Muhamad Hidayat

**Name of the Vulnerable Software and Affected Versions** Chatter versions n/a through 1.0.1 **Description** The issue is related to a Missing Authorization vulnerability. This vulnerability affects the Chatter software. **Recommendations** For versions n/a through 1.0.1, update to a version later than 1.0.1 to resolve the issue. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** Print, PDF, Email by PrintFriendly WordPress plugin versions prior to 5.2.3 **Description** The issue allows high privilege users, such as admins, to perform cross-Site Scripting attacks. This is due to the plugin not sanitizing and escaping the Custom Button Text settings, which can be exploited even when the unfiltered html capability is disallowed. **Recommendations** For versions prior to 5.2.3, update to version 5.2.3 or later to resolve the issue. As a temporary workaround, consider restricting access to the Custom Button Text settings to minimize the risk of exploitation.

**Name of the Vulnerable Software and Affected Versions** JivoChat Live Chat WordPress plugin versions prior to 1.3.5.4 **Description** The issue arises from the plugin's failure to properly check CSRF tokens on POST requests to its admin page and its lack of sanitization for certain parameters. This leads to a stored Cross-Site Scripting vulnerability, allowing an attacker to trick a logged-in administrator into injecting arbitrary JavaScript. **Recommendations** For versions prior to 1.3.5.4, update to version 1.3.5.4 or later to resolve the issue. As a temporary workaround, consider restricting access to the plugin's admin page to minimize the risk of exploitation.

**Name of the Vulnerable Software and Affected Versions** AdRotate WordPress plugin versions prior to 5.8.23 **Description** The issue allows high privilege users to perform Cross-Site Scripting attacks even when the unfiltered html capability is disallowed, due to the plugin not escaping Group Names. **Recommendations** For versions prior to 5.8.23, update to version 5.8.23 or later to resolve the issue. As a temporary workaround, consider restricting the ability of high privilege users to input Group Names until the update is applied.

**Name of the Vulnerable Software and Affected Versions** AdRotate WordPress plugin versions prior to 5.8.23 **Description** The issue allows high privilege users to perform Cross-Site Scripting attacks due to the lack of sanitization and escaping of Advert Names, even when the unfiltered html capability is disallowed. **Recommendations** For versions prior to 5.8.23, update to version 5.8.23 or later to resolve the issue. As a temporary workaround, consider restricting the ability to create or edit Advert Names to trusted users only until the update is applied.

**Name of the Vulnerable Software and Affected Versions** ThirstyAffiliates WordPress plugin versions prior to 3.10.5 **Description** The issue lacks authorization checks in the `ta insert external image` action, allowing a low-privilege user to add an image from an external URL to an affiliate link. Additionally, it lacks csrf checks, enabling an attacker to trick a logged-in user into performing the action by crafting a special request. **Recommendations** For versions prior to 3.10.5, update to version 3.10.5 or later to resolve the issue. As a temporary workaround, consider restricting access to the `ta insert external image` action to prevent unauthorized use.

**Name of the Vulnerable Software and Affected Versions** Easy Digital Downloads WordPress plugin versions prior to 2.11.6 **Description** The issue concerns the lack of sanitization and escaping of the `Downloadable File Name` in the Logs, potentially allowing high-privilege users to perform Cross-Site Scripting attacks when the `unfiltered html` capability is disallowed. **Recommendations** For versions prior to 2.11.6, update to version 2.11.6 or later to resolve the issue.

**Name of the Vulnerable Software and Affected Versions** Easy Digital Downloads versions prior to 2.11.6 **Description** The issue concerns a lack of CSRF check when inserting payment notes, potentially allowing attackers to make a logged admin insert arbitrary notes via a CSRF attack. **Recommendations** For versions prior to 2.11.6, update to version 2.11.6 or later to resolve the issue. As a temporary workaround, consider restricting access to the payment notes insertion functionality to minimize the risk of exploitation.

**Name of the Vulnerable Software and Affected Versions** Simple Membership WordPress plugin versions prior to 4.1.0 **Description** The issue concerns the lack of a CSRF check when deleting transactions, which could allow attackers to make a logged-in admin delete arbitrary transactions via a CSRF attack. **Recommendations** For versions prior to 4.1.0, update to version 4.1.0 or later to resolve the issue.

**Name of the Vulnerable Software and Affected Versions** Amelia WordPress plugin versions prior to 1.0.47 **Description** The issue concerns a lack of CSRF check when deleting customers, which could allow attackers to make a logged-in admin delete arbitrary customers via a CSRF attack. **Recommendations** For versions prior to 1.0.47, update to version 1.0.47 or later to resolve the issue. As a temporary workaround, consider restricting access to the customer deletion functionality to minimize the risk of exploitation.