Blackangel

**Name of the Vulnerable Software and Affected Versions** WP Config File Editor WordPress plugin versions 1.7.1 and earlier **Description** The issue is related to an Authenticated Stored Cross-Site Scripting (XSS) vulnerability. This means that an attacker could potentially inject malicious scripts into the application, which would then be executed by the user's browser. However, no information is provided about the estimated number of potentially affected devices worldwide or details about real-world incidents where this issue was exploited. **Recommendations** For WP Config File Editor WordPress plugin versions 1.7.1 and earlier, update to a version later than 1.7.1 to resolve the issue.

**Name of the Vulnerable Software and Affected Versions** Smart Slider 3 versions prior to 3.5.0.9 **Description** The issue is related to a Stored Cross-Site Scripting problem. It occurs because the `Project Name` is not properly sanitized before being outputted back on the page. By default, only administrator users have access to the affected functionality, which limits the potential for exploitation. However, if WordPress administrators allow users with lesser privileges to access the plugin's functionality, it could lead to privilege escalation. **Recommendations** For versions prior to 3.5.0.9, update to version 3.5.0.9 or later to resolve the issue. As a temporary workaround, consider restricting access to the plugin's functionality to only administrator users to minimize the risk of exploitation.