Dutafi

**Name of the Vulnerable Software and Affected Versions** CP Media Player versions prior to 1.3.1 **Description** Unauthenticated Cross Site Scripting (XSS) allows an attacker to execute malicious scripts in the browser of a user without requiring authentication. **Recommendations** Update CP Media Player to a version newer than 1.3.0.

**Name of the Vulnerable Software and Affected Versions** Kadence Shop Kit versions prior to 3.0.7 **Description** An issue exists that allows a user with subscriber privileges to perform a SQL Injection. This occurs when the application fails to properly sanitize input used in database queries, allowing an attacker to manipulate the query structure. **Recommendations** Update Kadence Shop Kit to version 3.0.7 or later.

**Name of the Vulnerable Software and Affected Versions** Readabler versions prior to 2.0.18 **Description** An issue exists where unauthenticated attackers can perform SQL Injection, a technique used to interfere with the queries that an application makes to its database. This occurs due to insufficient escaping of user-supplied parameters and a lack of proper preparation of the SQL query, allowing attackers to append additional queries to extract sensitive information from the database. **Recommendations** Update to version 2.0.18 or later.

**Name of the Vulnerable Software and Affected Versions** WP Project Manager Pro versions prior to 4.0.2 **Description** Insufficient escaping of user-supplied parameters and lack of proper preparation in SQL queries allow authenticated attackers with Subscriber-level access and above to perform SQL Injection. This occurs when additional SQL queries are appended to existing ones, enabling the extraction of sensitive information from the database. **Recommendations** Update WP Project Manager Pro to version 4.0.2 or later.

**Name of the Vulnerable Software and Affected Versions** Ultimate Dashboard versions prior to 3.11.3 **Description** An unauthenticated Cross Site Scripting (XSS) issue exists, which allows an attacker to execute malicious scripts in the browser of a user without requiring prior authentication. **Recommendations** Update Ultimate Dashboard to version 3.11.3 or later.

**Name of the Vulnerable Software and Affected Versions** Simple Link Directory versions prior to 15.0.6 **Description** An unauthenticated Cross Site Scripting (XSS) issue exists, which allows an attacker to execute malicious scripts in the browser of a user without requiring prior authentication. **Recommendations** Update Simple Link Directory to a version newer than 15.0.5.

**Name of the Vulnerable Software and Affected Versions** Customize My Account for WooCommerce versions prior to 4.4.0 **Description** Reflected Cross-Site Scripting occurs due to insufficient input sanitization and output escaping. This allows unauthenticated attackers to inject arbitrary web scripts into pages, which execute when a user is tricked into performing an action, such as clicking a link. **Recommendations** Update to a version newer than 4.3.9.

**Name of the Vulnerable Software and Affected Versions** CodePeople Post Map for Google Maps versions prior to 1.2.6 **Description** Stored Cross-Site Scripting occurs due to insufficient input sanitization and output escaping. This allows unauthenticated attackers to inject arbitrary web scripts into pages, which execute when a user accesses the affected page. **Recommendations** Update CodePeople Post Map for Google Maps to version 1.2.6 or later.

**Name of the Vulnerable Software and Affected Versions** ARForms versions prior to 7.1.3 **Description** An unauthenticated Cross Site Scripting (XSS) issue exists, which allows an attacker to execute malicious scripts in the browser of a user without requiring prior authentication. **Recommendations** Update to a version newer than 7.1.2.

**Name of the Vulnerable Software and Affected Versions** Buddyboss Platform versions prior to 3.0.5 **Description** PHP Object Injection occurs when an application deserializes untrusted data, allowing an attacker to manipulate the application logic or execute arbitrary code by injecting malicious objects into the `Subscriber` object. **Recommendations** Update Buddyboss Platform to version 3.0.5 or later.

**Name of the Vulnerable Software and Affected Versions** perfmatters versions prior to 2.6.4 **Description** An unauthenticated Cross Site Scripting (XSS) issue exists, which allows an attacker to execute malicious scripts in the browser of a user without requiring prior authentication. **Recommendations** Update to a version newer than 2.6.3.

**Name of the Vulnerable Software and Affected Versions** Directorist Booking versions prior to 3.0.4 **Description** Improper Neutralization of Special Elements used in an SQL Command in wpWax Directorist Booking allows Blind SQL Injection. Blind SQL Injection is a technique where an attacker asks the database true or false questions and determines the answer based on the application's response. **Recommendations** Update to a version newer than 3.0.3.

**Name of the Vulnerable Software and Affected Versions** WPFunnels Pro versions prior to 2.9.5 **Description** The WPFunnels Pro plugin for WordPress contains a Stored Cross-Site Scripting (XSS) flaw. This issue occurs because of insufficient input sanitization and output escaping, allowing unauthenticated attackers to inject arbitrary web scripts into pages. These scripts execute automatically whenever a user visits the affected page. **Recommendations** Update to a version newer than 2.9.4.

**Name of the Vulnerable Software and Affected Versions** Thrive Apprentice versions prior to 10.8.10.2 **Description** An unauthenticated PHP Object Injection exists due to the deserialization of untrusted input. This allows an attacker to inject a PHP Object. While no POP chain (a sequence of gadgets used to achieve code execution) is present in the software itself, the presence of a POP chain via another installed plugin or theme could enable the deletion of arbitrary files, retrieval of sensitive data, or remote code execution. **Recommendations** Update to version 10.8.10.2 or later.

**Name of the Vulnerable Software and Affected Versions** miniOrange WordPress Social Login and Register versions through 7.7.0 **Description** The software contains a flaw related to improper control of filename for include/require statements, specifically a PHP Remote File Inclusion issue. This allows for PHP Local File Inclusion. The `miniOrange WordPress Social Login and Register` software is affected. **Recommendations** Update to a version newer than 7.7.0.

**Name of the Vulnerable Software and Affected Versions** NEX-Forms – Ultimate Forms Plugin for WordPress versions through 9.1.6 **Description** The software is susceptible to SQL Injection through the `orderby` parameter within the `nf load form entries` action. Insufficient input sanitization and inadequate SQL query preparation allow authenticated attackers with Administrator-level access or higher to inject additional SQL queries, potentially extracting sensitive database information. Lower-level users may also be able to exploit this if granted access by a site administrator. **Recommendations** Update NEX-Forms – Ultimate Forms Plugin for WordPress to a version later than 9.1.6.