Philipp Doblhofer

The Bookit — Booking & Appointment Calendar WordPress plugin before 2.6.0.1 does not properly restrict the data returned by an availability-check request, allowing unauthenticated users to retrieve other customers' appointment details, including free-text booking comments and contact information.

The MultiVendorX WordPress plugin before 5.0.16 does not restrict who can update its role and capability settings, allowing users holding its vendor role to grant that role administrator-level capabilities and take over the site.

The CoolClock WordPress plugin before 4.3.8 does not properly escape a custom skin setting before outputting it inside an inline script, allowing users with contributor-level access and above to inject arbitrary JavaScript that executes when the content is viewed.

The CoolClock WordPress plugin before 4.3.8 does not properly escape a skin setting before outputting it within an HTML attribute, allowing users with contributor-level access and above to inject arbitrary web scripts that execute when the content is viewed.

The Loops & Logic WordPress plugin before 4.3.0 does not restrict its public template-data action to the data a visitor is permitted to see, allowing unauthenticated users to read arbitrary user records (including email addresses and roles) and arbitrary site options.

**Name of the Vulnerable Software and Affected Versions** EventPrime – Events Calendar, Bookings and Tickets versions prior to 4.3.4.3 **Description** Stored Cross-Site Scripting occurs due to insufficient input sanitization and output escaping. This allows attackers to inject arbitrary web scripts into pages that execute when accessed by other users. The issue is triggered via the `new event type background color` parameter. If the Guest Submissions setting `allow submission by anonymous user` is enabled, unauthenticated attackers can submit event types via the frontend form. Otherwise, exploitation requires at least a subscriber-level authenticated account. **Recommendations** Update EventPrime – Events Calendar, Bookings and Tickets to version 4.3.4.3 or later. Disable the `allow submission by anonymous user` setting to prevent unauthenticated exploitation.

**Name of the Vulnerable Software and Affected Versions** Services Section Block – Showcase Service Details in Grid or Columns versions prior to 1.4.5 **Description** Insufficient input sanitization and output escaping allow authenticated attackers with contributor-level access or higher to perform Stored Cross-Site Scripting. This is achieved via the `link` block attribute, where arbitrary web scripts can be injected into pages. The payload persists within HTML comments in `post content`, bypassing the `wp kses post()` sanitization function during the save process. The script executes through the primary service link anchor or a secondary title-wrapped anchor when the `linkIn` option is set to `title`. **Recommendations** Update to a version later than 1.4.4.