Mikica Ivosevic

The TrueBooker WordPress plugin before 1.3.0 does not perform any capability check on one of its setup handlers, and the token it does check is issued to unauthenticated visitors, allowing anyone to overwrite the plugin's entire configuration and to discard any setting they do not supply.

**Name of the Vulnerable Software and Affected Versions** NodeBB versions prior to 0.7.3 **Description** The issue is related to outgoing XSS in the controllers/index.js file. **Recommendations** For versions prior to 0.7.3, update to version 0.7.3 or later to resolve the issue.