Sajjad Haqi

**Name of the Vulnerable Software and Affected Versions** WP Crowdfunding WordPress plugin versions prior to 2.2.1 **Description** An issue exists where the plugin fails to verify the `campaign-submission` capability within an AJAX action. This allows authenticated users with low privileges, such as Subscribers, to create crowdfunding campaign posts without the required permissions. **Recommendations** Update the plugin to version 2.2.1 or later.

**Name of the Vulnerable Software and Affected Versions** WP Crowdfunding WordPress plugin versions prior to 2.2.1 **Description** Insufficient verification of order ownership allows authenticated users, including those with Subscriber roles, to access personal data from any WooCommerce order and enumerate all orders within the store. **Recommendations** Update WP Crowdfunding WordPress plugin to version 2.2.1 or later.

**Name of the Vulnerable Software and Affected Versions** Paymob for WooCommerce versions prior to 4.1.3 **Description** The Paymob for WooCommerce plugin for WordPress contains a broken access control issue. This is caused by a missing capability check within a function, allowing unauthenticated attackers to perform unauthorized actions. **Recommendations** Update Paymob for WooCommerce to version 4.1.3 or later.

**Name of the Vulnerable Software and Affected Versions** WP EasyPay versions prior to 4.4.0 **Description** Cross-Site Request Forgery (CSRF) allows an attacker to induce a user to perform actions they did not intend to do by tricking their browser into sending a forged request to the application. **Recommendations** Update to a version later than 4.4.0.

**Name of the Vulnerable Software and Affected Versions** weDevs WP User Frontend versions prior to 4.3.2 **Description** A missing authorization issue exists due to incorrectly configured access control security levels. **Recommendations** Update to a version newer than 4.3.1.

Name of the Vulnerable Software and Affected Versions David Lingren Media Library Assistant versions through 3.34 Description A SQL Injection issue exists in David Lingren Media Library Assistant due to improper neutralization of special elements used in an SQL command. This allows attackers to exploit the system. Recommendations Update to version 3.35.

Name of the Vulnerable Software and Affected Versions David Lingren Media LIbrary Assistant versions through 3.34 Description A stored cross-site scripting (XSS) issue exists in David Lingren Media LIbrary Assistant. This allows for the injection of malicious scripts through improper input neutralization during web page generation. Recommendations Update to a version later than 3.34