Haitam Lazaar

**Name of the Vulnerable Software and Affected Versions** Booking for Appointments and Events Calendar versions prior to 2.4.9 **Description** The plugin fails to require authentication or a valid request token before executing the post-booking action chain. This allows an unauthenticated user to trigger booking notifications and integration callbacks by enumerating the booking identifier. **Recommendations** Update to version 2.4.9 or later.

The GutenKit WordPress plugin before 2.5.1 does not validate or escape style settings saved against a post before using them to build the CSS it outputs on the front end, allowing users with the Contributor role and above to inject arbitrary CSS into pages served to other users and to anonymous visitors. JavaScript execution is not possible at that role, so the impact is limited to defacement, interface redressing and forcing external resources to load.

The Booking for Appointments and Events Calendar WordPress plugin before 9.8 does not verify that an authenticated employee (provider) owns the provider account being updated, allowing any employee with an Employee Panel login to overwrite another employee's cabinet password and take over their account.

**Name of the Vulnerable Software and Affected Versions** MotoPress Hotel Booking WordPress plugin versions prior to 6.2.3 **Description** An issue exists where the software fails to verify record ownership before updating customer records. This allows any authenticated user with low-privileged permissions, such as a Subscriber account, to modify or overwrite the personal data of any customer by providing an arbitrary identifier. **Recommendations** Update the MotoPress Hotel Booking WordPress plugin to version 6.2.3 or later.

**Name of the Vulnerable Software and Affected Versions** MotoPress Hotel Booking WordPress plugin versions prior to 6.2.3 **Description** An issue exists where the software fails to perform authorization or ownership checks on a REST endpoint used to create payment records. This allows unauthenticated users to create completed payment records for arbitrary bookings, falsely marking them as paid. **Recommendations** Update the MotoPress Hotel Booking WordPress plugin to version 6.2.3 or later.

**Name of the Vulnerable Software and Affected Versions** Newsletters WordPress plugin versions prior to 4.16 **Description** When the optional API is enabled, the software fails to strictly compare the API authentication key. This allows unauthenticated attackers to bypass authentication using type juggling—a behavior where a language's loose comparison allows different data types to be treated as equal—to perform privileged actions, including modifying subscriber records and sending emails. **Recommendations** Update the Newsletters WordPress plugin to version 4.16 or later.

**Name of the Vulnerable Software and Affected Versions** Events Made Easy WordPress plugin versions prior to 3.1.2 **Description** An issue exists where the payment authorization token is not bound to the specific payment record being charged. This allows unauthenticated attackers to complete a payment for a low-cost booking and subsequently apply that authorization to mark a separate, higher-priced booking as fully paid. **Recommendations** Update the Events Made Easy WordPress plugin to version 3.1.2 or later.

**Name of the Vulnerable Software and Affected Versions** Events Made Easy WordPress plugin versions prior to 3.1.4 **Description** The plugin fails to verify if a requester is authorized to modify a specific record during unauthenticated data-change requests. It relies solely on a public nonce without implementing per-record tokens or ownership checks, which allows unauthenticated attackers to overwrite the personal data of any person record. **Recommendations** Update the plugin to version 3.1.4 or later.

**Name of the Vulnerable Software and Affected Versions** Ultimate Member WordPress plugin versions prior to 2.12.1 **Description** The plugin fails to filter administrator-level capabilities from the roles available for selection on registration forms. Additionally, the post-registration safeguard designed to prevent the creation of elevated accounts is disabled by default. This allows unauthenticated users to register with a site-defined role that possesses administrator capabilities, granting them full administrative access to the site, provided such a role exists and a role-selection field is active on a published registration form. **Recommendations** Update Ultimate Member WordPress plugin to version 2.12.1 or later.

The Eventin WordPress plugin before 4.1.16 does not properly authorize order creation and accepts an attacker-supplied order status, allowing unauthenticated users to create orders marked as paid without completing any payment.

**Name of the Vulnerable Software and Affected Versions** The Events Calendar versions prior to 6.16.5.1 **Description** The plugin fails to perform an authorization check on an Event Aggregator import REST API route and bypasses an integrity check for a specific status value. This allows unauthenticated attackers to mark existing import records as failed and store arbitrary content within a hidden comment record. **Recommendations** Update to version 6.16.5.1 or later.

**Name of the Vulnerable Software and Affected Versions** Product Addons and Product Options With Custom Fields versions prior to 1.6.15 **Description** An unauthenticated file-upload endpoint does not restrict access and accepts SVG files that are stored and served inline. This allows an unauthenticated attacker to upload a malicious SVG file containing an embedded script. The script executes in the session of any user, including administrators, who opens the file, resulting in Stored Cross-Site Scripting (XSS), which is a technique where malicious scripts are permanently stored on a target server. **Recommendations** Update to version 1.6.15 or later.

**Name of the Vulnerable Software and Affected Versions** Paid Membership Plugin, Ecommerce, User Registration Form, Login Form, User Profile & Restrict Content versions prior to 4.16.17 **Description** An Insecure Direct Object Reference occurs because the software fails to verify if the authenticated user performing a subscription action is the actual owner of the targeted subscription. This allows any user with Subscriber level permissions or higher to cancel active subscriptions belonging to other users. **Recommendations** Update Paid Membership Plugin, Ecommerce, User Registration Form, Login Form, User Profile & Restrict Content to version 4.16.17 or later.

**Name of the Vulnerable Software and Affected Versions** AI Share & Summarize versions prior to 2.0.4 **Description** Users with the Contributor role and above can perform Stored Cross-Site Scripting (XSS) attacks. This occurs because the plugin fails to sanitize and escape certain shortcode attributes, specifically the `title style` attribute, before they are output on a page. Stored XSS is a type of vulnerability where a malicious script is permanently stored on the target server and executed in the browser of users who visit the affected page. **Recommendations** Update AI Share & Summarize to version 2.0.4 or later. As a temporary mitigation, restrict the use of the `title style` shortcode attribute for users with the Contributor role.

**Name of the Vulnerable Software and Affected Versions** Pie Register versions prior to 3.8.4.10 **Description** The plugin fails to use sufficiently random values when generating account verification tokens. This allows unauthenticated attackers to predict a valid token and activate an account without having access to the associated email inbox. **Recommendations** Update to version 3.8.4.10 or later.