Sajjad Shariati

**Name of the Vulnerable Software and Affected Versions** The Clock In Portal- Staff & Attendance Management WordPress plugin versions 2.1 and earlier **Description** The issue is related to the lack of a CSRF check when deleting staff members, which could allow attackers to make logged-in admins delete arbitrary staff via a CSRF attack. This could potentially be exploited by attackers to manipulate staff data. **Recommendations** For versions 2.1 and earlier, consider temporarily disabling the staff deletion feature until a patch is available. Restrict access to the staff management module to minimize the risk of exploitation. Avoid using the staff deletion functionality in the affected plugin until the issue is resolved. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** The Clock In Portal- Staff & Attendance Management WordPress plugin versions 2.1 and earlier **Description** The issue is related to the lack of a CSRF check when deleting designations, which could allow attackers to make logged-in admins delete arbitrary designations via a CSRF attack. This could potentially lead to unauthorized changes in the attendance management system. **Recommendations** For The Clock In Portal- Staff & Attendance Management WordPress plugin versions 2.1 and earlier, update to a version that includes a CSRF check for designation deletion to prevent unauthorized changes. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** The Clock In Portal- Staff & Attendance Management WordPress plugin versions 2.1 and earlier **Description** The issue is related to the lack of a CSRF check when deleting holidays, which could allow attackers to make logged-in admins delete arbitrary holidays via a CSRF attack. This could potentially be exploited by attackers to manipulate holiday settings without the admin's knowledge or consent. **Recommendations** For versions 2.1 and earlier, consider temporarily disabling the holiday deletion feature until a patch is available. Restrict access to the holiday management module to minimize the risk of exploitation. Avoid using the affected plugin until the issue is resolved. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** The Pickup | Delivery | Dine-in date time WordPress plugin versions 1.0.0 through 1.0.9 **Description** The issue allows high privilege users, such as admins, to perform Stored Cross-Site Scripting attacks, even when the unfiltered html capability is disallowed, for example in multisite setups. This is due to the plugin not sanitizing and escaping some of its settings. **Recommendations** For versions 1.0.0 through 1.0.9, update to a version that properly sanitizes and escapes settings to prevent Stored Cross-Site Scripting attacks. At the moment, there is no information about a newer version that contains a fix for this vulnerability.