Endang Alfarisi

**Name of the Vulnerable Software and Affected Versions** Gutena Forms – Contact Form, Survey Form, Feedback Form, Booking Form, and Custom Form Builder versions prior to 1.9.1 **Description** An authorization bypass exists because the plugin fails to properly verify if a user is authorized to perform specific actions. Unauthenticated attackers can modify the read/unread status of or permanently trash arbitrary form submission entries for any form. This occurs because the nonce (a unique token used to prevent cross-site request forgery) issued by the `check ajax referer()` function is emitted to unauthenticated visitors via `wp localize script()` on any public page containing a Gutena Forms block, allowing anonymous attackers to obtain it easily. **Recommendations** Update Gutena Forms – Contact Form, Survey Form, Feedback Form, Booking Form, and Custom Form Builder to version 1.9.1 or later.

**Name of the Vulnerable Software and Affected Versions** Debug Log Manager – Conveniently Monitor and Inspect Errors versions prior to 2.5.1 **Description** The plugin is subject to improper output neutralization for logs. The `log js errors()` AJAX handler is registered for unauthenticated users via `wp ajax nopriv log js errors` and is protected only by a nonce. This nonce is publicly disclosed in the HTML of every front-end page through `wp localize script()` when JavaScript error logging is enabled, failing to provide an effective authorization barrier. Unauthenticated attackers can inject forged entries into the WordPress debug log by controlling the `message`, `script`, `lineNo`, `columnNo`, and `pageUrl` variables. This allows for the spoofing of incident records and the obscuring of malicious activity. This issue is only exploitable if the JavaScript error logging feature is enabled. **Recommendations** Update to a version later than 2.5.0. As a temporary mitigation, disable the JavaScript error logging feature to prevent the nonce from being published in the page HTML.