Yuya Kotake

**Name of the Vulnerable Software and Affected Versions** Snow Monkey versions prior to 29.1.6 **Description** The Snow Monkey theme for WordPress is susceptible to Server-Side Request Forgery (SSRF) in all versions up to and including 29.1.5. This flaw resides within the `request()` function and allows unauthenticated attackers to initiate web requests to arbitrary locations from the web application. Successful exploitation could enable attackers to query and modify information from internal services. **Recommendations** Update to Snow Monkey version 29.1.6 or later.

**Name of the Vulnerable Software and Affected Versions** Intuitive Custom Post Order WordPress plugin versions prior to 3.1.4 **Description** The issue allows any logged-in user, with roles as low as Subscriber, to update the menu order due to a lack of authorization check in the `update-menu-order` ajax action. **Recommendations** For versions prior to 3.1.4, update to version 3.1.4 or later to resolve the issue. As a temporary workaround, consider restricting access to the `update-menu-order` ajax action to prevent unauthorized menu order updates.

**Name of the Vulnerable Software and Affected Versions** Intuitive Custom Post Order WordPress plugin versions prior to 3.1.4 **Description** The issue lacks CSRF protection in its `update-menu-order` ajax action, allowing an attacker to trick any user into changing the menu order via a CSRF attack. **Recommendations** For versions prior to 3.1.4, update to version 3.1.4 or later to resolve the issue. As a temporary workaround, consider restricting access to the `update-menu-order` ajax action to minimize the risk of exploitation.

**Name of the Vulnerable Software and Affected Versions** BaserCMS (affected versions not specified) **Description** The issue is a cross-site scripting vulnerability in the management system of BaserCMS, a content management system with a Japanese language focus. This vulnerability needs to be addressed when the management system is used by an unspecified number of users. **Recommendations** At the moment, there is no information about a newer version that contains a fix for this vulnerability.