Nguyen Ba Khanh

**Name of the Vulnerable Software and Affected Versions** NotificationX Pro versions prior to 3.1.5 **Description** Insufficient input sanitization and output escaping allow unauthenticated attackers to perform Stored Cross-Site Scripting (XSS), a technique where malicious scripts are permanently stored on a target server. This enables the injection of arbitrary web scripts into pages, which execute automatically when a user accesses the affected page. **Recommendations** Update NotificationX Pro to a version newer than 3.1.4.

**Name of the Vulnerable Software and Affected Versions** Blocksy Companion Pro plugin for WordPress versions prior to 2.1.47 **Description** An unauthenticated arbitrary file upload issue exists within the Advanced Reviews feature. The `save attachments()` function fails to properly validate file extensions, specifically due to a flawed `strpos()` substring check in the Custom Fonts extension. An attacker can bypass this validation by using double-extension filenames, such as `shell.woff2.php`, allowing the upload of executable files that the web server processes as PHP, leading to remote code execution. **Recommendations** Update Blocksy Companion Pro plugin for WordPress to version 2.1.47 or later.

**Name of the Vulnerable Software and Affected Versions** Admin and Site Enhancements (ASE) Pro versions prior to 8.8.6 **Description** An unauthenticated Cross Site Scripting (XSS) issue exists, which allows an attacker to execute malicious scripts in the browser of a user without requiring prior authentication. **Recommendations** Update Admin and Site Enhancements (ASE) Pro to version 8.8.6 or later.

**Name of the Vulnerable Software and Affected Versions** Survey Maker versions prior to 5.2.2.6 **Description** An unauthenticated Cross Site Scripting (XSS) issue exists, which allows an attacker to execute malicious scripts in the browser of a user without requiring prior authentication. **Recommendations** Update to a version newer than 5.2.2.5.

**Name of the Vulnerable Software and Affected Versions** Kit (formerly ConvertKit) for WooCommerce versions prior to 2.1.6 **Description** An unauthenticated sensitive data exposure issue exists in the plugin, allowing unauthorized users to access confidential information without providing credentials. **Recommendations** Update the plugin to a version newer than 2.1.5.

**Name of the Vulnerable Software and Affected Versions** Sendcloud Shipping versions prior to 1.0.30 **Description** Missing authorization allows for the exploitation of incorrectly configured access control security levels. **Recommendations** Update Sendcloud Shipping to version 1.0.30 or later.

**Name of the Vulnerable Software and Affected Versions** wpDataTables versions 6.5.1.1 and earlier **Description** An unauthenticated Cross Site Scripting (XSS) issue exists, allowing an attacker to execute malicious scripts in the browser of a user without requiring prior authentication. **Recommendations** Update wpDataTables to a version later than 6.5.1.1.

**Name of the Vulnerable Software and Affected Versions** Modula - PRO versions prior to 2.10.9 **Description** Stored Cross-Site Scripting occurs due to insufficient input sanitization and output escaping. This allows unauthenticated attackers to inject arbitrary web scripts into pages, which execute when a user accesses the affected page. **Recommendations** Update Modula - PRO to a version newer than 2.10.8.

**Name of the Vulnerable Software and Affected Versions** WowAddons versions prior to 1.6.15 **Description** The Product Addons and Product Options With Custom Fields – WowAddons plugin for WordPress contains a stored Cross-Site Scripting (XSS) flaw. This issue occurs because of insufficient input sanitization and output escaping, allowing unauthenticated attackers to inject arbitrary web scripts into pages. These scripts execute automatically when a user visits the affected page. **Recommendations** Update to a version newer than 1.6.14.

**Name of the Vulnerable Software and Affected Versions** WP Photo Album Plus versions prior to 9.2.02.005 **Description** Stored Cross-Site Scripting occurs due to insufficient input sanitization and output escaping. This allows unauthenticated attackers to inject arbitrary web scripts into pages, which execute when a user accesses the affected page. **Recommendations** Update WP Photo Album Plus to a version newer than 9.2.02.004.

**Name of the Vulnerable Software and Affected Versions** Blocksy Companion Pro versions prior to 2.1.47 **Description** An unauthenticated remote code execution flaw allows an attacker to execute arbitrary code on the site without requiring login credentials. **Recommendations** Update to a version newer than 2.1.46.

**Name of the Vulnerable Software and Affected Versions** WooCommerce Designer Pro versions prior to 1.9.35 **Description** Cross Site Scripting (XSS) allows an attacker with subscriber privileges to execute malicious scripts in the browser of other users. **Recommendations** Update WooCommerce Designer Pro to version 1.9.35 or later.

**Name of the Vulnerable Software and Affected Versions** Automatic versions prior to 3.135.1 **Description** An unauthenticated Cross Site Scripting (XSS) issue exists, which allows an attacker to execute malicious scripts in the browser of a user without requiring prior authentication. **Recommendations** Update to version 3.135.1 or later.

**Name of the Vulnerable Software and Affected Versions** weMail versions prior to 2.1.3 **Description** The weMail – Email Marketing, Newsletter Builder & Email Automations for WooCommerce plugin for WordPress contains a Reflected Cross-Site Scripting (XSS) flaw. This issue occurs due to insufficient input sanitization and output escaping, allowing unauthenticated attackers to inject arbitrary web scripts into pages. The attack is executed if a user is tricked into performing an action, such as clicking a malicious link. **Recommendations** Update the plugin to a version later than 2.1.2.

**Name of the Vulnerable Software and Affected Versions** Exclusive Addons Elementor versions prior to 2.7.9.9 **Description** Improper neutralization of input during web page generation allows for Stored Cross-site Scripting (XSS), a flaw where malicious scripts are permanently stored on the target server and later executed in the browser of an unsuspecting user. **Recommendations** Update Exclusive Addons Elementor to version 2.7.9.9 or later.

**Name of the Vulnerable Software and Affected Versions** JetSmartFilters versions prior to 3.8.4 **Description** An unauthenticated SQL Injection exists in the software. SQL Injection is a type of vulnerability that allows an attacker to interfere with the queries that an application makes to its database, potentially allowing them to view data they are not normally able to retrieve. **Recommendations** Update JetSmartFilters to version 3.8.4 or later.

**Name of the Vulnerable Software and Affected Versions** YMC Filter versions prior to 3.11.5 **Description** Improper neutralization of special elements used in an SQL command allows for SQL Injection. This occurs when the application fails to properly sanitize user-supplied data before incorporating it into a database query, potentially allowing an attacker to manipulate the query logic. **Recommendations** Update YMC Filter to a version newer than 3.11.5.

**Name of the Vulnerable Software and Affected Versions** FOX – Currency Switcher Professional for WooCommerce versions prior to 1.4.9 **Description** Stored Cross-Site Scripting occurs due to insufficient input sanitization and output escaping. This allows unauthenticated attackers to inject arbitrary web scripts into pages, which execute when a user accesses the affected page. **Recommendations** Update to a version newer than 1.4.8.

**Name of the Vulnerable Software and Affected Versions** WorkScout-Core versions prior to 1.7.12 **Description** An issue allows unauthenticated users to perform arbitrary file deletion. This means an attacker can delete files on the server without needing to provide valid login credentials. **Recommendations** Update to a version newer than 1.7.11.

**Name of the Vulnerable Software and Affected Versions** Advanced Ads versions prior to 2.0.22 **Description** Improper Control of Generation of Code (Code Injection) allows Remote Code Inclusion, which occurs when an application allows an attacker to include and execute remote code on the server. **Recommendations** Update to version 2.0.22 or later.