Ryoma Nishioka

**Name of the Vulnerable Software and Affected Versions** Admin Custom Login versions prior to 3.6.5 **Description** Stored Cross-Site Scripting occurs due to insufficient input sanitization and output escaping within the admin settings. This allows authenticated attackers with administrator-level permissions or higher to inject arbitrary web scripts into pages. These scripts execute when a user accesses the affected page. This issue specifically impacts multi-site installations and environments where `unfiltered html` has been disabled. **Recommendations** Update Admin Custom Login to version 3.6.5 or later.

**Name of the Vulnerable Software and Affected Versions** WP Post Author – Author Box, Multiple Authors, Guest Authors & Custom Avatars versions prior to 3.9.2 **Description** This issue is a generic SQL Injection, which occurs when an application fails to properly sanitize user input, allowing an attacker to interfere with the queries that an application makes to its database. Authenticated attackers with author-level access or higher can append additional SQL queries to extract sensitive information from the database. The exploitation process involves a two-step chain: first, the attacker saves a crafted guest-author token using the `wpma metabox authors list` parameter during post creation or editing; second, the injection is triggered when an administrator loads the post list screen at the '/wp-admin/edit.php' endpoint, resulting in the injected SQL output being displayed in the Authors column. **Recommendations** Update to a version newer than 3.9.1. Avoid using the `wpma metabox authors list` parameter during post creation or editing until the update is applied.

**Name of the Vulnerable Software and Affected Versions** Context Blog theme for WordPress versions prior to 1.3.6 **Description** Sensitive information exposure occurs via the `context blog modal popup` component. This flaw allows unauthenticated attackers to extract the content of posts that are password-protected. **Recommendations** Update the Context Blog theme to a version newer than 1.3.5. As a temporary mitigation, restrict access to the `context blog modal popup` functionality.