Navapon Premkasem

**Name of the Vulnerable Software and Affected Versions** Kirki – Freeform Page Builder, Website Builder & Customizer versions prior to 6.2.1 **Description** Insufficient input sanitization and output escaping in the `post meta` Shortcode allow authenticated attackers with Contributor-level access or higher to perform Stored Cross-Site Scripting. This enables the injection of arbitrary web scripts into pages, which execute when a user visits the affected page. **Recommendations** Update to a version newer than 6.2.0.

**Name of the Vulnerable Software and Affected Versions** The Simple JWT Login – Allows you to use JWT on REST endpoints. versions prior to 3.6.7 **Description** An authentication bypass leading to privilege escalation exists due to improper handling of identity claims. The `AuthenticateService::generatePayload()` function only overwrites JWT payload keys defined in the admin-configured `jwt payload` list, allowing attacker-supplied claims like `email`, `id`, or `username` to remain intact and signed. Authenticated attackers with subscriber-level access or higher can escalate their privileges to Administrator by injecting a target administrator's email address into the `payload` parameter at the '/wp-json/simple-jwt-login/v1/auth' endpoint and subsequently redeeming the JWT at the '/autologin' endpoint. **Recommendations** Update to a version newer than 3.6.6. As a temporary mitigation, restrict access to the '/wp-json/simple-jwt-login/v1/auth' and '/autologin' endpoints or avoid using the `payload` parameter.