Matilj

**Name of the Vulnerable Software and Affected Versions** Loco Translate versions prior to 2.8.8 **Description** The Loco Translate plugin for WordPress contains a Stored Cross-Site Scripting issue involving PO File Extracted Comments. This occurs because of insufficient input sanitization and output escaping, allowing authenticated attackers with translator-level access or higher to inject arbitrary web scripts into pages. These scripts execute whenever a user visits the affected page. **Recommendations** Update the plugin to version 2.8.8 or later.

**Name of the Vulnerable Software and Affected Versions** Online Booking & Scheduling Calendar for WordPress by vcita versions prior to 4.6.1 **Description** Insufficient input sanitization and output escaping allow unauthenticated attackers to perform Stored Cross-Site Scripting (XSS), a technique where malicious scripts are permanently stored on the target server. This occurs via the `business id` parameter within the REST API endpoint. An attacker can inject arbitrary web scripts into pages that execute automatically when a user accesses the affected page. **Recommendations** Update the plugin to a version newer than 4.6.0. As a temporary mitigation, restrict access to the REST API endpoint utilizing the `business id` parameter.

**Name of the Vulnerable Software and Affected Versions** MotoPress Appointment Booking versions prior to 2.4.6 **Description** Insufficient escaping of user-supplied input and lack of proper preparation in SQL queries allow authenticated attackers with the `mpa appointment employee` custom role to perform SQL Injection. By manipulating the `s` parameter, an attacker can append additional SQL queries to extract sensitive information from the database. **Recommendations** Update the plugin to version 2.4.6 or later. Restrict access to the `mpa appointment employee` role to trusted users only.