Resecured.Io

**Name of the Vulnerable Software and Affected Versions** Labib Ahmed Carousel Anything For WPBakery Page Builder versions through 2.1 **Description** The issue is related to Improper Neutralization of Input During Web Page Generation, also known as Cross-site Scripting, which allows Stored XSS. This means that an attacker can inject malicious scripts into the website, potentially leading to unauthorized access or other security issues. **Recommendations** For versions through 2.1, update to a version that contains a fix for this issue, as the current version is affected by the Stored XSS vulnerability. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** Lordicon Animated Icons versions through 2.0.1 **Description** The issue is related to Improper Neutralization of Input During Web Page Generation, also known as Cross-site Scripting, which allows Stored XSS. This means that an attacker can inject malicious scripts into the website, potentially affecting users who access the compromised page. **Recommendations** For Lordicon Animated Icons versions through 2.0.1, update to a version later than 2.0.1 to resolve the issue. At the moment, there is no information about other specific mitigation measures for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** Scrollsequence versions 1.5.4 and earlier **Description** The issue is related to Improper Neutralization of Input During Web Page Generation, also known as Cross-site Scripting, which allows Stored XSS. This means that an attacker can inject malicious scripts into the website, potentially affecting users who access the compromised page. **Recommendations** For versions 1.5.4 and earlier, update to a version later than 1.5.4 to resolve the issue. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** Nicdark Restaurant Reservations versions 1.8 and earlier **Description** The issue is related to Improper Neutralization of Input During Web Page Generation, also known as Cross-site Scripting, which allows Stored XSS. This means that an attacker can inject malicious scripts into the website, potentially affecting users who access the compromised page. **Recommendations** For versions 1.8 and earlier, update to a version that fixes the Stored XSS issue. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** My Agile Privacy versions through 2.1.7 **Description** The issue is related to Improper Neutralization of Input During Web Page Generation, also known as Cross-site Scripting, which allows Stored XSS. This means that an attacker can inject malicious scripts into the website, potentially leading to unauthorized access or data theft. The estimated number of potentially affected devices worldwide is not available. There is no information about real-world incidents where this issue was exploited. **Recommendations** For versions through 2.1.7, update to a version later than 2.1.7 to resolve the issue. At the moment, there is no information about other specific mitigation measures for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** Pay with Vipps and MobilePay for WooCommerce versions 1.14.13 and earlier **Description** The issue is related to Improper Neutralization of Input During Web Page Generation, also known as Cross-site Scripting, which allows Stored XSS. This means that an attacker can inject malicious scripts into the website, potentially leading to unauthorized access or data theft. The estimated number of potentially affected devices worldwide is not available. **Recommendations** For Pay with Vipps and MobilePay for WooCommerce versions 1.14.13 and earlier, update to a version later than 1.14.13 to resolve the issue. As a temporary workaround, consider restricting access to sensitive areas of the website to minimize the risk of exploitation. Avoid using potentially vulnerable input fields until the issue is resolved. At the moment, there is no additional information about other mitigation measures.

**Name of the Vulnerable Software and Affected Versions** Auto Listings – Car Listings & Car Dealership Plugin for WordPress versions n/a through 2.6.5 **Description** The issue affects the WP Auto Listings plugin, allowing Stored XSS due to improper neutralization of input during web page generation. This can lead to cross-site scripting attacks. **Recommendations** For versions n/a through 2.6.5, update to a version later than 2.6.5 to resolve the issue. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** OWL Carousel – WordPress Owl Carousel Slider versions 1.4.0 and earlier **Description** The issue is related to Improper Neutralization of Input During Web Page Generation, also known as Cross-site Scripting. This allows for Stored XSS in the LogicHunt OWL Carousel – WordPress Owl Carousel Slider. **Recommendations** For versions 1.4.0 and earlier, update to a version later than 1.4.0 to resolve the issue. As a temporary workaround, consider restricting access to the vulnerable slider until a patch is available.

**Name of the Vulnerable Software and Affected Versions** MojofyWP WP Affiliate Disclosure versions 1.2.7 and earlier **Description** The issue is related to improper neutralization of input during web page generation, which allows for stored cross-site scripting (XSS). This means that an attacker can inject malicious scripts into the website, potentially leading to unauthorized access or other malicious activities. The estimated number of potentially affected devices worldwide is not available. **Recommendations** For MojofyWP WP Affiliate Disclosure versions 1.2.7 and earlier, update to a version that contains a fix for this issue. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** Aleksandar Urošević Stock Ticker versions 3.23.4 and earlier **Description** The issue is related to Improper Neutralization of Input During Web Page Generation, also known as Cross-site Scripting, which allows Stored XSS. This means that an attacker can inject malicious code into the web page, potentially affecting users who access the page. **Recommendations** For versions 3.23.4 and earlier, update to a version later than 3.23.4 to resolve the issue. As a temporary workaround, consider restricting user input to prevent malicious code injection until a patch is available.

**Name of the Vulnerable Software and Affected Versions** Formzu WP versions 1.6.6 and earlier **Description** The issue is related to improper neutralization of input during web page generation, which allows for stored cross-site scripting (XSS). This means that an attacker can inject malicious scripts into the website, potentially leading to unauthorized access or control. **Recommendations** For versions 1.6.6 and earlier, update to a version later than 1.6.6 to resolve the issue. As a temporary workaround, consider restricting access to the Formzu WP plugin until a patch is available.

**Name of the Vulnerable Software and Affected Versions** Spiffy Calendar versions through 4.9.5 **Description** The issue is related to improper neutralization of input during web page generation, which allows for stored cross-site scripting (XSS). This means that an attacker can inject malicious scripts into the website, potentially leading to unauthorized access or other malicious activities. **Recommendations** For versions through 4.9.5, update to a version later than 4.9.5 to resolve the issue. As a temporary workaround, consider restricting access to the Spiffy Calendar plugin to minimize the risk of exploitation.

**Name of the Vulnerable Software and Affected Versions** Contact Form – Custom Builder, Payment Form, and More versions n/a through 2.1.0 **Description** The issue is related to Improper Neutralization of Input During Web Page Generation, also known as 'Cross-site Scripting'. This allows for Stored XSS attacks. **Recommendations** For versions n/a through 2.1.0, update to a version later than 2.1.0 to resolve the issue. At the moment, there is no information about other mitigation measures for this specific vulnerability.

**Name of the Vulnerable Software and Affected Versions** Parallax Image versions 1.7.1 and earlier **Description** The issue is related to Improper Neutralization of Input During Web Page Generation, also known as Cross-site Scripting, which allows Stored XSS. This means that an attacker can inject malicious scripts into the website, potentially affecting users who access the compromised page. **Recommendations** For Parallax Image versions 1.7.1 and earlier, at the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** assorted[chips] DrawIt (draw.Io) plugin versions <= 1.1.3 **Description** The issue is related to Improper Neutralization of Input During Web Page Generation, also known as Cross-site Scripting. This allows for potentially malicious input to be executed, posing a security risk. **Recommendations** For assorted[chips] DrawIt (draw.Io) plugin versions <= 1.1.3, update to a version greater than 1.1.3 to resolve the issue.

**Name of the Vulnerable Software and Affected Versions** Nicola Modugno Smart Cookie Kit plugin versions prior to 2.3.1 **Description** The issue is related to a Stored Cross-Site Scripting (XSS) vulnerability. This vulnerability can be exploited by contributors or users with higher authentication levels. There is no information provided about the estimated number of potentially affected devices worldwide or real-world incidents where this issue was exploited. **Recommendations** For versions prior to 2.3.1, update to a version that contains a fix for this issue. At the moment, there is no information about a newer version that contains a fix for this vulnerability.