Vaibhav Narkhede

**Name of the Vulnerable Software and Affected Versions** Buckaroo Woocommerce Payments Plugin versions prior to 4.9.0 **Description** An issue exists where the plugin fails to perform capability checks or nonce validation—a security mechanism used to prevent cross-site request forgery—on an AJAX action used to process payment capture refunds. This allows any authenticated user, including those with Subscriber privileges, to trigger refunds for captured orders. **Recommendations** Update the plugin to version 4.9.0 or later.

The JS Help Desk WordPress plugin before 3.1.4 grants a support-agent capability to the Contributor role on activation and does not perform a capability check on a user-listing handler, allowing Contributor-level users to enumerate the email addresses of all registered WordPress users.

The Animation Addons for Elementor WordPress plugin before 2.7.0 does not sanitise uploaded SVG/SVGZ files, which it adds to the list of allowed upload types, allowing users with the upload files capability (Author and above) to upload files containing malicious JavaScript, leading to Stored Cross-Site Scripting.

**Name of the Vulnerable Software and Affected Versions** Header Footer Builder for Elementor versions prior to 1.2.1 **Description** Insufficient administrative capability requirements for the dashboard template-import action allow users with `edit posts` permissions, such as Contributors, to import templates. An attacker can include an Elementor HTML widget configured for site-wide display to inject JavaScript that executes in the session of any visitor or administrator who loads the site. **Recommendations** Update Header Footer Builder for Elementor to version 1.2.1 or later.

**Name of the Vulnerable Software and Affected Versions** Adminify WordPress plugin versions prior to 4.2.10 **Description** An issue exists in an administration search feature that fails to perform per-user read-capability checks on returned results. This allows users with low-privilege roles, such as Contributor, to disclose non-public content that is normally restricted, including unpublished post titles from other authors, pending comment content, user account names, and the plugin inventory. **Recommendations** Update Adminify WordPress plugin to version 4.2.10 or later.

**Name of the Vulnerable Software and Affected Versions** Decent Comments versions prior to 3.0.2 **Description** The Decent Comments WordPress plugin fails to restrict access to comment author and post author email addresses through its REST API endpoint. This allows unauthenticated attackers to enumerate the email addresses of registered users. **Recommendations** Update to version 3.0.2 or later.