Mustafa Ahmed

**Name of the Vulnerable Software and Affected Versions** Simple Membership MailChimp Integration versions prior to 1.9.8 **Description** The settings page of the plugin lacks Cross-Site Request Forgery (CSRF) checks, which is a type of attack that forces an authenticated user to execute unwanted actions. This allows an attacker to trick a logged-in administrator into modifying the configured third-party API key. Consequently, all subsequent member registration data, including name, email, and membership level, is transmitted to an account controlled by the attacker. **Recommendations** Update Simple Membership MailChimp Integration to version 1.9.8 or later.

**Name of the Vulnerable Software and Affected Versions** Tutor LMS versions prior to 4.0.6 **Description** The plugin fails to enforce per-object ownership checks on its course content type. This allows users with the instructor role to access and read the content of private courses created by other instructors through an Insecure Direct Object Reference (IDOR), which occurs when an application provides direct access to objects based on user-supplied input without sufficient authorization checks. **Recommendations** Update to version 4.0.6 or later.

**Name of the Vulnerable Software and Affected Versions** WCFM Marketplace WordPress plugin versions prior to 3.8.1 **Description** The plugin fails to verify if a marketplace vendor owns a review before permitting it to be unapproved or deleted. This allows any vendor to modify or permanently delete reviews associated with stores belonging to other vendors. **Recommendations** Update the WCFM Marketplace WordPress plugin to version 3.8.1 or later.

**Name of the Vulnerable Software and Affected Versions** Advanced Excerpt WordPress plugin versions prior to 4.5 **Description** Stored Cross-Site Scripting (XSS) occurs because the plugin fails to sanitize and escape a settings value before it is rendered on the site front end. This allows administrators, including those lacking the `unfiltered html` capability in multisite environments, to execute malicious scripts in the context of any visitor viewing the affected pages. **Recommendations** Update the Advanced Excerpt WordPress plugin to version 4.5 or later.

**Name of the Vulnerable Software and Affected Versions** Booking for Appointments and Events Calendar versions prior to 9.7 **Description** An issue exists where the plugin fails to verify if an authenticated employee (provider) is associated with the customer record being accessed. This allows any user with an Employee Panel login to read and modify the personal data of any customer by enumerating sequential identifiers. **Recommendations** Update to version 9.7 or later.

**Name of the Vulnerable Software and Affected Versions** HT Contact Form WordPress plugin versions prior to 2.9.3 **Description** An authorization bypass exists in the endpoint that returns saved form drafts. This allows unauthenticated users to access and read personal data stored within these drafts, including names, emails, phone numbers, and addresses. **Recommendations** Update HT Contact Form WordPress plugin to version 2.9.3 or later.

**Name of the Vulnerable Software and Affected Versions** WP Events Manager versions prior to 2.2.5 **Description** An issue exists where the plugin fails to validate the requested quantity during registration for paid events. Because the price is computed based on a quantity controlled by the user, any authenticated user can create a completed booking for a paid event without performing a payment. **Recommendations** Update to version 2.2.5 or later.

**Name of the Vulnerable Software and Affected Versions** Fluent Support versions prior to 2.3.1 **Description** An Insecure Direct Object Reference (IDOR) exists where the software fails to perform a per-ticket access check before reassigning a ticket's customer. This allows a restricted support agent to change the assigned customer of any ticket in the system, including those outside their granted scope. **Recommendations** Update to version 2.3.1 or later.

**Name of the Vulnerable Software and Affected Versions** Brizy WordPress plugin versions prior to 2.8.18 **Description** Insufficient authorization verification in a request handler allows users with the Contributor role or higher to access the content of arbitrary posts. This includes the ability to read private, pending, and draft posts belonging to other users via the `get post info` function. **Recommendations** Update the Brizy WordPress plugin to version 2.8.18 or later.

**Name of the Vulnerable Software and Affected Versions** BuddyPress versions prior to 14.5.0 **Description** Insufficient authorization enforcement on private messaging endpoints allows any authenticated user with Subscriber level permissions or higher to read, modify, or delete private messages belonging to other users. **Recommendations** Update BuddyPress to version 14.5.0 or later.

The LifterLMS WordPress plugin before 10.0.10 does not strip event-handler attributes from a course pricing field before storing and rendering it, allowing users with a course-editing role to inject JavaScript that executes in the session of an administrator who views the course.

**Name of the Vulnerable Software and Affected Versions** Easy Appointments WordPress plugin versions prior to 3.12.28 **Description** An issue exists where a customer-listing handler fails to perform a per-request capability or nonce check. A nonce is a unique token used to prevent replay attacks by ensuring that a request is intentional and authentic. This allows authenticated users with contributor-level access to read the personal information of all stored customers. **Recommendations** Update the plugin to version 3.12.28 or later.

**Name of the Vulnerable Software and Affected Versions** Sina Extension for Elementor versions prior to 3.10.2 **Description** An unauthenticated AJAX handler fails to escape a value reconstructed from request input before reflecting it into the HTML response. This allows unauthenticated attackers to execute arbitrary JavaScript in the browser of users who trigger a crafted request, leading to a Reflected Cross-Site Scripting (XSS) attack. Cross-Site Scripting is a technique where malicious scripts are injected into trusted websites. **Recommendations** Update Sina Extension for Elementor to version 3.10.2 or later.

**Name of the Vulnerable Software and Affected Versions** WPBot versions prior to 8.5.2 **Description** This issue is a second-order SQL injection where the plugin fails to validate field identifiers configured by an administrator before incorporating them into a SQL query. The injection is triggered when a visitor performs a search operation. The vulnerable variable is `qc bot str fields`. **Recommendations** Update to version 8.5.2 or later.

**Name of the Vulnerable Software and Affected Versions** Academy LMS versions prior to 3.8.1 **Description** An Insecure Direct Object Reference (IDOR) exists in several lesson AJAX handlers. The plugin fails to verify the ownership of a user-supplied user identifier, which allows authenticated users with subscriber-level access to read and modify lesson notes belonging to other users and mark their lesson content as completed. **Recommendations** Update Academy LMS to version 3.8.1 or later.

**Name of the Vulnerable Software and Affected Versions** WPBot WordPress plugin versions prior to 8.2.0 **Description** An issue exists in a retrieval-augmented-generation (RAG) settings handler where the software fails to perform a capability or nonce check. This allows authenticated users with subscriber-level access to modify the plugin configuration. A nonce is a unique token used to protect against cross-site request forgery (CSRF) attacks. **Recommendations** Update the WPBot WordPress plugin to version 8.2.0 or later.

**Name of the Vulnerable Software and Affected Versions** WS Form LITE versions prior to 1.11.8 **Description** An issue exists where a capability check is missing on a settings-update action. This allows authenticated users with subscriber-level access and above to modify the plugin settings. **Recommendations** Update to version 1.11.8 or later.

**Name of the Vulnerable Software and Affected Versions** F4 Post Tree WordPress plugin versions prior to 2.0.5 **Description** An issue exists where the plugin fails to perform capability checks or CSRF/nonce verification on an AJAX action. This allows authenticated users with Subscriber-level access and above to modify the parent and menu order of arbitrary posts. CSRF (Cross-Site Request Forgery) is a type of attack that tricks a victim into submitting a malicious request. A nonce is a unique token used to prevent such requests from being replayed. **Recommendations** Update the plugin to version 2.0.5 or later.

**Name of the Vulnerable Software and Affected Versions** Shariff for WordPress versions prior to 1.0.12 **Description** The plugin fails to sanitize or escape the `shariff infourl` setting before it is output in the frontend HTML via the `generateshariff()` function. This flaw allows high-privilege users, such as administrators, to execute Stored Cross-Site Scripting (XSS) attacks, which occurs when a malicious script is permanently stored on the target server and served to other users. This is possible even in environments where the `unfiltered html` capability is disabled, such as in multisite setups. **Recommendations** Update Shariff for WordPress to version 1.0.12 or later.

**Name of the Vulnerable Software and Affected Versions** Drupal Paragraphs versions 0.0.0 through 1.21.0 **Description** A missing authorization issue in the Paragraphs Library module allows forceful browsing. The module fails to sufficiently restrict access to direct child paragraphs of library items through API endpoints. This issue is mitigated if the `paragraphs library` module is not in use or if general write access to paragraphs via other modules is restricted. **Recommendations** Update Drupal Paragraphs to a version later than 1.21.0. As a temporary mitigation, disable the `paragraphs library` module.