Chirita Catalin-Andrei

**Name of the Vulnerable Software and Affected Versions** GiveWP – Donation Plugin and Fundraising Platform versions prior to 4.16.4 **Description** Insufficient input sanitization and output escaping allow authenticated attackers with give worker-level access and above to perform Stored Cross-Site Scripting. The issue occurs when the `twitter message` Sequoia Template Setting is used, allowing the injection of arbitrary web scripts. These scripts execute when a donor clicks the Share on Twitter button on the Sequoia donation confirmation view, as the unescaped `twitter message` value is evaluated within a JavaScript template literal. **Recommendations** Update GiveWP – Donation Plugin and Fundraising Platform to version 4.16.4 or later.

**Name of the Vulnerable Software and Affected Versions** ProfilePress versions prior to 4.16.19 **Description** An arbitrary file upload issue exists in the `allowed mime types()` function. The plugin unconditionally registers an `upload mimes` filter that adds executable file extensions such as .exe, .apk, and .msi to the global WordPress MIME allowlist. Because this filter is registered globally on every request and not limited to digital-product upload contexts, authenticated attackers with author-level access or higher can upload executable files, potentially leading to remote code execution. **Recommendations** Update to a version newer than 4.16.18.

**Name of the Vulnerable Software and Affected Versions** GiveWP – Donation Plugin and Fundraising Platform versions prior to 4.16.2 **Description** Insufficient input sanitization and output escaping allow authenticated attackers with Give Worker-level access or higher to perform Stored Cross-Site Scripting (XSS). This occurs via the `sequoia[introduction][image]` parameter, enabling the injection of arbitrary web scripts into pages that execute when accessed by other users. **Recommendations** Update GiveWP – Donation Plugin and Fundraising Platform to version 4.16.2 or later. Restrict access to the `sequoia[introduction][image]` parameter for users with Give Worker-level permissions until the update is applied.

**Name of the Vulnerable Software and Affected Versions** LatePoint – Calendar Booking Plugin for Appointments and Events versions prior to 5.4.2 **Description** A privilege escalation issue exists due to a missing authorization check in the `execute()` function of the connect-customer-to-wp-user ability. The system only requires the `customer edit` capability, which is granted to the `latepoint agent` role by default, but fails to verify if the target WordPress user ID belongs to a privileged account. This allows authenticated attackers with the `latepoint agent` role to link a LatePoint customer record to an administrator account and reset the administrator's password through the standard customer password-reset process, leading to a full site takeover. **Recommendations** Update the plugin to a version later than 5.4.1.