Décio Brandão

The Opti-Behavior – Self-Hosted Heatmaps, Session Recordings, Funnels, A/B Testing & Smart Insights plugin for WordPress is vulnerable to Stored DOM-Based Cross-Site Scripting via the 'targetUrl' parameter in all versions up to, and including, 1.9.2.1 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. The ingest endpoint is gated only by a nonce that is publicly emitted to every anonymous visitor on tracked pages via optiBehaviorHeatmapConfig.nonce, meaning no account or authentication of any kind is required to write the malicious payload.

The Vulnity Security plugin for WordPress is vulnerable to authentication bypass in all versions up to, and including, 1.4.3 This is due to insufficient protection of the delegated-login pairing credential file on Nginx-based installations, where the plugin's generated server configuration snippet guards the wrong directory path. This makes it possible for unauthenticated attackers to retrieve the stored credentials, forge signed REST API requests, and log in as an administrator.

**Name of the Vulnerable Software and Affected Versions** ByteCoreStack – MCP Connector for AI Tools versions prior to 1.2.4 **Description** Authenticated users with Subscriber-level access or higher can elevate their privileges to Administrator. The issue exists in the `execute tool` function within the `wp update user meta` MCP tool, which uses an insufficient check `current user can('edit user', $uid)`. Because WordPress core resolves this check to a `read` primitive when a user targets their own ID, and the plugin uses an incomplete blocklist for meta keys that fails to protect `wp capabilities` and `wp user level`, attackers can modify their own roles. This is achieved by sending a request to the MCP JSON-RPC endpoint using the `key` parameter set to `wp capabilities` with an administrator role array. **Recommendations** Update to a version later than 1.2.3. Restrict access to the MCP JSON-RPC endpoint to minimize the risk of exploitation.

**Name of the Vulnerable Software and Affected Versions** The product name cannot be determined. (affected versions not specified) **Description** An issue exists where the `mp SetEnddisc()` function copies a user-supplied PSN endpoint value without performing length validation. This flaw allows a buffer overflow via the ppp(8) command interface, which a local user can exploit to crash ppp(8) or potentially execute arbitrary code with root privileges. **Recommendations** At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** ppp (affected versions not specified) **Description** The `mp Enddisc()` function uses incorrect length calculations when formatting endpoint discriminator addresses for display. This flaw allows a received endpoint option to overflow a global result buffer, which could enable a malicious PPP peer to crash the `ppp(8)` process or potentially execute arbitrary code with root privileges. **Recommendations** At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** FreeBSD (affected versions not specified) **Description** A flaw exists in the FreeBSD kernel within the `LcpDecodeConfig()` function due to the improper handling of a length parameter mismatch. A remote attacker could exploit this issue to cause a denial of service or execute arbitrary code. **Recommendations** At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**اسم البرنامج المعرض للخطر والإصدارات المتأثرة** TrueBooker – نظام حجز المواعيد والجدولة، الإصدارات الأقدم من 1.2.7 **الوصف** يوجد ثغرة في تجاوز التفويض بسبب عدم وجود عمليات تحقق من المصادقة أو الصلاحيات في معالج AJAX `admin user create cus`. وهذا يسمح للمهاجمين غير المصادق عليهم بتمرير معلمة `truebooker wp user id` التي يمكن التحكم فيها مباشرة إلى الدالة `wp update user()`. ومن خلال استغلال هذه الثغرة، يمكن للمهاجم استبدال عنوان البريد الإلكتروني لأي مستخدم في WordPress، بما في ذلك المسؤولين، واستخدام الإجراء القياسي لاستعادة كلمة المرور المفقودة للسيطرة الكاملة على الحساب. **التوصيات** قم بتحديث المكون الإضافي إلى إصدار أحدث من 1.2.6. كإجراء تخفيفي مؤقت، قم بتقييد الوصول إلى معالج AJAX `admin user create cus`.