Roll

**Name of the Vulnerable Software and Affected Versions** MailChimp Block versions prior to 1.1.16 **Description** An unauthenticated broken access control issue exists, allowing unauthorized users to bypass access restrictions. **Recommendations** Update to a version newer than 1.1.15.

**Name of the Vulnerable Software and Affected Versions** Paid Memberships Pro - Add Member From Admin versions prior to 0.7.3 **Description** An unauthenticated Cross Site Request Forgery (CSRF) exists, which allows attackers to execute unauthorized actions via crafted requests. CSRF is a type of attack that tricks a victim into submitting a malicious request. It occurs when an application relies on browser-stored credentials to authenticate requests without verifying that the user intentionally initiated the action. **Recommendations** Update to a version newer than 0.7.2.

**Name of the Vulnerable Software and Affected Versions** MDTF versions prior to 1.3.8 **Description** The Meta Data and Taxonomies Filter plugin for WordPress contains a flaw allowing unauthenticated attackers to execute SQL Injection. This occurs due to insufficient escaping of user-supplied parameters and a lack of proper preparation of the SQL query, enabling the extraction of sensitive information from the database. **Recommendations** Update the plugin to a version newer than 1.3.7.

Name of the Vulnerable Software and Affected Versions: Import any XML, CSV or Excel File to WordPress plugin versions through 3.9.3 Description: The Import any XML, CSV or Excel File to WordPress plugin for WordPress is susceptible to arbitrary file uploads due to the absence of file type validation during the import process. This allows authenticated attackers with Administrator-level access or higher to upload potentially harmful files, such as `.phar` files, to the server. Successful exploitation may lead to remote code execution. Recommendations: Update to a version beyond 3.9.3.