Md. Tareq Ahamed Jony

The MotoPress Hotel Booking plugin for WordPress contains an authorization bypass flaw resulting from improper verification of user permissions. Unauthenticated attackers can overwrite or delete internal notes by providing an arbitrary booking ID. This is possible because the required nonce is exposed in the HTML source of all public pages via `wp localize script` in the `MPHB. data.nonces` variable, allowing any visitor to perform the action without an account. The affected variable is ` mphb booking internal notes`.

The WPBookit plugin for WordPress is susceptible to Stored Cross-Site Scripting. This is due to insufficient input sanitization and output escaping in the `wpb user name` and `wpb user email` parameters. An unauthenticated attacker can inject arbitrary web scripts into pages, which will execute when a user accesses the injected page.

The SEATT: Simple Event Attendance plugin for WordPress is susceptible to Cross-Site Request Forgery (CSRF). This is caused by a lack of nonce validation when deleting events. An unauthenticated attacker could potentially delete events by tricking an administrator into performing an action, such as clicking a malicious link. The vulnerable functionality involves event deletion.