Universe

**Name of the Vulnerable Software and Affected Versions** Code Embed versions prior to 2.3.7 **Description** The issue is related to Uncontrolled Resource Consumption. This affects the Code Embed software. **Recommendations** For versions prior to 2.3.7, update to version 2.3.7 or later to resolve the issue.

**Name of the Vulnerable Software and Affected Versions** Darren Cooney Instant Images plugin versions <= 5.1.0.2 **Description** The issue is related to a Server-Side Request Forgery (SSRF) vulnerability. This means an attacker could potentially force the server to make requests to arbitrary domains, which could lead to unauthorized access to sensitive data or systems. **Recommendations** For Darren Cooney Instant Images plugin versions <= 5.1.0.2, update to a version higher than 5.1.0.2 to resolve the issue.

**Name of the Vulnerable Software and Affected Versions** Atlas Gondal Export All URLs plugin versions <= 4.1 **Description** The issue is related to a Stored Cross-Site Scripting (XSS) vulnerability that affects authenticated users with editor or higher privileges. **Recommendations** For Atlas Gondal Export All URLs plugin versions <= 4.1, consider disabling the plugin until a patch is available to prevent exploitation of the Stored Cross-Site Scripting (XSS) vulnerability.

**Name of the Vulnerable Software and Affected Versions** Activity Log Team Activity Log versions 2.8.3 and earlier **Description** A CSV Injection issue has been identified. This issue affects the Activity Log Team Activity Log plugin on WordPress. **Recommendations** For versions 2.8.3 and earlier, update to a version later than 2.8.3 to resolve the issue.

**Name of the Vulnerable Software and Affected Versions** Soflyy Import any XML or CSV File to WordPress plugin versions <= 3.6.7 **Description** The issue is related to an Authenticated Arbitrary Code Execution vulnerability. This allows for the execution of arbitrary code by an authenticated user. **Recommendations** For Soflyy Import any XML or CSV File to WordPress plugin versions <= 3.6.7, update to a version greater than 3.6.7 to resolve the issue.

**Name of the Vulnerable Software and Affected Versions** dmitrylitvinov Uploading SVG, WEBP and ICO files plugin version 1.0.1 and earlier **Description** The issue concerns an Authenticated Arbitrary File Upload vulnerability. This allows attackers to upload malicious files to the system, potentially leading to various security issues. The estimated number of potentially affected devices worldwide is not specified. There is no information provided about real-world incidents where this issue was exploited. **Recommendations** For dmitrylitvinov Uploading SVG, WEBP and ICO files plugin version 1.0.1 and earlier, update to a version later than 1.0.1 to resolve the issue. At the moment, there is no information about additional mitigation measures.

**Name of the Vulnerable Software and Affected Versions** dmitrylitvinov Uploading SVG, WEBP and ICO files plugin version 1.0.1 and earlier **Description** The issue is related to an Authenticated Stored Cross-Site Scripting (XSS) vulnerability. This vulnerability can be exploited by an authenticated user with author or higher privileges. The vulnerability is caused by the ability to upload SVG, WEBP, and ICO files, which can contain malicious scripts. **Recommendations** For dmitrylitvinov Uploading SVG, WEBP and ICO files plugin version 1.0.1 and earlier, update to a version later than 1.0.1 to resolve the issue. As a temporary workaround, consider disabling the upload of SVG, WEBP, and ICO files until a patch is available. Restrict access to the plugin's upload functionality to minimize the risk of exploitation.

**Name of the Vulnerable Software and Affected Versions** ideasToCode Enable SVG, WebP & ICO Upload plugin version 1.0.1 and earlier **Description** The issue is an Authenticated Stored Cross-Site Scripting (XSS) vulnerability. This means that an attacker, who has at least author or higher user role, can inject malicious scripts into the website, which will be executed by other users' browsers. The estimated number of potentially affected devices worldwide is not available. There is no information about real-world incidents where this issue was exploited. **Recommendations** For ideasToCode Enable SVG, WebP & ICO Upload plugin version 1.0.1 and earlier, update to a version later than 1.0.1 to resolve the issue. At the moment, there is no information about additional mitigation measures.

**Name of the Vulnerable Software and Affected Versions** ideasToCode Enable SVG, WebP & ICO Upload plugin version 1.0.1 and earlier **Description** The issue allows authenticated users with author or higher roles to upload arbitrary files. This can be exploited by uploading malicious files to the server. **Recommendations** For ideasToCode Enable SVG, WebP & ICO Upload plugin version 1.0.1 and earlier, update to a version later than 1.0.1 to resolve the issue.

**Name of the Vulnerable Software and Affected Versions** Export All URLs plugin versions prior to 4.2 **Description** The issue is related to an Authenticated Stored Cross-Site Scripting (XSS) vulnerability. This means that an attacker with editor or higher user role can inject malicious scripts into the application, which can then be executed by other users. **Recommendations** For Export All URLs plugin versions prior to 4.2, update to version 4.2 or later to resolve the issue.