Chirita Catalin-Andrei

The Paid Membership Plugin, Ecommerce, User Registration Form, Login Form, User Profile & Restrict Content – ProfilePress plugin for WordPress is vulnerable to Arbitrary File Upload in all versions up to, and including, 4.16.18 via the allowed mime types function. This is due to the unconditional registration of an upload mimes filter that adds executable file extensions (.exe, .apk, .msi) to the global WordPress MIME allowlist, without scoping the expansion to digital-product upload contexts. This makes it possible for authenticated attackers, with author-level access and above, to upload files that may be executable, which makes remote code execution possible. This filter is registered globally on every request regardless of whether the digital products feature is configured or in use, meaning the expanded MIME allowlist affects all WordPress upload contexts site-wide.

**Name of the Vulnerable Software and Affected Versions** GiveWP – Donation Plugin and Fundraising Platform versions prior to 4.16.4 **Description** Insufficient input sanitization and output escaping allow authenticated attackers with give worker-level access and above to perform Stored Cross-Site Scripting. The issue occurs when the `twitter message` Sequoia Template Setting is used, allowing the injection of arbitrary web scripts. These scripts execute when a donor clicks the Share on Twitter button on the Sequoia donation confirmation view, as the unescaped `twitter message` value is evaluated within a JavaScript template literal. **Recommendations** Update GiveWP – Donation Plugin and Fundraising Platform to version 4.16.4 or later.

**Name of the Vulnerable Software and Affected Versions** GiveWP – Donation Plugin and Fundraising Platform versions prior to 4.16.2 **Description** Insufficient input sanitization and output escaping allow authenticated attackers with Give Worker-level access or higher to perform Stored Cross-Site Scripting (XSS). This occurs via the `sequoia[introduction][image]` parameter, enabling the injection of arbitrary web scripts into pages that execute when accessed by other users. **Recommendations** Update GiveWP – Donation Plugin and Fundraising Platform to version 4.16.2 or later. Restrict access to the `sequoia[introduction][image]` parameter for users with Give Worker-level permissions until the update is applied.

**Name of the Vulnerable Software and Affected Versions** LatePoint – Calendar Booking Plugin for Appointments and Events versions prior to 5.4.2 **Description** A privilege escalation issue exists due to a missing authorization check in the `execute()` function of the connect-customer-to-wp-user ability. The system only requires the `customer edit` capability, which is granted to the `latepoint agent` role by default, but fails to verify if the target WordPress user ID belongs to a privileged account. This allows authenticated attackers with the `latepoint agent` role to link a LatePoint customer record to an administrator account and reset the administrator's password through the standard customer password-reset process, leading to a full site takeover. **Recommendations** Update the plugin to a version later than 5.4.1.