Testoun

**Name of the Vulnerable Software and Affected Versions** Easy Media Replace WordPress plugin versions prior to 0.2.1 **Description** Insufficient sanitization and escaping of attachment titles before they are output in an HTML attribute within the media library list view allows users with the Author role or higher to perform a Cross-Site Scripting (XSS) attack. This occurs when a higher privileged user views the media library, causing the injected arbitrary web scripts to execute in their browser. **Recommendations** Update the Easy Media Replace WordPress plugin to version 0.2.1 or later.

**Name of the Vulnerable Software and Affected Versions** Embed Google Photos album WordPress plugin versions prior to 2.2.2 **Description** Users with the Contributor role or higher can perform a stored cross-site scripting (XSS) attack. This occurs because the plugin fails to escape a shortcode attribute value before it is output within an HTML attribute, enabling the injection of arbitrary JavaScript that executes in the browser of any user, including administrators, who views the affected post. **Recommendations** Update the plugin to a version newer than 2.2.1.

**Name of the Vulnerable Software and Affected Versions** WP-Stats versions prior to 2.57 **Description** Insufficient input sanitization and output escaping allow unauthenticated attackers to perform Stored Cross-Site Scripting (XSS). This occurs when arbitrary web scripts are injected into pages, which then execute automatically when a user accesses the affected page. **Recommendations** Update WP-Stats to a version newer than 2.56.

**Name of the Vulnerable Software and Affected Versions** Patterns Kit WordPress plugin versions prior to 1.0.4 **Description** The plugin fails to escape a link attribute before a client-side script inserts it into the page. This allows users with Contributor privileges to store a malicious payload that executes in the browser of any user who views the content and clicks the affected element. **Recommendations** Update the Patterns Kit WordPress plugin to version 1.0.4 or later.

**Name of the Vulnerable Software and Affected Versions** Saitama Addon Pack versions prior to 1.0.9 **Description** The plugin fails to sanitize and escape specific post metadata values before they are output. This allows users with contributor-level access or higher to perform stored Cross-Site Scripting (XSS), where malicious scripts are permanently stored on the server and executed in the browser of a higher-privileged user who views the affected content. **Recommendations** Update Saitama Addon Pack to version 1.0.9 or later.

**Name of the Vulnerable Software and Affected Versions** BNE Testimonials versions prior to 2.0.8.2 **Description** Users with the contributor role and above can perform a Stored Cross-Site Scripting (XSS) attack. This occurs because the plugin fails to properly escape a shortcode attribute for a JavaScript context before echoing it into an inline script, enabling the injection of arbitrary JavaScript that executes in the browser of any user viewing the affected content. **Recommendations** Update BNE Testimonials to version 2.0.8.2 or later.

**Name of the Vulnerable Software and Affected Versions** Slick Slider versions prior to 0.5.3 **Description** Insufficient sanitization and escaping of a shortcode attribute value before it is output in an HTML attribute allows users with the Contributor role and above to perform Stored Cross-Site Scripting (XSS) attacks. This occurs when a user views the affected post. Stored XSS is a type of vulnerability where a malicious script is permanently stored on the target server. **Recommendations** Update to version 0.5.3 or later.

**Name of the Vulnerable Software and Affected Versions** Codeless Page Builder versions prior to 1.1.5 **Description** Insufficient sanitization and validation of a shortcode attribute allows users with contributor-level access and above to inject arbitrary HTML and JavaScript. This occurs when the attribute is used as an HTML tag name during content rendering, leading to stored Cross-Site Scripting (XSS), where the injected code executes in the session of higher-privileged users, such as administrators, who view the affected content. **Recommendations** Update Codeless Page Builder to version 1.1.5 or later.