Lttn

**Name of the Vulnerable Software and Affected Versions** weDevs WP Project Manager versions 2.6.7 and earlier **Description** The issue is related to a Missing Authorization vulnerability, which allows exploiting incorrectly configured access control security levels. **Recommendations** For weDevs WP Project Manager versions 2.6.7 and earlier, update to a version later than 2.6.7 to resolve the issue.

**Name of the Vulnerable Software and Affected Versions** RegistrationMagic versions 5.2.3.0 and earlier **Description** The issue is related to a missing authorization vulnerability in Metagauss User Registration Forms RegistrationMagic, which allows the exploitation of incorrectly configured access control security levels. **Recommendations** For RegistrationMagic versions 5.2.3.0 and earlier, update to a version later than 5.2.3.0 to resolve the issue. As a temporary workaround, consider restricting access to the RegistrationMagic module to minimize the risk of exploitation.

**Name of the Vulnerable Software and Affected Versions** Salon Booking System versions n/a through 8.6 **Description** The issue is related to Improper Privilege Management, allowing Privilege Escalation in the Salon Booking System. **Recommendations** For versions n/a through 8.6, update to a version that includes a fix for the Improper Privilege Management issue to prevent Privilege Escalation. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** LearnPress plugin for WordPress versions up to, and including, 4.2.5.7 **Description** The issue allows authenticated attackers with subscriber-level access and above to retrieve the details of another user's course progress due to missing validation on the `userID` user controlled key in the "/wp-json/lp/v1/profile/course-tab" API endpoint. **Recommendations** For versions up to, and including, 4.2.5.7, consider disabling access to the "/wp-json/lp/v1/profile/course-tab" API endpoint until a patch is available. Restrict the use of the `userID` key to minimize the risk of exploitation.

**Name of the Vulnerable Software and Affected Versions** Youzify – BuddyPress Community, User Profile, Social Network & Membership Plugin for WordPress versions 1.2.2 and earlier **Description** The issue is related to an Authorization Bypass Through User-Controlled Key vulnerability. This allows for unauthorized access by exploiting a user-controlled key. **Recommendations** For Youzify – BuddyPress Community, User Profile, Social Network & Membership Plugin for WordPress versions 1.2.2 and earlier, update to a version that contains a fix for this issue, if available. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** weDevs WP Project Manager – Task, team, and project management plugin featuring kanban board and gantt charts versions through 2.6.7 **Description** The issue is related to Improper Neutralization of Input During Web Page Generation, also known as Cross-site Scripting. This allows for Stored XSS. **Recommendations** For versions through 2.6.7, update to a version later than 2.6.7 to resolve the issue. As a temporary workaround, consider restricting access to the plugin until a patch is available. Avoid using the plugin's web page generation features until the issue is resolved.

**Name of the Vulnerable Software and Affected Versions** Atarim Visual Website Collaboration, Feedback & Project Management – Atarim plugin versions prior to 3.12 **Description** The issue is related to an Unauth. Stored Cross-Site Scripting (XSS) vulnerability. This means that an attacker can inject malicious scripts into the website, which can then be executed by other users, potentially leading to unauthorized actions. **Recommendations** For versions prior to 3.12, update to version 3.12 or later to resolve the issue.