Youssef Elouaer

Name of the Vulnerable Software and Affected Versions Bookly versions up to and including 27.0 Description The Online Scheduling and Appointment Booking System – Bookly plugin for WordPress is susceptible to price manipulation through the `tips` parameter. The plugin does not properly validate user-supplied input against the configured price, allowing unauthenticated attackers to submit a negative number to the `tips` parameter. This can reduce the total price to zero. Recommendations Update Bookly to a version newer than 27.0.

Name of the Vulnerable Software and Affected Versions WCAPF – WooCommerce Ajax Product Filter versions up to and including 4.2.3 Description The WooCommerce Ajax Product Filter plugin is susceptible to time-based SQL Injection through the `post-author` parameter. Insufficient input sanitization and inadequate SQL query preparation allow unauthenticated attackers to inject additional SQL queries, potentially extracting sensitive database information. Recommendations Update to a version greater than 4.2.3

Name of the Vulnerable Software and Affected Versions Pie Register – User Registration, Profiles & Content Restriction plugin for WordPress versions up to and including 3.8.4.8 Description The Pie Register plugin for WordPress is susceptible to unauthorized data modification. A missing capability check within the `pie main()` function allows unauthenticated attackers to alter the registration form status. Recommendations Update the Pie Register plugin to a version newer than 3.8.4.8.

A missing capability check allows unauthenticated attackers to cause unauthorized data loss. The plugin MVC framework dynamically registers unauthenticated AJAX handlers via `wp ajax nopriv ` hooks without verifying user capabilities. This is combined with the base controller ` call()` magic method forwarding undefined method calls to the model layer, while the `havePermissions()` method defaults to `true` when no permissions are explicitly defined. An attacker can truncate the `wp wpf filters` database table by sending a crafted AJAX request to the endpoint using the `action` variable set to 'delete', resulting in the permanent destruction of all filter configurations.

The Thim Kit for Elementor – Pre-built Templates & Widgets for Elementor plugin for WordPress is susceptible to unauthorized data access. A missing validation check on the `thim-ekit/archive-course/get-courses` API endpoint allows unauthenticated attackers to disclose private or draft LearnPress course content. This is achieved by manipulating the `post status` parameter within the `params url` payload.

The Wicked Folders plugin for WordPress is susceptible to an Insecure Direct Object Reference issue in versions up to and including 4.1.0. This is due to a lack of validation on a user-controlled key within the `delete folders()` function. Authenticated attackers with Contributor-level access or higher can exploit this to delete folders created by other users. The `delete folders()` function is the component directly involved in this issue.

The NEX-Forms – Ultimate Forms Plugin for WordPress is susceptible to an Insecure Direct Object Reference issue. This is due to a lack of validation on a user-controlled key within the `submit nex form()` function. This allows unauthenticated attackers to overwrite arbitrary form entries by manipulating the `nf set entry update id` parameter.

The Name Directory plugin for WordPress is susceptible to Stored Cross-Site Scripting through the `name directory name` parameter. Insufficient input sanitization and output escaping allow unauthenticated attackers to inject arbitrary web scripts into pages. These scripts execute when a user accesses the injected page. The issue was partially addressed in versions 1.30.3 and 1.32.1.

The Responsive Contact Form Builder & Lead Generation Plugin for WordPress is susceptible to Stored Cross-Site Scripting through form field submissions. This occurs because the `lfb lead sanitize()` function does not adequately sanitize input, specifically omitting certain field types from its sanitization whitelist. This, combined with a permissive `wp kses()` filter allowing `onclick` attributes on anchor tags, enables unauthenticated attackers to inject malicious web scripts. These scripts execute when an administrator views lead entries within the WordPress dashboard. The vulnerability allows for the injection of arbitrary web scripts via form field submissions.

The Gutena Forms plugin for WordPress is susceptible to unauthorized data modification. A missing authorization check within the `save gutena forms schema()` function allows authenticated attackers with Contributor-level access or higher to update option values. This can lead to denial of service by creating errors on the site or enabling features that are explicitly disabled, such as site user registration.

The wpForo Forum plugin for WordPress is susceptible to time-based SQL Injection through the `wpfob` parameter. Insufficient escaping of user-supplied input and inadequate SQL query preparation allow unauthenticated attackers to inject additional SQL queries into existing ones. This can lead to the extraction of sensitive information from the database.

The software contains an Insecure Direct Object Reference issue. The `get items permissions check()` permission callback on the `/kaliforms/v1/forms/{id}` API endpoint only verifies the `edit posts` capability, without confirming user ownership or authorization for the specific form resource. This allows authenticated attackers with Contributor-level access or higher to view form configuration data belonging to other users, including administrators, by identifying form IDs. Exposed data includes form field structures, Google reCAPTCHA secret keys (if configured), email notification templates, and server paths.

The Custom Block Builder – Lazy Blocks plugin for WordPress has a flaw that allows for Remote Code Execution. An authenticated attacker with Contributor-level access or higher can execute code on the server through multiple functions within the `LazyBlocks Blocks` class.