Binit Ghimire

**Name of the Vulnerable Software and Affected Versions** WPQA Builder Plugin versions prior to 5.2 **Description** The issue allows any user with privileges as low as Subscriber to delete the profile pictures of other users due to a lack of validation for the `image id` parameter in the `wpqa remove image` ajax action. **Recommendations** For versions prior to 5.2, update to version 5.2 or later to resolve the issue. As a temporary workaround, consider restricting access to the `wpqa remove image` ajax action to prevent unauthorized deletion of profile pictures.

**Name of the Vulnerable Software and Affected Versions** reNgine version 1.0 **Description** A Cross Site Scripting (XSS) issue exists via the Scan Engine name file in the Scan Engine deletion confirmation modal box. **Recommendations** For version 1.0, consider disabling the Scan Engine deletion confirmation modal box as a temporary workaround until a patch is available. Restrict access to the Scan Engine name file to minimize the risk of exploitation. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** CMS Made Simple versions prior to 2.2.15 **Description** The issue allows for cross-site scripting (XSS) attacks through a crafted File Picker profile name. **Recommendations** For CMS Made Simple versions prior to 2.2.15, update to version 2.2.15 or later to resolve the issue.

**Name of the Vulnerable Software and Affected Versions** CMS Made Simple versions through 2.2.10 **Description** The issue concerns a Reflected XSS in the File Manager component. This occurs via the `New name` field when performing a Rename action. **Recommendations** For versions through 2.2.10, update to a version that contains a fix for this issue.