Sorra

The Directorist: AI-Powered Business Directory, Listings & Classified Ads plugin for WordPress is vulnerable to Stored Cross-Site Scripting via 'phone' Listing Field in all versions up to, and including, 8.10.2.1 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with subscriber-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. This is possible because the plugin grants the edit at biz dirs and publish at biz dirs capabilities to the subscriber role, allowing any subscriber-level user to submit and publish listings without moderation.

**Name of the Vulnerable Software and Affected Versions** LatePoint | Calendar & Scheduling for WordPress versions prior to 5.7.0 **Description** An Insecure Direct Object Reference (IDOR) exists in the `set customer object` function due to missing validation on a user-controlled key. This allows unauthenticated attackers to enumerate arbitrary customer records and disclose personally identifiable information, such as first name, last name, email address, and phone number, by iterating the `customer[id]` parameter. This issue is only exploitable when the site is configured with customer authentication disabled (guest checkout enabled). **Recommendations** Update LatePoint | Calendar & Scheduling for WordPress to version 5.7.0 or later. As a temporary mitigation, enable customer authentication to disable guest checkout.