João Pedro S Alcântara

**Name of the Vulnerable Software and Affected Versions** Kalles Addons versions prior to 1.0.7 **Description** The Kalles Addons plugin for WordPress is susceptible to PHP Object Injection due to the deserialization of untrusted input. This allows unauthenticated attackers to inject a PHP Object. The impact of this issue depends on the presence of a POP chain (a sequence of gadgets used to achieve code execution or other malicious actions) within other installed plugins or themes. If such a chain exists, an attacker could potentially delete arbitrary files, retrieve sensitive data, or execute code. **Recommendations** Update the plugin to a version later than 1.0.6.

**Name of the Vulnerable Software and Affected Versions** WPeMatico RSS Feed Fetcher versions prior to 2.8.18 **Description** The WPeMatico RSS Feed Fetcher plugin for WordPress contains a stored Cross-Site Scripting (XSS) flaw. This issue occurs because the software fails to properly sanitize input and escape output, allowing unauthenticated attackers to inject arbitrary web scripts into pages. These scripts execute automatically when a user visits the affected page. **Recommendations** Update WPeMatico RSS Feed Fetcher to a version newer than 2.8.17.

**Name of the Vulnerable Software and Affected Versions** Kids Life | Children School WordPress versions prior to 5.3 **Description** Stored Cross-Site Scripting (XSS) occurs due to insufficient input sanitization and output escaping. This allows unauthenticated attackers to inject arbitrary web scripts into pages, which execute when a user accesses the affected page. **Recommendations** Update Kids Life | Children School WordPress to a version newer than 5.2.

**Name of the Vulnerable Software and Affected Versions** NativeChurch versions prior to 4.8.8.3 **Description** An unauthenticated Cross Site Scripting (XSS) issue exists, allowing attackers to execute malicious scripts without authentication. **Recommendations** Update NativeChurch to a version newer than 4.8.8.2.

**Name of the Vulnerable Software and Affected Versions** LMS versions prior to 9.8 **Description** An unauthenticated Cross Site Scripting (XSS) issue exists, allowing an attacker to execute malicious scripts in the victim's browser without requiring authentication. **Recommendations** Update to a version newer than 9.7.

**Name of the Vulnerable Software and Affected Versions** Werkstatt versions prior to 4.8.4 **Description** The Werkstatt - Creative Portfolio WordPress Theme is susceptible to PHP Object Injection, a condition where untrusted input is deserialized, allowing an attacker to inject a PHP Object. This issue affects authenticated users with contributor-level access and above. While no native POP chain (a sequence of gadgets used to achieve code execution) is present in the software, the presence of a POP chain via other installed plugins or themes could enable the deletion of arbitrary files, retrieval of sensitive data, or remote code execution. **Recommendations** Update to a version newer than 4.8.3.

**Name of the Vulnerable Software and Affected Versions** Automotive Car Dealership Business versions prior to 13.3.4 **Description** An unauthenticated Cross Site Scripting (XSS) issue exists, allowing an attacker to execute malicious scripts in the browser of a user without requiring authentication. **Recommendations** Update to a version newer than 13.3.3.

**Name of the Vulnerable Software and Affected Versions** Link Whisper Free versions prior to 0.9.5 **Description** Unauthenticated Cross Site Scripting (XSS) allows an attacker to execute malicious scripts in the browser of a user without requiring authentication. **Recommendations** Update Link Whisper Free to version 0.9.5 or later.

**Name of the Vulnerable Software and Affected Versions** Jobify versions prior to 4.3.3 **Description** An unauthenticated Cross Site Scripting (XSS) issue exists, which allows an attacker to execute malicious scripts in the browser of a user without requiring prior authentication. **Recommendations** Update to a version newer than 4.3.2.

**Name of the Vulnerable Software and Affected Versions** Real Estate 7 versions prior to 3.5.10 **Description** An unauthenticated Cross Site Scripting (XSS) issue exists, which allows an attacker to execute malicious scripts in the browser of a user without requiring prior authentication. **Recommendations** Update Real Estate 7 to version 3.5.10 or later.

**Name of the Vulnerable Software and Affected Versions** WofficeIO Woffice versions prior to 5.4.33 **Description** An issue exists where incorrectly configured access control security levels lead to missing authorization, allowing for potential exploitation. **Recommendations** Update WofficeIO Woffice to version 5.4.33 or later.

**Name of the Vulnerable Software and Affected Versions** Pearl - Corporate Business versions prior to 3.4.11 **Description** An unauthenticated Local File Inclusion (LFI) issue exists, which allows an attacker to read files from the local file system without requiring authentication. **Recommendations** Update Pearl - Corporate Business to a version newer than 3.4.10.

**Name of the Vulnerable Software and Affected Versions** Automotive Listings versions prior to 18.7 **Description** Reflected Cross-Site Scripting occurs due to insufficient input sanitization and output escaping. This allows unauthenticated attackers to inject arbitrary web scripts into pages, which execute when a user is tricked into performing an action, such as clicking a link. **Recommendations** Update to a version newer than 18.6.

**Name of the Vulnerable Software and Affected Versions** TheFox versions prior to 3.9.77 **Description** The TheFox theme for WordPress is subject to Reflected Cross-Site Scripting (XSS), a flaw where malicious scripts are reflected off a web application to the victim's browser. This occurs due to insufficient input sanitization and output escaping, allowing unauthenticated attackers to inject arbitrary web scripts into pages. These scripts execute if a user is tricked into performing an action, such as clicking a malicious link. **Recommendations** Update to a version newer than 3.9.76.

**Name of the Vulnerable Software and Affected Versions** Real Estate 7 versions prior to 3.6.0 **Description** An unauthenticated Cross-Site Request Forgery (CSRF) issue exists in the Real Estate 7 WordPress theme. This occurs due to missing or incorrect nonce validation—a security mechanism used to ensure that a request was intentionally sent by the user—within a function. This allows an attacker to perform unauthorized actions by tricking a site administrator into clicking a malicious link. **Recommendations** Update to a version newer than 3.5.9.

**Name of the Vulnerable Software and Affected Versions** Neve PRO versions prior to 3.1.3 **Description** Cross Site Scripting (XSS) exists in the software, allowing users with contributor-level permissions to execute malicious scripts in the browser of other users. **Recommendations** Update Neve PRO to version 3.1.3 or later.

**Name of the Vulnerable Software and Affected Versions** SeedProd Pro versions prior to 6.19.5 **Description** Stored Cross-Site Scripting occurs due to insufficient input sanitization and output escaping. Authenticated attackers with contributor-level access and above can inject arbitrary web scripts into pages, which execute when a user accesses the affected page. **Recommendations** Update SeedProd Pro to version 6.19.5 or later.

**Name of the Vulnerable Software and Affected Versions** Blog2Social versions prior to 8.9.3 **Description** An unauthenticated Cross Site Scripting (XSS) issue exists, which allows an attacker to execute malicious scripts in the browser of a user without requiring prior authentication. **Recommendations** Update Blog2Social to version 8.9.3 or later.

**Name of the Vulnerable Software and Affected Versions** Master Slider versions prior to 3.11.3 **Description** An unauthenticated cross-site scripting (XSS) flaw exists in the web-facing input handling. The issue stems from improper input validation and output encoding, which allows attacker-supplied content to be rendered as an active script in the browser. A remote attacker can inject malicious payloads into exposed parameters or fields without authentication. If an administrator or user interacts with the crafted content, it can lead to session hijacking, admin account takeover via stolen cookies or nonces, and malicious redirects. **Recommendations** At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** Real Estate 7 versions prior to 3.6.0 **Description** An unauthenticated SQL Injection exists due to insufficient escaping of user-supplied parameters and a lack of proper preparation of SQL queries. This allows attackers to append additional SQL queries to existing ones to extract sensitive information from the database. **Recommendations** Update Real Estate 7 to a version newer than 3.5.9.