Park Hyun Woo

**Name of the Vulnerable Software and Affected Versions** FunnelKit Payment Gateway for Stripe WooCommerce versions prior to 1.14.0.4 **Description** An unauthenticated Cross-Site Request Forgery (CSRF) issue exists in the FunnelKit Payment Gateway for Stripe WooCommerce plugin for WordPress. This occurs due to missing or incorrect nonce validation—a security token used to verify that a request was intentionally sent by the user—within a function. This allows an attacker to perform unauthorized actions by tricking a site administrator into clicking a malicious link. **Recommendations** Update the plugin to a version newer than 1.14.0.3.

**Name of the Vulnerable Software and Affected Versions** Recipe Maker For Your Food Blog from Zip Recipes versions prior to 8.2.8 **Description** A SQL Injection issue exists that allows exploitation at the contributor level. SQL Injection is a technique where an attacker inserts malicious SQL code into a query, potentially allowing them to manipulate the database. **Recommendations** Update to a version newer than 8.2.7.

**Name of the Vulnerable Software and Affected Versions** Advanced Order Export For WooCommerce versions prior to 4.1.0 **Description** Stored Cross-Site Scripting occurs due to insufficient input sanitization and output escaping. This allows authenticated attackers with customer-level access and above to inject arbitrary web scripts into pages, which execute when a user accesses the affected page. **Recommendations** Update Advanced Order Export For WooCommerce to a version newer than 4.0.9.

**Name of the Vulnerable Software and Affected Versions** CorvusPay WooCommerce Payment Gateway versions prior to 2.7.5 **Description** The CorvusPay WooCommerce Payment Gateway plugin for WordPress contains a broken authentication flaw. This issue occurs because of a missing capability check in a function, allowing unauthenticated attackers to perform unauthorized actions. **Recommendations** Update CorvusPay WooCommerce Payment Gateway to version 2.7.5 or later.

**Name of the Vulnerable Software and Affected Versions** UPI QR Code Payment Gateway for WooCommerce versions prior to 1.6.3 **Description** The UPI QR Code Payment Gateway for WooCommerce plugin for WordPress contains a broken access control flaw. This issue occurs due to a missing capability check within a function, allowing authenticated users with customer-level permissions or higher to perform unauthorized actions. **Recommendations** Update the plugin to a version newer than 1.6.2.

**Name of the Vulnerable Software and Affected Versions** Stylish Cost Calculator versions prior to 8.4.0 **Description** An unauthenticated broken access control issue exists, allowing unauthorized users to bypass access restrictions. **Recommendations** Update to a version newer than 8.3.9.

**Name of the Vulnerable Software and Affected Versions** Registration Form for WooCommerce versions prior to 1.1.0 **Description** An issue exists in the Registration Form for WooCommerce plugin for WordPress that allows unauthenticated attackers to elevate their privileges to those of an administrator. **Recommendations** Update the plugin to a version newer than 1.0.9.

**Name of the Vulnerable Software and Affected Versions** Falang multilanguage versions prior to 1.4.3 **Description** The Falang multilanguage plugin for WordPress allows authenticated attackers with Subscriber-level access or higher to elevate their privileges. **Recommendations** Update to a version newer than 1.4.2.

**Name of the Vulnerable Software and Affected Versions** WP Engine Faust.Js versions prior to 1.8.8 **Description** An authentication bypass exists in WP Engine Faust.Js through the use of an alternate path or channel, which allows for the exploitation of the password recovery process. **Recommendations** Update to version 1.8.8 or later.

**Name of the Vulnerable Software and Affected Versions** SePay Gateway versions prior to 1.1.21 **Description** A missing authorization issue in the SePay Gateway allows for the retrieval of embedded sensitive data. **Recommendations** Update to a version later than 1.1.20.