Hieus

**Name of the Vulnerable Software and Affected Versions** SigmaForms Pro – AI Generated Forms versions prior to 1.4.12 **Description** Insufficient file path validation in the `delete submission files()` function allows unauthenticated attackers to delete arbitrary files on the server. This is achieved by submitting a malicious path traversal URL via a form upload field, which is then stored in the database. The deletion is triggered when an administrator removes the submission record from the admin panel. Deleting critical files, such as `wp-config.php`, can lead to remote code execution. **Recommendations** Update SigmaForms Pro – AI Generated Forms to version 1.4.12 or later. As a temporary mitigation, restrict the use of the `delete submission files()` function until the update is applied.

**Name of the Vulnerable Software and Affected Versions** wpDiscuz versions prior to 7.6.60 **Description** The plugin fails to properly escape a user-supplied URL before outputting it within an HTML attribute. This allows unauthenticated users to perform Stored Cross-Site Scripting (XSS), a technique where malicious scripts are permanently stored on the target server, which then execute in the browser of any user, including administrators, who views the affected content. **Recommendations** Update wpDiscuz to version 7.6.60 or later.