9.2.7 or later.

**Name of the Vulnerable Software and Affected Versions** Rank Math SEO versions prior to 1.0.277 **Description** An issue allows for Author Remote Code Execution (RCE), a flaw that enables an attacker with author-level privileges to execute arbitrary code on the server. **Recommendations** Update Rank Math SEO to version 1.0.277 or later.

**Name of the Vulnerable Software and Affected Versions** FluentBooking Pro versions prior to 2.2.5 **Description** An unauthenticated Cross Site Request Forgery (CSRF) issue exists. CSRF is a flaw that allows an attacker to trick a victim into performing actions they did not intend to do on a web application. **Recommendations** Update FluentBooking Pro to version 2.2.5 or later.

**Name of the Vulnerable Software and Affected Versions** Fluent Boards Pro versions prior to 2.0.12 **Description** An arbitrary file upload issue exists within the editor component, allowing an attacker to upload unauthorized files to the server. **Recommendations** Update to a version newer than 2.0.11.

**Name of the Vulnerable Software and Affected Versions** Fluent Boards Pro versions prior to 2.0.12 **Description** An issue allows an editor to perform arbitrary file deletion within the application. **Recommendations** Update to version 2.0.12 or later.

**Name of the Vulnerable Software and Affected Versions** Fluent Boards Pro versions prior to 2.0.12 **Description** Cross Site Scripting (XSS) exists in the software, allowing users with Subscriber privileges to execute malicious scripts in the browser of other users. **Recommendations** Update to version 2.0.12 or later.

**Name of the Vulnerable Software and Affected Versions** FluentPlayer Pro versions prior to 1.3.3 **Description** Broken Access Control exists in the editor component, which may allow unauthorized users to perform actions they should not be permitted to execute. **Recommendations** Update to a version newer than 1.3.2.

**Name of the Vulnerable Software and Affected Versions** FluentCRM Pro versions prior to 3.1.13 **Description** A privilege escalation issue exists that allows a user with Editor permissions to elevate their privileges. **Recommendations** Update to a version newer than 3.1.12.

**Name of the Vulnerable Software and Affected Versions** Fluent Boards Pro versions prior to 2.0.12 **Description** PHP Object Injection occurs in the Editor component. PHP Object Injection is a vulnerability that allows an attacker to inject malicious objects into the application, which can lead to unauthorized code execution or other security breaches during the deserialization process. **Recommendations** At the moment, there is no information about a newer version that contains a fix for this vulnerability. Restrict access to the Editor component to minimize the risk of exploitation.

**Name of the Vulnerable Software and Affected Versions** FluentCRM Pro versions prior to 3.1.13 **Description** An issue exists in the FluentCRM Pro plugin for WordPress due to insufficient escaping of user-supplied parameters and a lack of proper preparation of SQL queries. This allows authenticated attackers with Author-level access or higher to perform SQL Injection, which involves inserting malicious SQL statements into existing queries to extract sensitive information from the database. **Recommendations** Update the plugin to version 3.1.13 or later.

**Name of the Vulnerable Software and Affected Versions** Fluent Boards Pro versions prior to 2.0.12 **Description** An Insecure Direct Object Reference occurs due to missing validation on a user controlled key. This allows authenticated attackers with Subscriber-level access and above to perform unauthorized actions. **Recommendations** Update Fluent Boards Pro to version 2.0.12 or later.

**Name of the Vulnerable Software and Affected Versions** Fluent Support Pro versions prior to 2.3.2 **Description** An unauthorized access issue exists due to a missing capability check in a function. This allows authenticated users with Subscriber-level permissions or higher to perform unauthorized actions. **Recommendations** Update Fluent Support Pro to version 2.3.2 or later.

**Name of the Vulnerable Software and Affected Versions** Real Testimonials versions prior to 3.1.16 **Description** Deserialization of untrusted data in the testimonial-free component allows for Object Injection. This occurs when the application deserializes data from an untrusted source without sufficient validation, potentially allowing an attacker to inject malicious PHP objects into the application state. **Recommendations** Update to a version newer than 3.1.15.

**Name of the Vulnerable Software and Affected Versions** WooCommerce Bulk Edit Products – WP Sheet Editor versions prior to 1.8.22 **Description** Broken access control occurs due to missing authorization, which allows the exploitation of incorrectly configured access control security levels within the `woo-bulk-edit-products` component. **Recommendations** Update WooCommerce Bulk Edit Products – WP Sheet Editor to version 1.8.22 or later.

**Name of the Vulnerable Software and Affected Versions** JetBlocks For Elementor versions prior to 1.5.1 **Description** An issue in the Crocoblock JetBlocks For Elementor plugin allows the retrieval of embedded sensitive system information by an unauthorized party. **Recommendations** Update JetBlocks For Elementor to a version newer than 1.5.0.

**Name of the Vulnerable Software and Affected Versions** Themeisle Auto Featured Image (Auto Post Thumbnail) versions prior to 5.0.5 **Description** Server-Side Request Forgery (SSRF) occurs in the auto-post-thumbnail component, which allows an attacker to induce the server-side application to make requests to an unintended location. **Recommendations** Update Themeisle Auto Featured Image (Auto Post Thumbnail) to version 5.0.5 or later.

**Name of the Vulnerable Software and Affected Versions** User Profile Picture versions prior to 2.6.4 **Description** An authorization bypass exists due to a user-controlled key, allowing the exploitation of incorrectly configured access control security levels. This issue is characterized as an Insecure Direct Object Reference (IDOR), which occurs when an application provides direct access to objects based on user-supplied input without sufficient authorization checks. **Recommendations** Update User Profile Picture to version 2.6.4 or later.

**Name of the Vulnerable Software and Affected Versions** persian-gravity-forms versions prior to 3.0.3 **Description** An improper neutralization of special elements used in an SQL command allows for Blind SQL Injection. Blind SQL Injection is a technique where an attacker asks the database true or false questions and determines the answer based on the application's response. **Recommendations** Update persian-gravity-forms to a version newer than 3.0.2.