Huazu Jiang

**Name of the Vulnerable Software and Affected Versions** Members – Membership & User Role Editor Plugin versions prior to 3.2.23 **Description** An issue exists that allows unauthenticated attackers to expose sensitive information through the `members filter protected posts for rest` function. This flaw enables the determination of the existence and exact count of access-restricted posts. Furthermore, attackers can utilize per-page pagination as a boolean oracle—a technique where a binary response (true/false) is used to deduce hidden data—to infer keywords and content within these restricted posts. **Recommendations** Update the plugin to a version newer than 3.2.22.

**Name of the Vulnerable Software and Affected Versions** Xpro Addons — 140+ Widgets for Elementor versions prior to 1.7.3 **Description** Stored Cross-Site Scripting occurs due to insufficient input sanitization and output escaping. Authenticated attackers with author-level access and above can inject arbitrary web scripts into pages via the `custom attributes` parameter. These scripts execute whenever a user accesses the affected page. **Recommendations** Update Xpro Addons — 140+ Widgets for Elementor to version 1.7.3 or later. As a temporary mitigation, restrict access to the `custom attributes` parameter for users with author-level permissions.