Dodoh4T

**Name of the Vulnerable Software and Affected Versions** WPIDE – File Manager & Code Editor versions prior to 3.5.7 **Description** An unauthenticated Cross Site Request Forgery (CSRF) issue exists. CSRF is a flaw that allows an attacker to trick a victim into performing actions they did not intend to do on a web application. **Recommendations** Update WPIDE – File Manager & Code Editor to a version newer than 3.5.6.

**Name of the Vulnerable Software and Affected Versions** ProfileGrid versions prior to 5.9.9.8 **Description** An unauthenticated Cross Site Request Forgery (CSRF) issue exists, which could lead to account takeover. CSRF is a flaw that allows an attacker to trick a victim into performing actions they did not intend to do on a web application. **Recommendations** Update ProfileGrid to a version newer than 5.9.9.7.

**Name of the Vulnerable Software and Affected Versions** Permalink Manager for WooCommerce versions prior to 1.0.8.3 **Description** An unauthenticated Cross Site Request Forgery (CSRF) issue exists, which can lead to Stored Cross-Site Scripting (XSS). CSRF is a flaw that allows an attacker to trick a victim into performing actions they did not intend to take, while Stored XSS occurs when a malicious script is permanently stored on the target server and executed in the browser of users who visit the affected page. **Recommendations** Update Permalink Manager for WooCommerce to a version newer than 1.0.8.2.

**Name of the Vulnerable Software and Affected Versions** ShortPixel Adaptive Images versions prior to 3.11.4 **Description** Stored Cross-Site Scripting occurs due to insufficient input sanitization and output escaping. This allows authenticated attackers with subscriber-level access and above to inject arbitrary web scripts into pages, which execute when a user accesses the affected page. **Recommendations** Update ShortPixel Adaptive Images to version 3.11.4 or later.

**Name of the Vulnerable Software and Affected Versions** Internal Links Manager versions prior to 3.0.4 **Description** Stored Cross-Site Scripting occurs due to insufficient input sanitization and output escaping. This allows unauthenticated attackers to inject arbitrary web scripts into pages, which execute when a user accesses the affected page. **Recommendations** Update Internal Links Manager to version 3.0.4 or later.

**Name of the Vulnerable Software and Affected Versions** Trinity Backup versions prior to 2.0.10 **Description** An issue exists that allows unauthenticated users to access sensitive data. **Recommendations** Update to a version newer than 2.0.9.

**Name of the Vulnerable Software and Affected Versions** Object Cache 4 everyone versions prior to 2.3.3 **Description** An issue exists that allows unauthenticated users to cause sensitive data exposure. **Recommendations** Update to a version newer than 2.3.2.

**Name of the Vulnerable Software and Affected Versions** Syncee Premium Dropshipping & Wholesale versions prior to 1.0.28 **Description** An unauthenticated broken access control issue exists, allowing unauthorized users to bypass security restrictions. **Recommendations** Update to a version newer than 1.0.27.

**Name of the Vulnerable Software and Affected Versions** Gallery versions prior to 4.7.9 **Description** An issue exists that allows for SQL Injection, a technique where malicious SQL statements are inserted into entry fields for execution, specifically affecting contributors. **Recommendations** Update to a version newer than 4.7.8.

**Name of the Vulnerable Software and Affected Versions** License Manager for WooCommerce versions prior to 3.0.16 **Description** An unauthenticated Insecure Direct Object Reference (IDOR) exists in the software. IDOR is a type of access control vulnerability that occurs when an application provides direct access to objects based on user-supplied input without sufficient authorization checks. **Recommendations** Update to a version newer than 3.0.15.

**Name of the Vulnerable Software and Affected Versions** Intranet & Private Site – All-In-One Intranet versions prior to 1.8.2 **Description** Broken access control exists due to a missing capability check in a function, allowing unauthenticated attackers to perform unauthorized actions. **Recommendations** Update to a version newer than 1.8.1.

**Name of the Vulnerable Software and Affected Versions** SureDash versions prior to 1.8.0 **Description** Improper neutralization of special elements used in an SQL command allows for Blind SQL Injection. This occurs when the application fails to properly sanitize user-supplied data before including it in a database query, enabling an attacker to infer information from the database by observing the application's response to specific queries. **Recommendations** Update to a version later than 1.8.0.

**Name of the Vulnerable Software and Affected Versions** Booking Manager versions prior to 2.1.19 **Description** Booking Manager contains a stored cross-site scripting (XSS) flaw, which occurs when the application fails to properly neutralize input during the generation of web pages. This allows an attacker to store malicious scripts on the server that are later executed in the browsers of other users. **Recommendations** Update to a version later than 2.1.18.

**Name of the Vulnerable Software and Affected Versions** QuickWebP – Compress / Optimize Images & Convert WebP | SEO Friendly versions prior to 3.2.8 **Description** An improper limitation of a pathname to a restricted directory, known as Path Traversal, exists in the quickwebp component. This flaw allows for arbitrary file deletion. **Recommendations** Update to a version newer than 3.2.7.

**Name of the Vulnerable Software and Affected Versions** VikBooking Hotel Booking Engine & PMS versions prior to 1.9.0 **Description** An improper limitation of a pathname to a restricted directory, known as Path Traversal, allows access to files outside of the intended directory. **Recommendations** Update to a version later than 1.8.9.

**Name of the Vulnerable Software and Affected Versions** BP Better Messages versions prior to 2.14.17 **Description** An authorization bypass exists due to user-controlled keys, which allows for the exploitation of incorrectly configured access control security levels. **Recommendations** Update to a version later than 2.14.16.