Nguyen Quang Truong

**Name of the Vulnerable Software and Affected Versions** affiliate-toolkit versions prior to 3.8.6 **Description** Authenticated attackers with Editor-level access and above can execute arbitrary code on the server. The issue occurs because the plugin utilizes the BladeOne templating engine's `runString()` method, which compiles user-supplied template content into PHP code and executes it via `eval()` without proper sanitization or sandboxing. **Recommendations** Update affiliate-toolkit to version 3.8.6 or later.

Name of the Vulnerable Software and Affected Versions: Import any XML, CSV or Excel File to WordPress plugin versions through 3.9.3 Description: The Import any XML, CSV or Excel File to WordPress plugin for WordPress is susceptible to arbitrary file uploads due to the absence of file type validation during the import process. This allows authenticated attackers with Administrator-level access or higher to upload potentially harmful files, such as `.phar` files, to the server. Successful exploitation may lead to remote code execution. Recommendations: Update to a version beyond 3.9.3.