Ibnu Ubaeydillah

**Name of the Vulnerable Software and Affected Versions** Embed PDF Viewer versions 2.3.1 and earlier **Description** The issue is related to improper neutralization of input during web page generation, which allows for stored Cross-site Scripting (XSS). This means an attacker can inject malicious scripts into the website, potentially affecting users who access the compromised page. The estimated number of potentially affected devices worldwide is not specified. There is no information provided about real-world incidents where this issue was exploited. **Recommendations** For Embed PDF Viewer versions 2.3.1 and earlier, update to a version later than 2.3.1 to resolve the issue. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** NextGEN Gallery versions 3.59.3 and earlier **Description** The issue is related to Improper Neutralization of Input During Web Page Generation, also known as Cross-site Scripting (XSS). This allows for Stored XSS, which can lead to malicious script execution. **Recommendations** For versions 3.59.3 and earlier, update the plugin to a patched version immediately. As a temporary workaround, consider restricting access to sensitive areas of the gallery to minimize the risk of exploitation.

**Name of the Vulnerable Software and Affected Versions** Photo Gallery by Ays versions prior to 5.7.1 **Description** The issue is related to an Improper Neutralization of Special Elements in Output Used by a Downstream Component, also known as an 'Injection' vulnerability, in the Photo Gallery Team Photo Gallery by Ays. This allows for Code Injection. **Recommendations** For versions prior to 5.7.1, update to version 5.7.1 or later to resolve the issue.