Duy Tran

The Easy Appointments WordPress plugin through 3.12.26 does not verify that the appointment targeted by its customer-data update action belongs to the current user; the action only checks a shared nonce that any authenticated user can obtain from their own appointment's edit form. A subscriber-level user with an appointment of their own can therefore reuse that nonce to overwrite the customer metadata (email, name, phone, description) of another user's appointment. Because the Easy Appointments WordPress plugin through 3.12.26 then treats that metadata as the appointment's contact data, a subsequent administrator status change with customer notifications enabled delivers the victim's appointment notification to the attacker-controlled email address.

**Name of the Vulnerable Software and Affected Versions** Everest Forms versions prior to 3.5.0 **Description** The plugin fails to reliably delete temporary CSV files created during email-notification processing. These files remain publicly accessible within the uploads directory. Unauthenticated attackers can retrieve form submission records of other users by utilizing predictable and enumerable filenames. **Recommendations** Update the plugin to version 3.5.0 or later.

**Name of the Vulnerable Software and Affected Versions** Simple Membership WordPress plugin versions prior to 4.7.5 **Description** Insufficient verification of Stripe webhook requests occurs when no signing secret is configured. Additionally, the plugin fails to escape values retrieved from these requests before displaying them in administrator notices. This allows unauthenticated attackers to perform a Cross-Site Scripting (XSS) attack—injecting arbitrary web scripts that execute within the session of a logged-in administrator. **Recommendations** Update Simple Membership WordPress plugin to version 4.7.5 or later.