Nixxies

**Name of the Vulnerable Software and Affected Versions** VillaTheme AFFI – Affiliate Marketing for WooCommerce versions prior to 1.1.0 **Description** Missing authorization in the `affi-affiliate-marketing-for-woo` component allows for the exploitation of incorrectly configured access control security levels, leading to broken access control. **Recommendations** Update VillaTheme AFFI – Affiliate Marketing for WooCommerce to version 1.1.0 or later.

**Name of the Vulnerable Software and Affected Versions** REST API Log versions prior to 1.7.3 **Description** An Insecure Direct Object Reference (IDOR) exists in the REST API, allowing unauthenticated users to access objects directly by manipulating identifiers. IDOR is a type of access control flaw where an application provides direct access to objects based on user-supplied input. **Recommendations** Update REST API Log to a version newer than 1.7.2.

Subscriber Broken Access Control in WP Project Manager <= 4.0.7 versions.

Contributor Cross Site Scripting (XSS) in PublishPress Series <= 3.1.3 versions.

Contributor Insecure Direct Object References (IDOR) in Cooked <= 1.16.0 versions.