P3N7A90N

**Name of the Vulnerable Software and Affected Versions** Elementor Website Builder WordPress plugin versions prior to 3.12.2 **Description** The issue arises from improper sanitization and escaping of the `Replace URL` parameter in the Tools module, which is used in a SQL statement. This leads to a SQL injection that can be exploited by users with the Administrator role. **Recommendations** For versions prior to 3.12.2, update to version 3.12.2 or later to resolve the issue. As a temporary workaround, consider restricting access to the Tools module for users with the Administrator role until the update is applied.

**Name of the Vulnerable Software and Affected Versions** AnyWhere Elementor WordPress plugin versions prior to 1.2.8 **Description** The issue allows an attacker to obtain a Freemius Secret Key, which could be used to purchase the pro subscription using test credit card numbers without actually paying the amount. The key in question has been revoked. **Recommendations** For versions prior to 1.2.8, update to version 1.2.8 or later to resolve the issue. As a temporary workaround, consider restricting access to the plugin's subscription functionality until the update is applied.

**Name of the Vulnerable Software and Affected Versions** Import all XML, CSV & TXT WordPress plugin versions prior to 6.5.8 **Description** The issue is related to the improper sanitization and escaping of imported data, which is then used in SQL statements. This leads to SQL injection, a type of attack where an attacker can execute malicious SQL code. The exploitation of this issue is possible by high-privilege users, such as administrators. **Recommendations** For versions prior to 6.5.8, update to version 6.5.8 or later to resolve the issue. As a temporary workaround, consider restricting the import functionality to minimize the risk of exploitation. Avoid using the import feature with untrusted data until the issue is resolved.

**Name of the Vulnerable Software and Affected Versions** Import all XML, CSV & TXT WordPress plugin versions prior to 6.5.8 **Description** The issue concerns a lack of authorization in certain areas of the plugin, potentially allowing any authenticated users to access specific features if they obtain the related nonce. **Recommendations** For versions prior to 6.5.8, update to version 6.5.8 or later to resolve the issue.