Valent1

**Name of the Vulnerable Software and Affected Versions** wpForo Forum plugin for WordPress versions prior to 3.1.2 **Description** Stored Cross-Site Scripting occurs due to insufficient input sanitization and output escaping. Authenticated attackers with subscriber-level access or higher can inject arbitrary web scripts into pages. The issue resides in the `location` profile field, where the `sanitize text field()` function fails to encode double quotes. This allows an attacker to break out of the `href` attribute context and inject event handler attributes, which execute when a user accesses the affected page. **Recommendations** Update the plugin to version 3.1.2 or later. As a temporary mitigation, restrict the ability of subscriber-level users to edit the `location` profile field.

**Name of the Vulnerable Software and Affected Versions** WP Hotel Booking versions prior to 2.3.2 **Description** Insufficient Verification of Data Authenticity allows unauthenticated attackers to mark hotel bookings as paid without submitting actual payment. The issue exists in the `web hook process paypal standard()` IPN handler, which allows the selection of the PayPal validation endpoint via the attacker-controlled `$ REQUEST['test ipn']` parameter. When `test ipn` is set to `1`, pending transactions are force-upgraded to completed. Additionally, the system fails to perform post-verification checks on `receiver email`, `mc currency`, and the uniqueness of `txn id` after receiving a verified response. Attackers can exploit this by routing validation through a PayPal sandbox account or replaying a previously verified IPN from a nominal payment. **Recommendations** Update the plugin to version 2.3.2 or later. As a temporary mitigation, restrict or disable the use of the `test ipn` parameter in the `web hook process paypal standard()` function.

**Name of the Vulnerable Software and Affected Versions** NEX-Forms – Ultimate Forms Plugin for WordPress versions prior to 9.2.3 **Description** An authorization bypass exists because the plugin fails to properly verify if a user is authorized to perform specific actions. This allows unauthenticated attackers to enumerate sequential report IDs and download complete form submission data, which may include names, email addresses, phone numbers, postal addresses, payment details, and uploaded file paths for any saved report on the site. **Recommendations** Update NEX-Forms – Ultimate Forms Plugin for WordPress to version 9.2.3 or later.