Het Kalariya

**Name of the Vulnerable Software and Affected Versions** Loco Translate WordPress plugin versions prior to 2.8.9 **Description** Insufficient sanitization and escaping of bundle configuration values before they are output on an admin page allows users with translator capabilities or higher to execute Stored Cross-Site Scripting (XSS) attacks against high-privilege users, such as administrators. Stored Cross-Site Scripting is a type of attack where malicious scripts are permanently stored on the target server. **Recommendations** Update the plugin to version 2.8.9 or later.

**Name of the Vulnerable Software and Affected Versions** WP Mobile Menu versions prior to 2.9 **Description** Insufficient nonce verification during the settings import process allows an attacker to perform a cross-site request within an administrator's session to import arbitrary settings. Because these imported values are output unescaped to all visitors, this leads to Stored Cross-Site Scripting (XSS), a condition where malicious scripts are permanently stored on the server and executed in the browsers of users visiting the site. **Recommendations** Update WP Mobile Menu to version 2.9 or later.