Pb>Sec

**Name of the Vulnerable Software and Affected Versions** Modula Image Gallery – Photo Grid & Video Gallery versions prior to 3.0.3 **Description** Insufficient file path validation in the `upload image()` function allows authenticated attackers with author-level access or higher to delete arbitrary files on the server. The restriction to the wp-content/uploads directory is ineffective because all user attachment files are located within that directory, and users with the Author role can easily bypass the `edit post` check on their own galleries. **Recommendations** Update Modula Image Gallery – Photo Grid & Video Gallery to version 3.0.3 or later. As a temporary mitigation, restrict access to the `upload image()` function for users with Author-level permissions.

**Name of the Vulnerable Software and Affected Versions** Download Manager versions prior to 3.3.69 **Description** An Insecure Direct Object Reference (IDOR) exists in the `duplicate()` function hooked on `admin init`. The issue occurs because the handler verifies only the generic `edit posts` capability and a static nonce (`NONCE KEY`) without performing object-level authorization checks against the targeted `wpdmpro` package ID. Authenticated attackers with Author-level access or higher can duplicate arbitrary packages owned by other users, including administrators. This process copies all package metadata, such as protected file references, role-based access restrictions, and password lock settings, into a clone owned by the attacker, who can then remove restrictions to access protected files. **Recommendations** Update to a version newer than 3.3.68. As a temporary mitigation, restrict users with Author-level access from accessing the administrative functions related to the `duplicate()` function.

**Name of the Vulnerable Software and Affected Versions** Strong Testimonials versions prior to 3.3.9 **Description** Stored Cross-Site Scripting occurs due to insufficient input sanitization and output escaping. Authenticated attackers with contributor-level access or higher can inject arbitrary web scripts into pages via the `lightbox class` shortcode attribute. These scripts execute when a user visits the affected page. This issue is triggered only when a testimonial view contains at least one published testimonial with a featured image and the lightbox wrapper enabled, as the flaw is located in the thumbnail rendering process. **Recommendations** Update Strong Testimonials to version 3.3.9 or later.