Or Benit

**Name of the Vulnerable Software and Affected Versions** GenerateBlocks versions prior to 2.3.1 **Description** Insufficient input sanitization and output escaping allow authenticated attackers with contributor-level access and above to perform Stored Cross-Site Scripting (XSS). An attacker can inject arbitrary web scripts by placing a dynamic tag, such as `{{post meta key:...}}`, into non-URL HTML attributes (including `title`, `aria-label`, `alt`, or `data-*` attributes) of a block element. The payload is stored by setting the corresponding unprotected post meta key via the Custom Fields metabox to a value containing a closing quote and an injected event-handler attribute, which executes when a user accesses the affected page. **Recommendations** Update to a version newer than 2.3.0.

**Name of the Vulnerable Software and Affected Versions** The Photo Gallery by 10Web – Mobile-Friendly Image Gallery versions prior to 1.8.41 **Description** An issue exists due to insufficient escaping of user-supplied parameters and lack of preparation in SQL queries. Authenticated attackers with contributor-level access or higher can perform a time-based blind SQL Injection—a technique used to extract information from a database by observing the time it takes for the server to respond to specific queries. This is achieved by embedding a malicious shortcode in a post or draft, which executes the injected SQL when the shortcode is rendered via the `order by` parameter. **Recommendations** Update the plugin to a version later than 1.8.40. Avoid using the `order by` parameter in shortcodes until the update is applied.

Name of the Vulnerable Software and Affected Versions Download Manager plugin for WordPress versions up to and including 3.3.51 Description The Download Manager plugin for WordPress is susceptible to unauthorized data modification. This is due to a missing capability check in the `makeMediaPublic()` and `makeMediaPrivate()` functions. These functions only verify the `edit posts` capability, failing to confirm post ownership using `current user can('edit post', $id)`. The destructive operations occur before the admin-level check in `mediaAccessControl()`. Authenticated attackers with Contributor-level access or higher can remove protection metadata (passwords, access restrictions, private flags) from any media file, even those they do not own, making admin-protected files publicly accessible via their direct URL. Recommendations Update to a version beyond 3.3.51.

**Name of the Vulnerable Software and Affected Versions** Enable Media Replace plugin for WordPress versions through 4.1.7 **Description** The Enable Media Replace plugin for WordPress has a flaw that allows unauthorized modification of data. This is due to an insufficient capability check within the `RemoveBackGroundViewController::load` function. Authenticated attackers with Author-level access or higher can replace any attachment with a removed background attachment. **Recommendations** Update the Enable Media Replace plugin to a version later than 4.1.7.