Hhhai

**Name of the Vulnerable Software and Affected Versions** LatePoint – Calendar Booking Plugin for Appointments and Events versions prior to 5.6.2 **Description** An authorization bypass exists because the plugin fails to properly verify if a user is authorized to perform specific actions. Unauthenticated attackers can modify personally identifiable information, including first name, last name, phone number, and notes, of any existing customer record, including those associated with administrator accounts. This is achieved by submitting the booking form using a known customer email address. This issue is exploitable when the plugin is configured to allow guest bookings, which allows the execution of the vulnerable unauthenticated code path in the `process step customer()` function. **Recommendations** Update to a version newer than 5.6.1. As a temporary mitigation, disable guest bookings to prevent the `process step customer()` function from being accessed by unauthenticated users.

**Name of the Vulnerable Software and Affected Versions** Booktics versions prior to 1.0.22 **Description** The Booktics plugin for WordPress allows unauthenticated attackers to perform PHP Object Injection through the deserialization of untrusted input. PHP Object Injection occurs when an application deserializes data from an untrusted source, potentially allowing an attacker to manipulate the object's properties. While no POP chain is present in the software itself, the presence of a POP chain via another installed plugin or theme could enable the deletion of arbitrary files, retrieval of sensitive data, or remote code execution. **Recommendations** Update to a version newer than 1.0.21.

**Name of the Vulnerable Software and Affected Versions** WP Job Portal versions prior to 2.5.3 **Description** The WP Job Portal plugin for WordPress contains a flaw where insufficient escaping of user-supplied parameters and lack of proper preparation of SQL queries allow authenticated attackers with contributor-level access or higher to perform SQL Injection. This allows the attacker to append additional SQL queries to existing ones to extract sensitive information from the database. **Recommendations** Update the plugin to a version newer than 2.5.2.

**Name of the Vulnerable Software and Affected Versions** WP Post Author versions prior to 3.9.2 **Description** The WP Post Author plugin for WordPress contains a flaw where insufficient escaping of user-supplied parameters and lack of proper preparation of SQL queries allow authenticated attackers with contributor-level access or higher to perform SQL Injection. This allows the attacker to append additional SQL queries to existing ones to extract sensitive information from the database. **Recommendations** Update to a version newer than 3.9.1.

**Name of the Vulnerable Software and Affected Versions** WC Vendors Marketplace versions prior to 2.6.9 **Description** The WC Vendors – WooCommerce Multivendor, WooCommerce Marketplace, Product Vendors plugin for WordPress contains a flaw where insufficient escaping of user-supplied parameters and lack of proper preparation of SQL queries allow authenticated attackers with subscriber-level access or higher to perform SQL Injection. This allows the addition of malicious SQL queries to existing ones to extract sensitive information from the database. **Recommendations** Update to a version newer than 2.6.8.

**Name of the Vulnerable Software and Affected Versions** Premmerce Wishlist for WooCommerce versions prior to 1.1.12 **Description** An unauthenticated SQL Injection exists in the Premmerce Wishlist for WooCommerce plugin for WordPress. The issue occurs due to insufficient escaping of user-supplied parameters and a lack of proper preparation of the SQL query. This allows an attacker to append additional SQL queries to existing ones to extract sensitive information from the database. **Recommendations** Update Premmerce Wishlist for WooCommerce to version 1.1.12 or later.

**Name of the Vulnerable Software and Affected Versions** VeronaLabs Slimstat Analytics versions prior to 5.4.12 **Description** Improper Neutralization of Special Elements used in an SQL Command allows Blind SQL Injection. This occurs when the application fails to properly sanitize user-supplied data before including it in a database query, enabling an attacker to infer information from the database by observing the application's response to specific queries. **Recommendations** Update to version 5.4.12 or later.

**Name of the Vulnerable Software and Affected Versions** WP Job Portal versions prior to 2.5.2 **Description** Improper neutralization of special elements used in an SQL command allows for Blind SQL Injection. Blind SQL Injection is a technique where an attacker asks the database true or false questions and determines the answer based on the application's response. **Recommendations** Update to a version newer than 2.5.1.

**Name of the Vulnerable Software and Affected Versions** Ahmad WP Job Portal versions prior to 2.5.1 **Description** Improper neutralization of input during web page generation allows Reflected Cross-Site Scripting (XSS), a flaw where an application includes untrusted data in a web page without proper validation or escaping, enabling attackers to execute malicious scripts in the victim's browser. **Recommendations** Update to a version later than 2.5.1.

**Name of the Vulnerable Software and Affected Versions** e2pdf versions prior to 1.32.15 **Description** The software contains an issue involving improper neutralization of input during web page generation, which allows for Reflected Cross-site Scripting (XSS). This occurs when an application includes untrusted data in a web page without proper validation or encoding, enabling an attacker to execute malicious scripts in the victim's browser. **Recommendations** Update e2pdf to version 1.32.15 or later.

**Name of the Vulnerable Software and Affected Versions** Tainacan versions prior to 1.0.4 **Description** Tainacan is subject to Blind SQL Injection, which occurs when an application fails to properly neutralize special elements used in an SQL command, allowing an attacker to infer data by observing the application's response to specific queries. **Recommendations** Update to a version later than 1.0.3.

**Name of the Vulnerable Software and Affected Versions** WPCS versions prior to 1.3.2 **Description** Improper neutralization of input during web page generation in the RealMag777 WPCS currency-switcher allows for DOM-Based Cross-site Scripting (XSS), a flaw where the application contains client-side JavaScript that processes data from an untrusted source in an unsafe way, typically by writing the data to a dangerous sink. **Recommendations** Update to a version later than 1.3.1.

**Name of the Vulnerable Software and Affected Versions** Smart Coupons for WooCommerce versions prior to 2.3.0 **Description** A missing authorization issue in WebToffee Smart Coupons for WooCommerce allows for the exploitation of incorrectly configured access control security levels. This is a broken access control flaw where the system fails to properly verify if a user has the necessary permissions to perform an action. **Recommendations** Update to version 2.3.0 or later.

**Name of the Vulnerable Software and Affected Versions** TotalSuite TotalContest Lite versions through 2.9.1 **Description** An issue exists in TotalSuite TotalContest Lite that allows for object injection due to the deserialization of untrusted data. This can lead to potential compromise of the system. **Recommendations** Versions prior to 2.9.1 should be updated. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** WPC Product Bundles for WooCommerce versions n/a through 8.4.5 **Description** An issue exists in WPClever WPC Product Bundles for WooCommerce where incorrectly configured access control security levels can be exploited due to a missing authorization check in the `woo-product-bundle` component. This allows unauthorized access. **Recommendations** Update WPC Product Bundles for WooCommerce to a version later than 8.4.5.

**Name of the Vulnerable Software and Affected Versions** Maciej Bis Permalink Manager Lite versions prior to 2.5.3 **Description** An authorization issue exists in Maciej Bis Permalink Manager Lite permalink-manager. The issue involves incorrectly configured access control security levels, potentially allowing unauthorized access. **Recommendations** Update Maciej Bis Permalink Manager Lite to version 2.5.3 or later.

**Name of the Vulnerable Software and Affected Versions** Delay Redirects versions through 1.0.0 **Description** Delay Redirects is susceptible to a DOM-Based Cross-site Scripting (XSS) issue due to improper neutralization of input during web page generation. This allows for potential malicious code execution within the context of the user's browser. **Recommendations** Update Delay Redirects to a version later than 1.0.0.