Vantastic

Unauthenticated Insecure Direct Object References (IDOR) in Kirki <= 6.0.11 versions.

**Name of the Vulnerable Software and Affected Versions** Uncanny Automator versions prior to 7.3.1.3 **Description** An unauthenticated PHP Object Injection issue exists. PHP Object Injection occurs when untrusted input is passed to the PHP `unserialize()` function, potentially allowing an attacker to manipulate objects and execute arbitrary code. **Recommendations** Update to a version newer than 7.3.1.2.

**Name of the Vulnerable Software and Affected Versions** Uncanny Automator Pro versions prior to 7.3.0.7 **Description** An issue exists that allows for PHP Object Injection, a condition where untrusted input is passed to the `unserialize()` function, potentially allowing an attacker to manipulate application logic or execute arbitrary code. **Recommendations** Update to a version newer than 7.3.0.6.

**Name of the Vulnerable Software and Affected Versions** Dokan Pro versions prior to 5.0.5 **Description** An issue allows unauthenticated users to perform privilege escalation, which enables an attacker to gain higher access levels within the system without providing valid credentials. **Recommendations** Update to a version newer than 5.0.4.

**Name of the Vulnerable Software and Affected Versions** EventPrime versions prior to 4.3.4.2 **Description** PHP Object Injection occurs when an application deserializes untrusted data, allowing an attacker to manipulate the object structure and potentially execute arbitrary code or perform unauthorized actions. **Recommendations** Update to version 4.3.4.2 or later.

**Name of the Vulnerable Software and Affected Versions** Toolset Forms versions prior to 2.6.25 **Description** An Insecure Direct Object Reference (IDOR) exists due to missing validation on a user controlled key. This allows unauthenticated attackers to perform unauthorized actions. **Recommendations** Update Toolset Forms to version 2.6.25 or later.

**Name of the Vulnerable Software and Affected Versions** JetEngine versions prior to 3.8.10.2 **Description** An unauthenticated SQL Injection allows an attacker to execute arbitrary SQL queries on the database without requiring valid credentials. **Recommendations** Update to version 3.8.10.2 or newer.

**Name of the Vulnerable Software and Affected Versions** JetEngine versions prior to 3.8.11 **Description** The JetEngine plugin for WordPress contains a Stored Cross-Site Scripting (XSS) flaw. This occurs because the software fails to properly sanitize input and escape output, allowing unauthenticated attackers to inject arbitrary web scripts into pages. These scripts execute automatically when a user visits the affected page. **Recommendations** Update JetEngine to version 3.8.11 or later.

**Name of the Vulnerable Software and Affected Versions** JetEngine versions prior to 3.8.11 **Description** The JetEngine plugin for WordPress contains a Stored Cross-Site Scripting (XSS) flaw. This occurs because the software fails to properly sanitize input and escape output, allowing unauthenticated attackers to inject arbitrary web scripts into pages. These scripts execute automatically when a user visits the affected page. **Recommendations** Update JetEngine to version 3.8.11 or later.

**Name of the Vulnerable Software and Affected Versions** JetEngine versions prior to 3.8.11 **Description** The JetEngine plugin for WordPress allows unauthenticated attackers to perform PHP Object Injection through the deserialization of untrusted input. PHP Object Injection occurs when an application deserializes data from an untrusted source, potentially allowing an attacker to manipulate the object's properties. While no POP chain (a sequence of gadgets used to achieve code execution) is present in the software itself, the presence of a POP chain in another installed plugin or theme could enable the deletion of arbitrary files, retrieval of sensitive data, or remote code execution. **Recommendations** Update JetEngine to a version newer than 3.8.10.

**Name of the Vulnerable Software and Affected Versions** LearnPress versions prior to 4.3.6 **Description** Improper neutralization of input during web page generation allows for Reflected Cross-Site Scripting (XSS), a flaw where an application includes untrusted data in a web page without proper validation, enabling attackers to execute malicious scripts in the victim's browser. **Recommendations** Update to a version newer than 4.3.6.