Pasindu Dilshan

**Name of the Vulnerable Software and Affected Versions** UsersWP versions prior to 1.2.64 **Description** The UsersWP plugin for WordPress contains an Insecure Direct Object Reference (IDOR), which occurs when an application provides direct access to objects based on user-supplied input. The issue exists due to missing validation on a user-controlled key within the `user id` parameter. This allows authenticated attackers with editor-level access or higher to reset and permanently delete the avatar or banner image of any user, including administrators, by clearing the `avatar thumb` or `banner thumb` metadata in the `uwp usermeta` table. **Recommendations** Update the plugin to a version later than 1.2.63. As a temporary workaround, restrict access to the `user id` parameter for users with editor-level permissions until the update is applied.

**Name of the Vulnerable Software and Affected Versions** Blocksy Companion versions prior to 2.1.46 **Description** The Blocksy Companion plugin for WordPress contains a Stored Cross-Site Scripting issue within the admin settings caused by insufficient input sanitization and output escaping. This allows authenticated attackers with editor-level permissions or higher to inject arbitrary web scripts into pages. These scripts execute when a user accesses the affected page. This issue specifically impacts multi-site installations and environments where `unfiltered html` has been disabled. **Recommendations** Update to a version later than 2.1.45.