Muhan Luo

**Name of the Vulnerable Software and Affected Versions** DHL eCommerce (Benelux) for WooCommerce versions prior to 2.2.4 **Description** The plugin is susceptible to unauthorized data modification and loss. This occurs because the `create label()` and `delete label()` functions lack proper capability checks and nonce verification. These functions are linked to the `wp ajax dhlpwc label create` and `wp ajax dhlpwc label delete` hooks and process an attacker-supplied `post id` variable, which represents a WooCommerce order ID. Consequently, authenticated users with Subscriber-level permissions or higher can create or delete DHL shipping labels for any WooCommerce order on the site. **Recommendations** Update the plugin to a version newer than 2.2.3. As a temporary mitigation, restrict access to the `create label()` and `delete label()` functions for users with Subscriber-level permissions.

**Name of the Vulnerable Software and Affected Versions** Colissimo Officiel : Méthodes de livraison pour WooCommerce versions prior to 2.9.1 **Description** Authenticated users with Subscriber-level access and above can perform unauthorized modification of data. The issue exists because the `updateShippingMethod()` function, registered to the `wp ajax lpc order affect` AJAX action, fails to perform a `current user can()` capability check and lacks nonce verification. This allows an attacker to provide a specific `order id` to modify the shipping method, pickup-point meta, and shipping address of arbitrary WooCommerce orders, including those belonging to other users. **Recommendations** Update to a version newer than 2.9.0. As a temporary workaround, restrict access to the `updateShippingMethod()` function until a patch is applied.

**Name of the Vulnerable Software and Affected Versions** JTL-Connector for WooCommerce versions prior to 2.4.2 **Description** The plugin contains missing authorization due to a lack of capability checks and nonce verification. This allows authenticated attackers with Subscriber-level access or higher to modify arbitrary plugin settings, download a ZIP archive of developer log files, and delete those logs. The issue affects the 'admin post settings save woo-jtl-connector' action handled by the `save()` function in `JtlConnectorAdmin`, as well as the 'wp ajax downloadJTLLogs' and 'wp ajax clearJTLLogs' AJAX actions handled by the `downloadJTLLogs()` and `clearJTLLogs()` functions. **Recommendations** Update the plugin to version 2.4.2 or later.

Name of the Vulnerable Software and Affected Versions: wpForo Forum plugin for WordPress versions prior to 2.4.6 Description: The wpForo Forum plugin for WordPress is susceptible to Stored Cross-Site Scripting through SVG file uploads. Insufficient input sanitization and output escaping allow authenticated attackers with Subscriber-level access or higher to inject arbitrary web scripts into pages. These scripts execute when a user accesses the SVG file. Recommendations: Update wpForo Forum plugin to version 2.4.6 or later.