Bilal Chawich

**Name of the Vulnerable Software and Affected Versions** WP ULike – The Ultimate Engagement Toolkit for Websites plugin for WordPress versions up to, and including, 4.7.4 **Description** The issue is a Cross-Site Request Forgery vulnerability due to missing or incorrect nonce validation on the `wp ulike delete history api()` function. This allows unauthenticated attackers to delete engagements via a forged request if they can trick a site administrator into performing an action, such as clicking on a link. **Recommendations** For versions up to, and including, 4.7.4, consider disabling the `wp ulike delete history api()` function until a patch is available to prevent exploitation. Restrict access to the plugin's functionality to minimize the risk of exploitation. Avoid using the plugin until the issue is resolved. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** SlimStat Analytics plugin for WordPress versions up to, and including, 5.2.6 **Description** The issue is related to Stored Cross-Site Scripting via the `resource` parameter due to insufficient input sanitization and output escaping when logging visitor requests. This allows unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. **Recommendations** For versions up to, and including, 5.2.6, update to a version later than 5.2.6 to resolve the issue. As a temporary workaround, consider restricting access to the `resource` parameter to minimize the risk of exploitation.

**Name of the Vulnerable Software and Affected Versions** Slimstat Analytics WordPress plugin versions prior to 4.9.3 **Description** The issue allows unauthenticated attackers to perform Stored Cross-Site Scripting attacks against logged-in admins viewing the logs, due to the plugin's failure to sanitise and escape the URI when logging requests. **Recommendations** For versions prior to 4.9.3, update to version 4.9.3 or later to resolve the issue. As a temporary workaround, consider restricting access to the logs for logged-in admins until the update is applied.