Ayush Srivastava

**Name of the Vulnerable Software and Affected Versions** EmbedPress WordPress plugin versions prior to 4.6.1 **Description** The plugin fails to validate user-supplied URLs before making server-side requests through unauthenticated endpoints. This allows unauthenticated attackers to induce the site to send HTTP requests to internal hosts and services that WordPress core URL validation does not cover, resulting in a blind Server-Side Request Forgery (SSRF). SSRF is a flaw where an attacker can force a server to make requests to an unintended location. **Recommendations** Update EmbedPress WordPress plugin to version 4.6.1 or later.

**Name of the Vulnerable Software and Affected Versions** WP Support Plus Responsive Ticket System WordPress plugin versions prior to 9.1.3 **Description** Insufficient validation of uploaded files allows unauthenticated users to upload files containing malicious JavaScript, such as HTML or SVG, to a publicly accessible location. This leads to Stored Cross-Site Scripting (XSS), a condition where malicious scripts are permanently stored on the target server and executed in the browser of site users and administrators. **Recommendations** Update the plugin to version 9.1.3 or later.

**Name of the Vulnerable Software and Affected Versions** WP Support Plus Responsive Ticket System versions prior to 9.1.3 **Description** Unauthenticated users can perform SQL injection attacks because the plugin fails to sanitize user-supplied array keys before incorporating them into a SQL statement. **Recommendations** Update WP Support Plus Responsive Ticket System to version 9.1.3 or later.