Marcin Motwicki

**Name of the Vulnerable Software and Affected Versions** DRIMO CMS (affected versions not specified) **Description** Reflected Cross-Site Scripting (XSS) occurs in the searching functionality. An attacker can craft a URL containing a malicious payload in the `q` parameter that, when accessed by a victim, executes arbitrary JavaScript in their browser. **Recommendations** Delete the `info.php` file to mitigate the issue. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** Cooked Pro WordPress plugin versions prior to 1.7.5.7 **Description** The issue arises from improper validation and sanitization of the `recipe args` parameter before unserializing it in the "cooked loadmore" action. This allows an unauthenticated attacker to trigger a PHP Object injection issue. **Recommendations** For versions prior to 1.7.5.7, update to version 1.7.5.7 or later to resolve the issue. As a temporary workaround, consider restricting access to the "cooked loadmore" action to minimize the risk of exploitation.