Jorge Diaz

**Name of the Vulnerable Software and Affected Versions** Stylish Google Sheet Reader versions n/a through 4.0 **Description** The issue is related to Improper Neutralization of Input During Web Page Generation, also known as Cross-site Scripting, allowing Reflected XSS. This enables potential attackers to inject malicious scripts into web pages. **Recommendations** For versions n/a through 4.0, update to a version that includes a fix for this issue, as using an affected version poses a significant risk. As a temporary workaround, consider restricting access to sensitive data and input validation to minimize the risk of exploitation.

**Name of the Vulnerable Software and Affected Versions** ProductDyno versions 1.0.0 through 1.0.24 **Description** The issue is related to improper neutralization of input during web page generation, also known as 'Cross-site Scripting'. This allows for Reflected XSS. **Recommendations** For versions 1.0.0 through 1.0.24, update to a version later than 1.0.24 to resolve the issue. As a temporary workaround, consider restricting user input to minimize the risk of exploitation.

**Name of the Vulnerable Software and Affected Versions** W3 Eden, Inc. Premium Packages versions n/a through 5.9.3 **Description** The issue is related to an SQL Injection vulnerability due to improper neutralization of special elements used in an SQL command. This allows for SQL Injection attacks. **Recommendations** For versions n/a through 5.9.3, update to a version later than 5.9.3 to resolve the issue. As a temporary workaround, consider restricting access to sensitive database operations to minimize the risk of exploitation. Avoid using user-supplied input in SQL commands until the issue is resolved.

**Name of the Vulnerable Software and Affected Versions** WPExperts Square For GiveWP versions 1.3 and earlier **Description** The issue is related to an SQL Injection vulnerability due to improper neutralization of special elements used in an SQL command. This allows for SQL Injection attacks. **Recommendations** For WPExperts Square For GiveWP versions 1.3 and earlier, at the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** MagePeople Team Multipurpose Ticket Booking Manager versions through 4.2.2 **Description** The issue is related to Improper Neutralization of Input During Web Page Generation, also known as Cross-site Scripting (XSS). This allows for Stored XSS, where an attacker can inject malicious scripts into the website, potentially affecting users. **Recommendations** For Multipurpose Ticket Booking Manager versions through 4.2.2, update to a version later than 4.2.2 to resolve the issue. As a temporary workaround, consider restricting user input to prevent malicious script injection until a patch is available.

**Name of the Vulnerable Software and Affected Versions** Vladimir Statsenko Terms descriptions versions n/a through 3.4.6 **Description** The issue is related to Improper Neutralization of Input During Web Page Generation, also known as Cross-site Scripting (XSS). This allows for Stored XSS, where an attacker can inject malicious scripts into the website, which are then stored and executed by the website. The estimated number of potentially affected devices worldwide is not provided. There is no information about real-world incidents where this issue was exploited. **Recommendations** For versions n/a through 3.4.6, update to a version later than 3.4.6 to resolve the issue. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Name of the Vulnerable Software and Affected Versions: MC4WP: Mailchimp for WordPress plugin for WordPress versions up to, and including, 4.9.16 Description: The issue is related to Stored Cross-Site Scripting via admin settings due to insufficient input sanitization and output escaping. This allows authenticated attackers with administrator-level permissions and above to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. The issue only affects multi-site installations and installations where unfiltered html has been disabled. Recommendations: For versions up to, and including, 4.9.16, update to a version higher than 4.9.16 to resolve the issue. As a temporary workaround, consider restricting access to admin settings to minimize the risk of exploitation. Additionally, enabling unfiltered html, if possible, may also mitigate the risk, but this should be done with caution and careful consideration of the potential security implications.

Name of the Vulnerable Software and Affected Versions: Manu225 Flipping Cards versions n/a through 1.30 Description: The issue is related to Improper Neutralization of Input During Web Page Generation, also known as Cross-site Scripting (XSS). This allows for Stored XSS attacks. Recommendations: For Manu225 Flipping Cards versions n/a through 1.30, consider disabling the input fields that allow user-generated content until a patch is available to prevent Stored XSS attacks. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** Cloudways Breeze versions through 2.1.3 **Description** The issue is related to improper neutralization of input during web page generation, which allows for Stored XSS. This means an attacker could inject malicious scripts into the website, potentially affecting users who visit the compromised page. **Recommendations** For versions through 2.1.3, update to a version later than 2.1.3 to resolve the issue. At the moment, there is no information about additional mitigation measures for this specific issue.