Gidget Smith

The Media Library Assistant plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'mla gallery' shortcode in versions up to and including 3.35. This is due to insufficient input sanitization and output escaping on the mla link href parameter when mla output is set to 'paginate links', where the paginate links() function processes the value through mla process shortcode parameter() and replace query parameter() without proper URL escaping, then outputs it directly in href attributes without applying esc url(). This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.

**Name of the Vulnerable Software and Affected Versions** Payment Plugins for Stripe WooCommerce versions prior to 4.0.8 **Description** An authorization bypass exists because the plugin fails to properly verify if a user is authorized to perform specific actions. Unauthenticated attackers can mark pending asynchronous WooCommerce orders as paid by forging a `charge.pending` event. This is achieved by controlling the `metadata.order id` and `metadata.gateway id` variables, and providing a charge object with `status=succeeded` and `captured=true`. This process triggers the `payment complete()` function and subsequent fulfillment flows using a transaction ID supplied by the attacker. This issue is exploitable if the merchant has left the `webhook secret test` or `webhook secret live` options blank, which is the default configuration. **Recommendations** Update to a version newer than 4.0.7. Manually configure a Stripe-issued `whsec ` value in the `webhook secret test` or `webhook secret live` options to enable signature verification.

**Name of the Vulnerable Software and Affected Versions** LatePoint – Calendar Booking Plugin for Appointments and Events versions prior to 5.6.3 **Description** An Insecure Direct Object Reference (IDOR) exists due to missing validation on a user-controlled key. This allows unauthenticated attackers to create approved bookings for services restricted to administrators and agents, which consumes restricted appointment capacity. The issue is exploitable through the `service id` parameter via the `params[booking][service id]` parameter in the 'steps load step' endpoint and the `presets[selected service]` parameter in the 'steps start' endpoint. **Recommendations** Update LatePoint – Calendar Booking Plugin for Appointments and Events to version 5.6.3 or later. Restrict access to the 'steps load step' and 'steps start' endpoints to minimize the risk of unauthorized bookings.

**Name of the Vulnerable Software and Affected Versions** Custom Twitter Feeds versions prior to 2.5.5 **Description** The Custom Twitter Feeds plugin for WordPress contains a Stored Cross-Site Scripting issue. This occurs because the `CTF Display Elements::get post text()` function fails to properly escape output when rendering cached tweet text. Specifically, the 'ctf get more posts' AJAX action is accessible to unauthenticated users and outputs cached tweet data using `nl2br()` without HTML escaping. An attacker can inject malicious HTML or JavaScript into the cached tweet data, which then executes when an unauthenticated user accesses the affected endpoint. **Recommendations** Update the plugin to a version later than 2.5.4. As a temporary workaround, restrict access to the 'ctf get more posts' AJAX action to minimize the risk of exploitation.