Duy Tran

**Name of the Vulnerable Software and Affected Versions** FiboSearch versions prior to 1.34.1 **Description** The plugin fails to consistently exclude password-protected products from unauthenticated AJAX endpoints. This allows unauthenticated users to enumerate and disclose password-protected products and their associated metadata without providing the required password. The affected endpoints are 'dgwt wcas ajax search' (used for autocomplete search) and 'dgwt wcas result details' (used for the Details Panel when querying taxonomy details). **Recommendations** Update FiboSearch to version 1.34.1 or later.

**Name of the Vulnerable Software and Affected Versions** Tag, Category, and Taxonomy Manager versions prior to 3.51.0 **Description** This issue occurs because the plugin fails to verify if a user is authorized to access a referenced post before processing it and returning derived data. Consequently, users with contributor privileges can disclose information from private or draft posts that they do not own. **Recommendations** Update to version 3.51.0 or later.

**Name of the Vulnerable Software and Affected Versions** Easy Appointments WordPress plugin versions prior to 3.12.27 **Description** The plugin fails to verify if the appointment being updated via the customer-data update action belongs to the authenticated user. It relies on a shared nonce (a unique token used to prevent cross-site request forgery) that any authenticated user can obtain from their own appointment edit form. Consequently, a user with subscriber-level privileges can reuse this nonce to overwrite the customer metadata of another user's appointment, specifically the `email`, `name`, `phone`, and `description` variables. If an administrator subsequently changes the appointment status while customer notifications are enabled, the notification intended for the victim is sent to the attacker's email address. **Recommendations** Update Easy Appointments WordPress plugin to version 3.12.27 or later.

**Name of the Vulnerable Software and Affected Versions** Everest Forms versions prior to 3.5.0 **Description** The plugin fails to reliably delete temporary CSV files created during email-notification processing. These files remain publicly accessible within the uploads directory. Unauthenticated attackers can retrieve form submission records of other users by utilizing predictable and enumerable filenames. **Recommendations** Update the plugin to version 3.5.0 or later.

**Name of the Vulnerable Software and Affected Versions** Simple Membership WordPress plugin versions prior to 4.7.5 **Description** Insufficient verification of Stripe webhook requests occurs when no signing secret is configured. Additionally, the plugin fails to escape values retrieved from these requests before displaying them in administrator notices. This allows unauthenticated attackers to perform a Cross-Site Scripting (XSS) attack—injecting arbitrary web scripts that execute within the session of a logged-in administrator. **Recommendations** Update Simple Membership WordPress plugin to version 4.7.5 or later.