Erwan Lr

The Payment Plugins for PayPal WooCommerce WordPress plugin before 2.0.26 does not validate the order key before adding order data to the JavaScript configuration it outputs on the front end, allowing unauthenticated users to obtain the secret that gates access to any order and, through it, that customer's billing and shipping details, by iterating sequential order identifiers.

The WP Travel WordPress plugin before 12.0.2 does not verify that the requester is authorized to act on the booking targeted by one of its front-end payment-message handlers, allowing unauthenticated attackers to cancel the payment on any customer's booking.

**Name of the Vulnerable Software and Affected Versions** AI Website Builder WordPress plugin (GitHub build) version 1.0.0 **Description** Lack of authorization and nonce checks on REST API routes allows unauthenticated attackers to perform several unauthorized actions. These include installing and activating plugins and themes, importing content from a controlled URL, and deleting site content and media. Additionally, attackers can write arbitrary files to the uploads directory. In environments where the server is configured to execute PHP files from the uploads directory, this can lead to remote code execution (RCE), which is the ability to execute arbitrary commands on the server. **Recommendations** Update AI Website Builder WordPress plugin (GitHub build) version 1.0.0 to a version that implements proper authorization and nonce checks on its REST API routes.

The Pods WordPress plugin before 3.3.9.2 does not restrict which functions a display callback may resolve to, allowing users with the author role and above to read arbitrary files from the server, including files outside the web root. Only sites using the restricted display-callback mode are affected, which is the automatic default on installations whose first Pods version predates 3.1.

**Name of the Vulnerable Software and Affected Versions** Simple Ajax Chat versions prior to 20260827 **Description** Stored Cross-Site Scripting (XSS) occurs because the plugin fails to escape chat message content before rendering it. This allows unauthenticated users to inject arbitrary HTML attributes into the page and execute scripts in the browser of any user viewing the chat, including administrators. **Recommendations** Update Simple Ajax Chat to version 20260827 or later.

**Name of the Vulnerable Software and Affected Versions** User Frontend WordPress plugin versions prior to 4.3.11 **Description** Authenticated users with subscriber-level access and above can perform PHP Object Injection, which may lead to remote code execution if a suitable gadget chain is present on the site. This occurs because the plugin fails to prevent user-supplied field values from being deserialized when a submitted post is reopened in its frontend editing form. PHP Object Injection is a technique where untrusted input is passed to the `unserialize()` function, allowing an attacker to manipulate the object's properties and potentially execute arbitrary code. **Recommendations** Update User Frontend WordPress plugin to version 4.3.11 or later.

**Name of the Vulnerable Software and Affected Versions** Brave WordPress plugin versions prior to 0.8.8 **Description** An issue exists where a URL parameter used to pre-fill a form field is not properly sanitized before being passed to the WordPress shortcode engine. This allows unauthenticated attackers to execute arbitrary shortcodes registered on the site server-side. **Recommendations** Update the Brave WordPress plugin to version 0.8.8 or later.

**Name of the Vulnerable Software and Affected Versions** MStore API versions prior to 4.21.1 **Description** The MStore API WordPress plugin fails to verify if the order targeted by its wallet payment handling belongs to the requester. Additionally, it does not deduct the wallet balance for most payment methods. This allows any authenticated user, including those with Subscriber roles, to mark arbitrary orders as paid without any actual payment being processed. **Recommendations** Update MStore API to version 4.21.1 or later.

**Name of the Vulnerable Software and Affected Versions** Newsletters versions prior to 4.17 **Description** When the optional API is enabled, the software fails to generate its API key using a sufficiently random source, instead deriving it from a publicly known value. This allows unauthenticated attackers to compute the key and perform privileged actions, including sending emails and adding or deleting subscribers. **Recommendations** Update to version 4.17 or later.

**Name of the Vulnerable Software and Affected Versions** Newsletters WordPress plugin versions prior to 4.17 **Description** Cross-Site Request Forgery (CSRF) occurs because the plugin fails to perform nonce or capability checks when saving settings screens. This allows an attacker to trick a logged-in administrator into overwriting arbitrary plugin settings, including the credentials used to protect its API, by submitting malicious parameters that are written directly into the plugin options. **Recommendations** Update Newsletters WordPress plugin to version 4.17 or later.

**Name of the Vulnerable Software and Affected Versions** User Profile Builder versions prior to 4.0.1 **Description** The User Profile Builder WordPress plugin fails to properly restrict its front-end file upload feature. This flaw allows unauthenticated visitors to obtain privileges reserved for privileged roles, enabling them to list the site media library and modify unpublished posts, pages, and media items belonging to other users. **Recommendations** Update the User Profile Builder plugin to version 4.0.1 or later.

**Name of the Vulnerable Software and Affected Versions** MStore API versions prior to 4.21.1 **Description** The MStore API WordPress plugin fails to verify if the order targeted by a delivery endpoint belongs to the user making the request. This allows any authenticated user, including those with Subscriber privileges, to mark arbitrary orders as completed and paid without performing an actual payment. **Recommendations** Update the MStore API plugin to version 4.21.1 or later.

**Name of the Vulnerable Software and Affected Versions** shared-files-pro WordPress plugin versions prior to 1.7.70 **Description** An issue exists where the plugin fails to validate the file path provided during the creation of a featured image. This allows unauthenticated attackers to read arbitrary files from the server and republish the contents to a public URL. **Recommendations** Update shared-files-pro WordPress plugin to version 1.7.70 or later.

**Name of the Vulnerable Software and Affected Versions** Workeera WordPress plugin versions prior to 1.0.6 **Description** Users with a role as low as subscriber can upload arbitrary files to a publicly reachable directory. This occurs because the plugin does not restrict the profile values a candidate can submit nor validate the file type being written. This flaw can lead to remote code execution, a situation where an attacker can execute arbitrary commands on the server. **Recommendations** Update the Workeera WordPress plugin to version 1.0.6 or later.

**Name of the Vulnerable Software and Affected Versions** Royal Addons for Elementor versions prior to 1.7.1066 **Description** Insufficient validation of widget settings before they are output within an HTML attribute allows users with the Contributor role and above to execute Stored Cross-Site Scripting (XSS) attacks. This issue specifically affects the effect settings of the Image Accordion Widget. **Recommendations** Update Royal Addons for Elementor to version 1.7.1066 or later.

**Name of the Vulnerable Software and Affected Versions** Duplicate Post WordPress plugin versions prior to 1.5.6 **Description** Insufficient capability checks before returning post data allow users with a delegated role to access content, metadata, and passwords of posts they are not authorized to view, including private and draft content belonging to other users. **Recommendations** Update Duplicate Post WordPress plugin to version 1.5.6 or later.

**Name of the Vulnerable Software and Affected Versions** Duplicate Post WordPress plugin versions prior to 1.5.6 **Description** Insufficient validation occurs when duplicating posts, as the plugin fails to verify if the user has permission to read the content before the duplication process. This allows users with delegated roles to republish password-protected posts created by other users, making the content publicly readable. **Recommendations** Update Duplicate Post WordPress plugin to version 1.5.6 or later.

**Name of the Vulnerable Software and Affected Versions** Passster WordPress plugin versions prior to 4.3.9 **Description** The plugin fails to correctly match its public endpoint paths when determining which REST API requests should bypass global password protection. This occurs because the system compares paths as an unanchored substring of the request URI instead of using the resolved route. Consequently, an unauthenticated attacker can read the content of posts and pages that are globally password-protected. **Recommendations** Update Passster WordPress plugin to version 4.3.9 or later.

**Name of the Vulnerable Software and Affected Versions** KiviCare versions prior to 4.5.4 **Description** An Insecure Direct Object Reference (IDOR) exists where the software fails to verify if the requesting user has the necessary permissions to access a specific media file. This allows authenticated users with patient-level privileges to download any file stored in the media library, which may include sensitive medical reports belonging to other patients. **Recommendations** Update KiviCare to version 4.5.4 or later.

**Name of the Vulnerable Software and Affected Versions** TrueBooker versions prior to 1.2.7 **Description** Insufficient authorization checks in an AJAX action allow unauthenticated users to delete arbitrary appointment records, including associated booking items and payment records. This occurs through the `update appointment booked` action. **Recommendations** Update TrueBooker to version 1.2.7 or later.