Unk9Vvn

**Name of the Vulnerable Software and Affected Versions** Soliloquy Lite version 2.5.6 **Description** A persistent cross-site scripting issue allows authenticated attackers to inject malicious scripts by inserting script tags into the post title field. This is achieved by submitting POST requests to the post editing endpoint using the `post title` parameter. The injected scripts are stored and subsequently executed when users preview the post. **Recommendations** At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** WordPress Popup Builder version 3.49 **Description** A persistent cross-site scripting issue allows authenticated attackers to inject malicious scripts. This is achieved by breaking out of option tags using the `post title` parameter. Attackers can send crafted POST requests to the "/post.php" endpoint with script payloads in the `post title` field, which then execute when pages or posts display popup selections. **Recommendations** At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** Duplicate-Post WordPress Plugin version 3.2.3 **Description** The Duplicate-Post WordPress Plugin version 3.2.3 has a persistent cross-site scripting issue in the plugin settings parameters. An attacker can inject malicious scripts into the title prefix, suffix, menu order, and blacklist fields. This allows for the execution of arbitrary JavaScript in the admin interfaces. The vulnerable parameters include `title prefix`, `suffix`, `menu order`, and `blacklist`. **Recommendations** Update Duplicate-Post WordPress Plugin to a newer version that addresses this issue. As a temporary workaround, sanitize all input to the `title prefix`, `suffix`, `menu order`, and `blacklist` fields.