Claudio Marchesini

The eaSYNC Booking WordPress plugin before 1.3.31 does not perform authorization or nonce checks on several of its cancellation-related AJAX actions, allowing unauthenticated users to create booking cancellation requests, trigger booking notification emails, and overwrite the content of the emails the site sends.

The User Rights Access Manager WordPress plugin through 1.1.3 does not restrict access to one of its AJAX account-registration handlers and assigns newly registered accounts a role that was created as a copy of the administrator role, allowing unauthenticated attackers to register an administrator-equivalent account and take over the site.

The Paymentfor Gateway for WooCommerce WordPress plugin before 1.0.6 does not verify the authenticity of an inbound payment notification before marking an order as paid, allowing unauthenticated attackers to mark orders as paid without any payment being completed.

The Fast Courier WordPress plugin before 5.2.4 does not sanitize and escape a value before using it in a SQL query on an unauthenticated REST route, allowing unauthenticated attackers to perform SQL injection and read arbitrary data from the database.

**اسم البرنامج المصاب والإصدارات المتأثرة** إضافة Prenotazioni WordPress الإصدارات السابقة لـ 1.7.6 **الوصف** تفتقر الإضافة إلى فحوصات التفويض والتحقق من تزوير الطلبات عبر المواقع (CSRF) عند حفظ الإعدادات. بالإضافة إلى ذلك، فإنها لا تقوم بتطهير بعض هذه الإعدادات عند عرضها، مما يسمح للمستخدمين غير المصرح لهم بتنفيذ هجمات Stored Cross-Site Scripting (XSS) ضد مسؤولي الموقع والزوار. Stored XSS هو نوع من الثغرات حيث يتم تخزين نص برمجى خبيث بشكل دائم على الخادم المستهدف. **التوصيات** تحديث الإضافة إلى الإصدار 1.7.6 أو إصدار أحدث.

**Name of the Vulnerable Software and Affected Versions** Accept PayPal Payments using Contact Form 7 versions prior to 4.0.7 **Description** The plugin fails to perform authorization checks before exporting stored form submissions. This allows unauthenticated attackers to download payment metadata and personal identifiable information (PII), including names, emails, telephone numbers, postal addresses, and messages, from all users who submitted a payment form. **Recommendations** Update Accept PayPal Payments using Contact Form 7 to version 4.0.7 or later.

**Name of the Vulnerable Software and Affected Versions** Testimonials by BestWebSoft WordPress plugin versions prior to 1.0.9 **Description** An issue exists where a parameter is not properly sanitized and escaped before being used in a SQL query. This allows unauthenticated attackers to perform SQL injection by appending additional SQL commands to the query. **Recommendations** Update the plugin to version 1.0.9 or later.

**Name of the Vulnerable Software and Affected Versions** Magee Shortcodes WordPress plugin versions prior to 2.1.2 **Description** Reflected Cross-Site Scripting occurs because the plugin fails to sanitize and escape user input in certain AJAX actions available to unauthenticated users before reflecting the data in the response. **Recommendations** Update the plugin to version 2.1.2 or later.

**Name of the Vulnerable Software and Affected Versions** Featured Image from URL (FIFU) WordPress plugin versions prior to 6.0.8 Featured Image from URL (FIFU) Premium WordPress plugin versions prior to 8.2.8 **Description** Cross-Site Request Forgery (CSRF) occurs because the software fails to correctly enforce the REST API nonce. When a crafted URL is used, the check is disabled for the entire request, allowing an attacker to force a logged-in administrator to execute any REST API action, including the creation of a new administrator account. **Recommendations** Update Featured Image from URL (FIFU) WordPress plugin to version 6.0.8 or later. Update Featured Image from URL (FIFU) Premium WordPress plugin to version 8.2.8 or later.

**Name of the Vulnerable Software and Affected Versions** BackupSheep WordPress Backup Plugin versions prior to 1.9 **Description** The plugin fails to properly validate its integration key, treating a blank or unset key as valid. This allows unauthenticated attackers to access backup and export endpoints to create and download full site backups, which include the database and user password hashes. Additionally, attackers can trigger file deletion actions on the server, potentially leading to sensitive data disclosure and complete site takeover. **Recommendations** Remove the plugin from any site where it is installed.

**Name of the Vulnerable Software and Affected Versions** MDJM Event Management versions prior to 1.7.8.5 Mobile Events Manager versions prior to 1.4.8.4 **Description** Insufficient validation of capabilities, nonces, and record types during playlist entry removal allows unauthenticated attackers to permanently delete arbitrary posts, pages, and media attachments, bypassing the trash mechanism. **Recommendations** Update MDJM Event Management to version 1.7.8.5 or later. Update Mobile Events Manager to version 1.4.8.4 or later.

**Name of the Vulnerable Software and Affected Versions** Hoo Companion WordPress plugin version 1.0.2 **Description** An import feature lacks authorization and validation checks and fails to sanitize submitted data before storing it as the active theme settings. This allows unauthenticated attackers to perform a Stored Cross-Site Scripting (XSS) attack—where malicious scripts are permanently stored on the server—which will execute for any user viewing the site, including administrators. Additionally, the same request overwrites and destroys existing theme settings. **Recommendations** At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**اسم البرنامج المعرض للخطر والإصدارات المتأثرة** نظام الحجز Pinpoint – الإصدارات السابقة للإصدار 2.9.9.6.9 **الوصف** يمكن للمهاجمين غير المصادق عليهم التلاعب بسعر الدفع النهائي للمنتجات القابلة للحجز المرتبطة بتقويم الحجز. تحدث هذه المشكلة لأن إجراء AJAX `dopbsp woocommerce add to cart` مسجل دون مصادقة أو التحقق من الرقم العشوائي (nonce). يقوم معالج `update` بقراءة قيمة `price total` مباشرةً من معلمة POST `cart data` التي يتحكم فيها المهاجم ويحفظها في قاعدة البيانات باستخدام `$wpdb->insert()` دون التحقق من صحتها مقابل أسعار التقويم المُعدة مسبقًا. وبالتالي، يسترد رد الاتصال `woocommerce before calculate totals` هذه القيمة ويطبقها على `$product->set price()` دون إعادة حساب التكلفة، مما يسمح بتعيين السعر على قيمة عشوائية. **التوصيات** قم بتحديث نظام الحجز Pinpoint – الإصدار 2 إلى إصدار أحدث من 2.9.9.6.8. كإجراء تخفيفي مؤقت، قم بتقييد الوصول إلى إجراء AJAX `dopbsp woocommerce add to cart` أو تجنب استخدام المعلمة `cart data` حتى يتم تطبيق التحديث.

اسم البرنامج المعرض للخطر والإصدارات المتأثرة: المكوّن الإضافي «Payment Gateway for Telcell» لـ WordPress، الإصدار 2.0.1 والإصدارات الأقدم الوصف: تتعلق المشكلة بخلل في إعادة التوجيه المفتوح (Open Redirect). وتحدث هذه المشكلة لأن المعلمة `api url` لا تخضع للتحقق من صحتها قبل إعادة توجيه المستخدم إلى قيمتها. وقد يؤدي ذلك إلى إمكانية إعادة التوجيه الخبيثة. التوصيات: بالنسبة للإصدارات 2.0.1 والإصدارات الأقدم، قم بالتحديث إلى إصدار يعمل على إصلاح هذه المشكلة. كحل مؤقت، ضع في اعتبارك تقييد الوصول إلى المعلمة `api url` لتقليل مخاطر الاستغلال.

**Name of the Vulnerable Software and Affected Versions** The Biteship: Plugin Ongkos Kirim Kurir Instant, Reguler, Kargo WordPress plugin versions prior to 2.2.25 **Description** The issue is related to a Reflected Cross-Site Scripting problem. It occurs because the `biteship error` and `biteship message` parameters are not properly sanitized and escaped before being outputted back on the page. This could be exploited against high-privilege users, such as administrators. **Recommendations** For versions prior to 2.2.25, update to version 2.2.25 or later to resolve the issue. As a temporary workaround, consider restricting access to the parameters `biteship error` and `biteship message` to minimize the risk of exploitation.

**Name of the Vulnerable Software and Affected Versions** WP Discord Invite WordPress plugin versions prior to 2.5.1 **Description** The issue allows an unauthenticated attacker to perform actions on behalf of a logged-in administrator by tricking them into submitting a crafted request, due to a lack of protection against CSRF attacks. **Recommendations** For WP Discord Invite WordPress plugin versions prior to 2.5.1, update to version 2.5.1 or later to resolve the issue.

**Name of the Vulnerable Software and Affected Versions** ArtPlacer Widget WordPress plugin versions prior to 2.20.7 **Description** The issue is related to the lack of sanitization and escaping of the `id` parameter before submitting a query, leading to a SQL injection (SQLI) that can be exploited by editors and above. Due to the absence of a CSRF check, the issue could also be exploited via a CSRF attack against a logged-in editor or higher. **Recommendations** For versions prior to 2.20.7, update to version 2.20.7 or later to resolve the issue. As a temporary workaround, consider restricting access to the plugin's functionality for editors and above until the update is applied. Additionally, restrict the use of the `id` parameter in queries to minimize the risk of exploitation.

**Name of the Vulnerable Software and Affected Versions** BSK Contact Form 7 Blacklist WordPress plugin versions 1.0.1 and earlier **Description** The issue is related to a Reflected Cross-Site Scripting problem. It occurs because the `inserted count` parameter is not properly sanitized and escaped before being outputted back in the page. This could be exploited against high-privilege users, such as administrators. **Recommendations** For versions 1.0.1 and earlier, as a temporary workaround, consider disabling the functionality that outputs the `inserted count` parameter until a patch is available. Restrict access to areas where this parameter is used to minimize the risk of exploitation. Update to a version that fixes this issue once it becomes available.

**Name of the Vulnerable Software and Affected Versions** The Martins Free & Easy SEO BackLink Link Building Network WordPress plugin versions prior to 1.2.30 **Description** The issue is related to a Reflected Cross-Site Scripting problem, where a parameter is not properly sanitized and escaped before being outputted back in the page. This could be exploited against high-privilege users, such as administrators. **Recommendations** For versions prior to 1.2.30, update to version 1.2.30 or later to resolve the issue. As a temporary workaround, consider restricting access to the plugin's functionality to minimize the risk of exploitation.

**Name of the Vulnerable Software and Affected Versions** Bonus for Woo WordPress plugin versions prior to 5.8.3 **Description** The issue is related to Reflected Cross-Site Scripting, which occurs because some parameters are not properly sanitised and escaped before being outputted back in pages. This could be exploited against high-privilege users, such as administrators. **Recommendations** For versions prior to 5.8.3, update to version 5.8.3 or later to resolve the issue.