David Álvarez Robles

**Name of the Vulnerable Software and Affected Versions** M4 PDF plugin for Prestashop sites versions 3.2.3 and before **Description** The issue is related to a directory traversal vulnerability. The `f` parameter is not properly checked in the resource "/m4pdf/pdf.php", allowing an attacker to download any file given its relative path. This could potentially enable an attacker to access sensitive files, such as "/etc/passwd", if they exist on the server. **Recommendations** For versions 3.2.3 and before, consider disabling the "/m4pdf/pdf.php" resource or restricting access to it until a patch is available. Additionally, avoid using the `f` parameter in the affected API endpoint until the issue is resolved. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** M4 PDF plugin for Prestashop sites versions 3.2.3 and before **Description** The M4 PDF plugin for Prestashop sites is vulnerable to an arbitrary HTML Document crafting vulnerability. The resource "/m4pdf/pdf.php" uses templates to dynamically create documents. If the template does not exist, the application returns a fixed document with a message in mpdf format. An attacker could exploit this vulnerability by inputting a valid HTML/CSS document as the value of the `parameter`. **Recommendations** For versions 3.2.3 and before, as a temporary workaround, consider restricting access to the "/m4pdf/pdf.php" endpoint until a patch is available. Avoid using the vulnerable parameter in the affected API endpoint until the issue is resolved. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** Visforms Base Package for Joomla 3 (affected versions not specified) **Description** The issue allows an attacker to interact with the database, potentially enabling them to read, modify, and delete data, due to the use of concatenation in constructing SQL queries. **Recommendations** At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** Themify Post Type Builder Search Addon WordPress plugin versions prior to 1.4.0 **Description** The issue arises from the plugin's failure to properly escape the current page URL before reusing it in an HTML attribute, leading to a reflected cross-site scripting vulnerability. **Recommendations** For versions prior to 1.4.0, update to version 1.4.0 or later to resolve the issue.

**Name of the Vulnerable Software and Affected Versions** Enfold versions prior to 4.8.4 **Description** The Enfold WordPress theme is affected by a Reflected Cross-Site Scripting (XSS) issue. This issue is present in Enfold versions that use Avia Page Builder and are previous to version 4.8.4. **Recommendations** For Enfold versions prior to 4.8.4, update to version 4.8.4 or later to resolve the issue. As a temporary workaround, consider restricting access to the Avia Page Builder until the update is applied.