The Hao

**Name of the Vulnerable Software and Affected Versions** JetEngine versions prior to 3.8.10.2 **Description** The JetEngine plugin for WordPress contains a flaw in the 'listing load more' AJAX handler. The handler accepts a `filtered query` parameter that is excluded from the HMAC query signature check to allow front-end filter integration. Because `meta query` row values within `filtered query` are not sanitized before being merged into SQL construction, unauthenticated attackers can perform time-based or boolean blind SQL injection. This is achieved by appending a malicious `meta query` value to a Load More AJAX request captured from any public Listing Grid page. **Recommendations** Update to a version newer than 3.8.10.1. As a temporary workaround, restrict access to the 'listing load more' AJAX handler or avoid using the `filtered query` parameter in public Listing Grid pages until the update is applied.

**Name of the Vulnerable Software and Affected Versions** LatePoint – Calendar Booking Plugin for Appointments and Events versions prior to 5.5.2 **Description** The plugin contains a flaw that allows an authenticated user with Agent privileges or higher to elevate their permissions to Administrator. This is achieved by chaining three independent issues, including an Insecure Direct Object Reference (IDOR)—a vulnerability where an application provides direct access to objects based on user-supplied input—within the `create or update` function of the `OsOrdersController` and an unauthenticated password reset mechanism in the Customer-Cabinet. This chain enables the attacker to overwrite a WordPress Administrator's password without accessing Administrator-only APIs. **Recommendations** Update the plugin to a version later than 5.5.1.