Stefan Broeder

**Name of the Vulnerable Software and Affected Versions** Relevanssi plugin version 4.0.4 **Description** A cross-site scripting (XSS) issue exists, allowing remote attackers to inject arbitrary JavaScript or HTML. This is achieved via the `tab` GET parameter in the lib/interface.php file. **Recommendations** For Relevanssi plugin version 4.0.4, update to a version that fixes this issue. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** Contact Form 7 to Database Extension plugin version 2.10.32 **Description** The issue allows remote attackers to inject spreadsheet formulas into CSV files via the contact form. This is achieved through a CSV Injection vulnerability in the ExportToCsvUtf8.php file of the plugin. **Recommendations** For version 2.10.32, update to a newer version that contains a fix for this issue to prevent remote attackers from injecting malicious spreadsheet formulas into CSV files.

**Name of the Vulnerable Software and Affected Versions** SnapCreek Duplicator plugin version 1.2.32 **Description** The issue is related to a cross-site scripting (XSS) vulnerability. This vulnerability allows remote attackers to inject arbitrary JavaScript or HTML via the `json` parameter in the installer/build/view.step4.php file. **Recommendations** For SnapCreek Duplicator plugin version 1.2.32, consider updating to a newer version that contains a fix for this issue. As a temporary workaround, restrict access to the vulnerable installer/build/view.step4.php file to minimize the risk of exploitation. Avoid using the `json` parameter in the affected API endpoint until the issue is resolved.

**Name of the Vulnerable Software and Affected Versions** Activity Log plugin versions prior to 2.4.1 for WordPress **Description** The issue allows remote attackers to inject arbitrary JavaScript or HTML via a title that is not properly escaped, potentially leading to cross-site scripting (XSS) attacks. This could enable attackers to execute malicious scripts on the client-side. **Recommendations** For versions prior to 2.4.1, update to version 2.4.1 or later to resolve the issue. As a temporary workaround, consider restricting user input for titles to minimize the risk of exploitation.