hookandhook vulnerabilities and threats

The WP Courses LMS plugin for WordPress contains an authorization bypass vulnerability in all versions up to and including 3.2.29. This flaw allows authenticated users with custom-level access or higher to read other users' quiz answers and scores by manipulating the 'resultID' parameter in an AJAX request. The vulnerability arises from missing validation on a user-controlled key and insufficient access control, relying only on a nonce check that is exposed to all logged-in users.

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in hookandhook WP Courses LMS wp-courses allows DOM-Based XSS.This issue affects WP Courses LMS: from n/a through <= 3.2.26.

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in hookandhook Post Grid Elementor Addon post-grid-elementor-addon.This issue affects Post Grid Elementor Addon: from n/a through <= 2.0.18.

The WP Courses LMS – Online Courses Builder, eLearning Courses, Courses Solution, Education Courses plugin for WordPress is vulnerable to unauthorized access due to a missing capability check on the wpc_update_user_meta_option() function in all versions up to, and including, 3.2.21. This makes it possible for authenticated attackers, with Subscriber-level access and above, to update arbitrary user's metadata which can be levereged to block an administrator from accessing their site when wp_capabilities is set to 0.