Normaandersonfrank

The Media Library Assistant plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'mla link attributes' parameter in all versions up to, and including, 3.35 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.

**Name of the Vulnerable Software and Affected Versions** Xpro Addons versions prior to 1.5.2 **Description** The Xpro Addons plugin for WordPress contains a flaw allowing unauthorized data creation due to a missing capability check in the `get menu content editor()` function. Authenticated users with Subscriber-level access or higher can create arbitrary published posts of the `xpro content` custom post type using titles they control. These posts are publicly accessible on the front-end, which can lead to content injection, SEO spam, and database pollution. **Recommendations** Update the plugin to version 1.5.2 or later. As a temporary workaround, restrict access to the `get menu content editor()` function to prevent unauthorized users from creating content.

**Name of the Vulnerable Software and Affected Versions** Smash Balloon Social Photo Feed – Easy Social Feeds Plugin versions prior to 6.11.2 **Description** Cross-Site Request Forgery occurs due to missing or incorrect nonce validation in the `maybe connection data()` function. This allows unauthenticated attackers to overwrite Instagram and Facebook oEmbed access tokens using the `sbi access token` parameter by tricking a site administrator into clicking a malicious link. Nonce validation is a security measure used to ensure that a request was intentionally sent by the user and not forged by a third party. **Recommendations** Update Smash Balloon Social Photo Feed – Easy Social Feeds Plugin to version 6.11.2 or later.