Tal Kantor

**Name of the Vulnerable Software and Affected Versions** Easy Digital Downloads versions prior to 3.7.0 **Description** Insufficient file type validation in the `edd do ajax import file upload()` function allows authenticated attackers with Shop Manager-level access or higher to upload arbitrary files to the server. The issue occurs because the system only verifies the `edd-import-file` parameter's Content-Type header against a CSV mime type allow-list and uses `move uploaded file()` to save the file in the `wp-content/uploads/edd/exports/` directory, bypassing core MIME enforcement. This could lead to remote code execution. **Recommendations** Update to a version newer than 3.6.9. As a temporary workaround, restrict access to the `edd do ajax import file upload()` function for users with Shop Manager-level access.

**Name of the Vulnerable Software and Affected Versions** White Label CMS versions prior to 2.7.13 **Description** Stored Cross-Site Scripting occurs via admin settings due to insufficient input sanitization and output escaping. Authenticated attackers with administrator-level permissions or higher can inject arbitrary web scripts into pages. These scripts execute when a user accesses the affected page. This issue specifically impacts multi-site installations and environments where `unfiltered html` has been disabled. **Recommendations** Update White Label CMS to version 2.7.13 or later.

**Name of the Vulnerable Software and Affected Versions** Q4 Inc Investor Relations Platform version 5.147.1.2 **Description** A Cross-Site Scripting (XSS) issue in the search function allows attackers to execute arbitrary Javascript by injecting a crafted payload into the `SearchTerm` parameter. This enables the execution of malicious scripts, potentially leading to unauthorized actions on the platform. **Recommendations** For Q4 Inc Investor Relations Platform version 5.147.1.2, consider restricting access to the search function until a patch is available, and avoid using the `SearchTerm` parameter in the affected search endpoint to minimize the risk of exploitation.