Tahu.Datar

Name of the Vulnerable Software and Affected Versions: Candid themes Grip versions 1.0.9 and earlier Description: The issue is related to an Improper Control of Filename for Include/Require Statement in PHP Program, also known as 'PHP Remote File Inclusion'. This is a type of vulnerability where an attacker can manipulate the filename used in include or require statements, potentially allowing them to execute malicious code. Recommendations: For Candid themes Grip versions 1.0.9 and earlier, at the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** NotFound Store Locator versions 3.98.10 and earlier **Description** The issue is related to an Improper Limitation of a Pathname to a Restricted Directory, also known as 'Path Traversal', which allows PHP Local File Inclusion. This can potentially lead to unauthorized access to sensitive files. **Recommendations** For versions 3.98.10 and earlier, update immediately to a version that is not affected by this issue. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** Ach Invoice App versions 1.0.1 and earlier **Description** The issue is related to improper control of filenames for Include/Require statements in PHP, allowing PHP Local File Inclusion. This problem affects the Service Shogun Ach Invoice App, enabling the inclusion of local PHP files. **Recommendations** For versions 1.0.1 and earlier, update to a version that fixes the improper control of filenames for Include/Require statements to prevent PHP Local File Inclusion. As a temporary workaround, consider restricting access to vulnerable include/require statements until a patch is available.

Name of the Vulnerable Software and Affected Versions: Sogrid versions 1.5.6 and earlier Description: The issue is related to an Improper Limitation of a Pathname to a Restricted Directory, also known as 'Path Traversal', which allows PHP Local File Inclusion. This means that an attacker could potentially access and include local files on the server, potentially leading to sensitive information disclosure or code execution. Recommendations: For versions 1.5.6 and earlier, update to a version that fixes this issue, however, at the moment, there is no information about a newer version that contains a fix for this vulnerability. As a temporary workaround, consider restricting access to sensitive files and directories to minimize the risk of exploitation.

Name of the Vulnerable Software and Affected Versions: Filippo Bodei WP Cookies Enabler versions 1.0.1 and earlier Description: The issue is related to an improper limitation of a pathname to a restricted directory, also known as 'Path Traversal', which allows for PHP Local File Inclusion. This means that an attacker could potentially access and include local files on the server, which could lead to sensitive information disclosure or other security issues. Recommendations: For Filippo Bodei WP Cookies Enabler versions 1.0.1 and earlier, consider disabling the plugin until a patch is available to prevent potential exploitation of the Path Traversal vulnerability. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Name of the Vulnerable Software and Affected Versions: Woolook versions n/a through 1.7.0 Description: The issue is related to an improper limitation of a pathname to a restricted directory, also known as 'Path Traversal', which allows PHP Local File Inclusion. This means that an attacker could potentially access and include files from outside the intended directory, leading to security issues. Recommendations: For versions n/a through 1.7.0, update to a version that fixes the 'Path Traversal' issue to prevent PHP Local File Inclusion. As a temporary workaround, consider restricting access to sensitive files and directories to minimize the risk of exploitation.

**Name of the Vulnerable Software and Affected Versions** WDesignkit versions 1.0.0 through 1.0.40 **Description** The issue allows for the unrestricted upload of files with dangerous types, enabling the upload of a web shell to a web server. This can be exploited to gain unauthorized access to the server. **Recommendations** For versions 1.0.0 through 1.0.40, consider restricting file uploads to only allow safe file types until a patch is available. As a temporary workaround, restrict access to the file upload functionality to minimize the risk of exploitation.

Name of the Vulnerable Software and Affected Versions: Acowebs Product Labels For Woocommerce versions 1.5.8 and earlier Description: The issue is related to an SQL Injection vulnerability, specifically Improper Neutralization of Special Elements used in an SQL Command. This allows for Blind SQL Injection, which can be exploited by attackers. Recommendations: For versions 1.5.8 and earlier, update to a version that contains a fix for this issue, as the current version is affected by the SQL Injection vulnerability. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** Navneil Naicer Bootscraper versions 2.1.0 and earlier **Description** The issue is related to an Improper Limitation of a Pathname to a Restricted Directory, also known as 'Path Traversal', which allows PHP Local File Inclusion. This can potentially compromise a site. **Recommendations** For Navneil Naicer Bootscraper versions 2.1.0 and earlier, upgrade immediately to a version that is not affected by this issue to protect your site from potential compromise.

Name of the Vulnerable Software and Affected Versions: Theme Horse NewsCard versions 1.3 and earlier Description: The issue is related to an improper control of filename for include/require statement in PHP, known as 'PHP Remote File Inclusion'. This allows for potential remote code execution. Recommendations: For Theme Horse NewsCard versions 1.3 and earlier, update to a version that includes a fix for this issue, as no specific workaround is provided for these versions.

Name of the Vulnerable Software and Affected Versions: Theme Horse Clean Retina versions 3.0.6 and earlier Description: The issue is related to an improper control of filename for include/require statement in PHP, also known as 'PHP Remote File Inclusion'. This allows potential exploitation. Recommendations: For Theme Horse Clean Retina versions 3.0.6 and earlier, update to a version later than 3.0.6 to resolve the issue.

Name of the Vulnerable Software and Affected Versions: Theme Horse Meta News versions 1.1.7 and earlier Description: The issue is related to an Improper Control of Filename for Include/Require Statement in PHP Program, also known as 'PHP Remote File Inclusion'. This is a type of vulnerability where an attacker can manipulate the filename used in include or require statements, potentially allowing remote code execution. Recommendations: For Theme Horse Meta News versions 1.1.7 and earlier, at the moment, there is no information about a newer version that contains a fix for this vulnerability.

Name of the Vulnerable Software and Affected Versions: Theme Horse Mags versions 1.1.6 and earlier Description: The issue is related to an Improper Control of Filename for Include/Require Statement in PHP Program, also known as 'PHP Remote File Inclusion'. This is a type of vulnerability where an attacker can manipulate the filename used in include or require statements, potentially allowing them to execute malicious code. Recommendations: For Theme Horse Mags versions 1.1.6 and earlier, at the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** Custom Icons for Elementor versions 0.3.3 and earlier **Description** The issue allows for the unrestricted upload of files with dangerous types, which can lead to uploading a web shell to a web server. **Recommendations** For versions 0.3.3 and earlier, update to a version that contains a fix for this issue, as the current version allows for the upload of malicious files. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** Moridrin SSV Events versions 3.2.7 and earlier **Description** The issue is related to an Improper Limitation of a Pathname to a Restricted Directory, also known as a 'Path Traversal' vulnerability, which allows PHP Local File Inclusion in Moridrin SSV Events. This vulnerability can lead to unauthorized access. **Recommendations** For Moridrin SSV Events versions 3.2.7 and earlier, upgrade to a newer version as soon as possible to mitigate the risk of unauthorized access. As a temporary workaround, consider restricting access to sensitive files and directories to minimize the risk of exploitation.

**Name of the Vulnerable Software and Affected Versions** Marco Heine PDF-Rechnungsverwaltung versions 0.0.1 and earlier **Description** The issue is related to an Improper Limitation of a Pathname to a Restricted Directory, also known as 'Path Traversal', which allows PHP Local File Inclusion. **Recommendations** For Marco Heine PDF-Rechnungsverwaltung versions 0.0.1 and earlier, at the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** Moridrin SSV MailChimp versions 3.1.5 and earlier **Description** The issue is related to an Improper Limitation of a Pathname to a Restricted Directory, also known as a 'Path Traversal' vulnerability. This allows for PHP Local File Inclusion. The risk associated with this issue is path traversal. **Recommendations** For Moridrin SSV MailChimp versions 3.1.5 and earlier: Update the plugin as soon as possible to mitigate the risk of path traversal exploitation. As a temporary workaround, consider restricting access to sensitive files and directories to minimize the risk of exploitation.

**Name of the Vulnerable Software and Affected Versions** Top Bar – PopUps – by WPOptin versions n/a through 2.0.1 **Description** The issue is related to an Improper Limitation of a Pathname to a Restricted Directory, also known as a 'Path Traversal' vulnerability. This vulnerability allows PHP Local File Inclusion, which can be exploited for remote attacks. **Recommendations** For versions n/a through 2.0.1, update the plugin immediately to a patched version. As a temporary workaround, consider restricting access to sensitive files and directories to minimize the risk of exploitation.

**Name of the Vulnerable Software and Affected Versions** Martin Greenwood WPSPX versions 1.0.2 and earlier **Description** The issue is related to an Improper Limitation of a Pathname to a Restricted Directory, also known as a 'Path Traversal' vulnerability, which allows for PHP Local File Inclusion in Martin Greenwood WPSPX. **Recommendations** For Martin Greenwood WPSPX versions 1.0.2 and earlier, update to a version that fixes this issue, as no specific workaround or mitigation measures are provided in the given information. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** WP Ticket Ultra Help Desk & Support Plugin versions 1.0.0 through 1.0.5 **Description** The issue is related to an Improper Limitation of a Pathname to a Restricted Directory, also known as a 'Path Traversal' vulnerability. This vulnerability allows PHP Local File Inclusion. **Recommendations** For WP Ticket Ultra Help Desk & Support Plugin versions 1.0.0 through 1.0.5, update to a version later than 1.0.5 to resolve the issue. At the moment, there is no information about additional mitigation measures for this vulnerability.