Erdemstar

**Name of the Vulnerable Software and Affected Versions** Alemha watermarker WordPress plugin versions 1.3.1 and earlier **Description** The issue allows high privilege users, such as admins, to perform Stored Cross-Site Scripting attacks, even when the unfiltered html capability is disallowed, for example, in a multisite setup. This is due to the plugin not sanitizing and escaping some of its settings. **Recommendations** For versions 1.3.1 and earlier, update to a version that addresses the sanitization and escaping of settings to prevent Stored Cross-Site Scripting attacks. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** Playlist for Youtube WordPress plugin versions 1.32 and earlier **Description** The issue concerns a Stored Cross-Site Scripting attack. High privilege users, such as admins, can exploit this even when the unfiltered html capability is disallowed, for example, in multisite setups. The vulnerability arises from the plugin's failure to sanitise and escape some of its settings. **Recommendations** For versions 1.32 and earlier, update to a version that addresses this issue. As a temporary workaround, consider restricting the ability of high privilege users to modify plugin settings until a patch is available. Avoid using potentially malicious input in settings such as the Playlist Name and Video size.