Ravi Dharmawan

**Name of the Vulnerable Software and Affected Versions** RSVPMaker versions n/a through 10.6.6 **Description** The issue is related to an Improper Control of Generation of Code ('Code Injection') vulnerability. This vulnerability affects the generation of code, potentially allowing for code injection attacks. No information is provided about the estimated number of potentially affected devices worldwide or real-world incidents where this issue was exploited. **Recommendations** For versions n/a through 10.6.6, at the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** Video Gallery – Best WordPress YouTube Gallery Plugin versions prior to 2.1.4 **Description** The issue is related to an SQL Injection vulnerability due to improper neutralization of special elements used in an SQL command. This allows for SQL Injection attacks. **Recommendations** For versions prior to 2.1.4, update to version 2.1.4 or later to resolve the issue.

**Name of the Vulnerable Software and Affected Versions** RSVPMaker versions through 10.6.6 **Description** The issue is related to an SQL Injection vulnerability due to improper neutralization of special elements used in an SQL command. This allows for SQL Injection attacks. **Recommendations** For versions through 10.6.6, update to a version later than 10.6.6 to resolve the issue. As a temporary workaround, consider restricting access to sensitive database operations until a patch is available. Avoid using user-supplied input in SQL commands without proper sanitization until the issue is resolved.

**Name of the Vulnerable Software and Affected Versions** Contact Form Plugin – Fastest Contact Form Builder Plugin for WordPress by Fluent Forms versions through 4.3.25 **Description** The issue is related to an SQL Injection vulnerability due to improper neutralization of special elements used in an SQL command. This allows for SQL Injection, potentially enabling unauthorized access to database content. **Recommendations** For versions through 4.3.25, update to a version later than 4.3.25 to resolve the issue. As a temporary workaround, consider restricting access to the plugin's database interactions until a patch is available.

**Name of the Vulnerable Software and Affected Versions** WPGraphQL versions 1.14.5 and earlier **Description** A Server-Side Request Forgery (SSRF) issue affects WPGraphQL, allowing authenticated users with media upload capabilities to execute the `createMediaItem` mutation and potentially gain unwarranted access to the server by passing executable paths in the `filePath` argument. **Recommendations** For WPGraphQL versions 1.14.5 and earlier, update to WPGraphQL v1.14.6 or newer to resolve the issue. If updating to v1.14.6 or higher is not possible, add a filter to the `graphql pre resolve field` function in functions.php to override the vulnerable `createMediaItem` mutation resolver, ensuring that only allowed protocols (https, http, file) are used and the file type is validated.