Walid213

**Name of the Vulnerable Software and Affected Versions** WPZOOM Connect: AI Chat, Click to Chat, Social Icons & Share Buttons versions prior to 4.7.4 **Description** Unauthenticated attackers can extract sensitive customer data for any arbitrary email address on a site. This includes the customer name, WordPress user ID, order history, order totals, purchased products, payment method labels, and EDD Software Licensing license keys with status and activation counts. The issue occurs via the `x-yamidoo-signature` parameter. Exploitation requires the attacker to register a WooCommerce customer or subscriber-level account using a crafted email address that encodes the target timestamp and victim email. This allows the signature generated by the `inline js()` function to pass the `verify request()` function for the target victim. The `share customer data` and `identify logged in` settings are enabled by default. **Recommendations** Update WPZOOM Connect: AI Chat, Click to Chat, Social Icons & Share Buttons to version 4.7.4 or later. Disable the `share customer data` and `identify logged in` settings to mitigate the risk.

**Name of the Vulnerable Software and Affected Versions** WP Ultimate Review versions prior to 2.4.4 **Description** Unauthenticated attackers can execute arbitrary shortcodes because the software fails to properly validate a value before running the `do shortcode()` function. The required nonce is exposed to unauthenticated visitors through the public review form, and submitted payloads are auto-published by default, allowing exploitation without an account or privileged interaction. **Recommendations** Update WP Ultimate Review to version 2.4.4 or later.