Suhayb Ahmed

The Export & Import WPBakery Page Builder WordPress plugin through 1.0.2 does not perform any CSRF check on its template-import feature and does not sanitise the imported data before storing it and echoing it back, allowing attackers to make a logged-in administrator import a crafted template via a forged request that results in Stored Cross-Site Scripting executed in the administrator's session.

The SSL Zen — SSL Certificate Installer & HTTPS Redirects WordPress plugin before 4.7.40 does not perform capability or nonce checks on a certificate-file download routine that runs early in the WordPress admin request lifecycle, allowing any authenticated user, including Subscribers, to download the site's TLS private key, certificates, and diagnostic logs.

**Name of the Vulnerable Software and Affected Versions** SAML Single Sign On versions prior to 5.4.7 **Description** The plugin fails to verify the signature of a SAML response before storing the included certificate. An administrator can then promote this stored certificate to the site's trusted signing certificate via a one-click control. This allows unauthenticated attackers to establish trust for their own certificate and authenticate as any user, including those with administrator privileges. **Recommendations** Update to version 5.4.7 or later.