Ryan Fabella

The Nexi XPay Build WordPress plugin from 7.6.1 to 7.6.2 does not verify that the saved payment token being requested belongs to the current user, allowing unauthenticated attackers to retrieve other customers' stored card token references together with a valid authorisation signature.

**Name of the Vulnerable Software and Affected Versions** Login & Register Forms versions prior to 4.0.2 **Description** When the verification-code reset mode is enabled, the plugin fails to enforce password reset attempt limits using a server-derived value. Instead, it relies on client-controlled data for both the verification code and the per-source attempt counter. This allows unauthenticated attackers to reset the attempt limit and brute-force the verification code to take over any account, including those with administrator privileges. **Recommendations** Update Login & Register Forms to version 4.0.2 or later.

**Name of the Vulnerable Software and Affected Versions** MultiVendorX WordPress plugin versions prior to 5.0.11 **Description** An issue exists where the plugin fails to verify if the requested store belongs to the current user within a REST API endpoint. This allows any user with vendor-level privileges to access and read the commission and financial data of other vendors. **Recommendations** Update the MultiVendorX WordPress plugin to version 5.0.11 or later.

**Name of the Vulnerable Software and Affected Versions** Podlove Podcast Publisher versions prior to 4.5.3 **Description** Cross-Site Request Forgery (CSRF) occurs because the plugin fails to perform nonce validation—a security mechanism used to protect against forged requests—on certain administrative create and delete actions. This allows an attacker to trick a logged-in administrator into visiting a crafted page, which can result in the creation of rogue records or the deletion of legitimate ones. **Recommendations** Update Podlove Podcast Publisher to version 4.5.3 or later.