Jakub Herman

**Name of the Vulnerable Software and Affected Versions** User Profile Builder versions prior to 3.16.4 **Description** An issue exists where the automatic login process following user registration is not correctly bound to the newly created account. This allows unauthenticated attackers to obtain an authenticated session for any existing user, including administrators, on sites utilizing a supported but non-default configuration. **Recommendations** Update User Profile Builder to version 3.16.4 or later.

**Name of the Vulnerable Software and Affected Versions** WP Go Maps versions prior to 10.1.04 **Description** Unauthenticated users can perform SQL injection attacks because the plugin fails to properly sanitize and escape a parameter before incorporating it into a SQL query. SQL injection is a technique where malicious SQL statements are inserted into entry fields for execution, potentially allowing unauthorized access to the database. **Recommendations** Update WP Go Maps to version 10.1.04 or later.

The Online Scheduling and Appointment Booking System WordPress plugin before 27.8 does not sanitize or properly cast a user-supplied parameter from its unauthenticated front-end booking requests before using it in a SQL query, allowing unauthenticated attackers to perform SQL injection attacks and extract sensitive data such as password hashes from the database.

**Name of the Vulnerable Software and Affected Versions** Events Manager versions prior to 7.3.7 **Description** On sites using No-User-Account Booking Mode, the software fails to safely handle booking-registration data. A registration field supplied by a booker is stored as booking meta and subsequently deserialized without restricting allowed classes, which enables PHP object injection. This process creates a gadget chain that leads to a database query constructed without parameterization, allowing an unauthenticated attacker to read arbitrary database data, such as secret keys and user password hashes, when the booking is loaded. **Recommendations** Update Events Manager to version 7.3.7 or later.

**Name of the Vulnerable Software and Affected Versions** All-in-One WP Migration and Backup versions prior to 7.106 **Description** An issue exists where a user-supplied value is not properly sanitized before being used to construct a file path. This allows unauthenticated attackers to create or append a log file in arbitrary locations outside the intended storage directory. **Recommendations** Update All-in-One WP Migration and Backup to version 7.106 or later.

The Redux Framework WordPress plugin before 4.5.13 does not restrict which user meta keys can be written when saving custom profile fields, allowing users with at least the Subscriber role to escalate their privileges to Administrator by submitting a crafted value while updating their own profile, on sites where the Redux Framework WordPress plugin before 4.5.13's user-profile (Users extension) feature is enabled.

Unauthenticated Cross Site Scripting (XSS) in eCommerce Product Catalog <= 3.5.4 versions.

**Name of the Vulnerable Software and Affected Versions** HubSpot versions prior to 11.3.52 **Description** An issue involving the insertion of sensitive information into sent data allows for the retrieval of embedded sensitive data. **Recommendations** Update to a version newer than 11.3.51.

**Name of the Vulnerable Software and Affected Versions** WP Reloaded ApplyOnline versions prior to 2.6.7.6 **Description** A missing authorization issue exists that allows the exploitation of incorrectly configured access control security levels. **Recommendations** Update WP Reloaded ApplyOnline to a version newer than 2.6.7.6.

**Name of the Vulnerable Software and Affected Versions** Print Invoice & Delivery Notes for WooCommerce versions prior to 7.1.2 **Description** An issue exists that allows unauthenticated users to access sensitive data. **Recommendations** Update to a version newer than 7.1.1.

**Name of the Vulnerable Software and Affected Versions** Payment Gateway Based Fees and Discounts for WooCommerce versions prior to 3.0.1 **Description** An unauthenticated Insecure Direct Object Reference (IDOR) exists in the software. IDOR is a type of access control vulnerability that occurs when an application provides direct access to objects based on user-supplied input without sufficient authorization checks. **Recommendations** Update to a version newer than 3.0.0.

**Name of the Vulnerable Software and Affected Versions** Booster for WooCommerce versions prior to 8.0.2 **Description** An issue allows customers to perform arbitrary file uploads. This occurs when the system fails to properly validate files uploaded by users, potentially allowing the upload of malicious files to the server. **Recommendations** Update Booster for WooCommerce to version 8.0.2 or later.

**Name of the Vulnerable Software and Affected Versions** Subscriptions for WooCommerce versions prior to 1.9.6 **Description** An unauthenticated broken access control issue exists, allowing unauthorized users to bypass security restrictions. **Recommendations** Update to a version newer than 1.9.5.

Affiliate Broken Access Control in Affiliates Manager <= 2.9.49 versions.

**Name of the Vulnerable Software and Affected Versions** MStore API versions prior to 4.18.4 **Description** An authentication bypass using an alternate path or channel in the MStore API allows for password recovery exploitation. **Recommendations** Update to a version later than 4.18.4.

Unauthenticated Broken Authentication in wpForo Forum <= 3.1.0 versions.

Subscriber Sensitive Data Exposure in PushEngage – Web Push Notifications, eCommerce Automation &amp; Chat Widget <= 4.2.3 versions.

Unauthenticated Insecure Direct Object References (IDOR) in Clean Login <= 1.15 versions.

Unauthenticated Broken Authentication in SMS Alert Order Notifications <= 3.9.3 versions.

**Name of the Vulnerable Software and Affected Versions** Wallet System for WooCommerce versions prior to 2.7.6 **Description** An authentication bypass occurs when using an alternate path or channel, which allows for the exploitation of the password recovery process. **Recommendations** Update Wallet System for WooCommerce to version 2.7.6 or later.