Grant Grubbs

**Name of the Vulnerable Software and Affected Versions** PixelYourSite – Your smart PIXEL (TAG) & API Manager versions up to and including 9.7.1 PixelYourSite PRO versions up to and including 10.4.2 **Description** The vulnerability allows unauthenticated attackers to view potentially sensitive information contained in publicly exposed log files and to delete log files. This issue affects the PixelYourSite and PixelYourSite PRO plugins for WordPress. **Recommendations** For PixelYourSite – Your smart PIXEL (TAG) & API Manager versions up to and including 9.7.1, update to a version later than 9.7.1 to resolve the issue. For PixelYourSite PRO versions up to and including 10.4.2, update to a version later than 10.4.2 to resolve the issue. As a temporary workaround, consider restricting access to the publicly exposed log files to minimize the risk of exploitation.

Name of the Vulnerable Software and Affected Versions: Brizy – Page Builder plugin for WordPress versions up to, and including, 2.5.1 Description: The issue is due to missing or incorrect nonce validation on form submissions, making it possible for unauthenticated attackers to submit forms intended for public use as another user via a forged request. This can happen if an attacker can trick a site administrator into performing an action such as clicking on a link. On sites where unfiltered html is enabled, this can lead to the admin unknowingly adding a Stored Cross-Site Scripting payload. Recommendations: For versions up to, and including, 2.5.1, update to a version that includes the fix for the missing or incorrect nonce validation issue. As a temporary workaround, consider restricting access to form submissions to minimize the risk of exploitation. Additionally, disabling unfiltered html on sites where it is not necessary can help prevent the addition of Stored Cross-Site Scripting payloads.