Jtb75

The Simply Schedule Appointments plugin for WordPress is vulnerable to Insecure Direct Object Reference in all versions up to, and including, 1.6.12.31 via the 'complete group' parameter due to missing validation on a user controlled key. This makes it possible for authenticated attackers, with subscriber-level access and above, to disclose every co-booker's private per-appointment id token (exposed as public token) alongside their PII (name and email address), then use each leaked token to read, overwrite arbitrary appointment meta on, or cancel the co-booker's appointment via the same REST controller. Exploitation requires the attacker to possess a valid id token for any single appointment within the targeted group booking.

**Name of the Vulnerable Software and Affected Versions** WP Ultimate Review versions prior to 2.4.3 **Description** Authenticated attackers with subscriber-level access and above can execute arbitrary shortcodes. This occurs because the software fails to properly validate a value before executing the `do shortcode` function. The issue is triggered via the `xs submit review data[xs reviw summery]` parameter. **Recommendations** Update WP Ultimate Review to a version newer than 2.4.2. Avoid using the `xs submit review data[xs reviw summery]` parameter until the update is applied.

**Name of the Vulnerable Software and Affected Versions** Bookly versions prior to 28.2 **Description** An Insecure Direct Object Reference (IDOR) exists due to missing validation on a user-controlled key. Unauthenticated attackers can enumerate customer conversations by incrementing the `conversation id` parameter, as these IDs are sequential integers and lack owner, user, or session identifiers. This allows attackers to read full AI booking conversation transcripts, leaking sensitive data such as names, email addresses, phone numbers, and appointment details. Additionally, attackers can inject arbitrary messages into victim conversations, which are then replayed to the Cloud AI worker along with the private history. **Recommendations** Update Bookly to version 28.2 or later. As a temporary mitigation, restrict access to the functionality utilizing the `conversation id` parameter.