Saphali LiqPay for donate <= 1.0.2 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode

saphali Saphali LiqPay for donate

Quick Featured Images <= 13.7.3 - Authenticated (Editor+) SQL Injection via delete_orphaned

kybernetikservices Quick Featured Images

CYAN Backup <= 2.5.4 - Authenticated (Admin+) Arbitrary File Deletion

gregross CYAN Backup

Academy LMS Pro <= 3.3.8 - Unauthenticated Sensitive Information Exposure via 'enqueue_social_login_script'

academylms Academy LMS Pro

Academy LMS – WordPress LMS Plugin for Complete eLearning Solution <= 3.3.8 - Authenticated (Administrator+) PHP Object Injection via 'import_all_courses'

academylms Academy LMS – WordPress LMS Plugin for Complete eLearning Solution

Flexible Refund and Return Order for WooCommerce <= 1.0.42 - Incorrect Authorization to Authenticated (Contributor+) Refund Status Update

wpdesk Flexible Refund and Return Order for WooCommerce

EventPrime – Events Calendar, Bookings and Tickets <= 4.2.0.0 - Missing Authorization to Authenticated (Subscriber+) Booking Note Creation

metagauss EventPrime – Events Calendar, Bookings and Tickets

Better Find and Replace <= 1.7.7 - Authenticated (Subscriber+) Limited Code Injection

codesolz Better Find and Replace – AI-Powered Suggestions

HTML Forms <= 1.5.5 - Authenticated (Admin+) Stored Cross-Site Scripting

linksoftware HTML Forms – Simple WordPress Forms Plugin

Insert Headers and Footers Code – HT Script <= 1.1.6 - Authenticated (Author+) Stored Cross-Site Scripting

htplugins Insert Headers and Footers Code – HT Script

WPFunnels <= 3.6.2 - Authenticated (Administrator+) Arbitrary File Deletion via Path Traversal

getwpfunnels Easy WordPress Funnel Builder To Collect Leads And Increase Sales – WPFunnels

Groups <= 3.7.0 - Authenticated (Subscriber+) Insecure Direct Object Reference to Arbitrary Group Join

itthinx Groups

Smart Auto Upload Images <= 1.2.0 - Authenticated (Contributor+) Arbitrary File Upload

burhandodhy Smart Auto Upload Images – Import External Images

Mang Board WP <= 2.3.1 - Reflected Cross-Site Scripting

kitae-park Mang Board WP

Tag, Category, and Taxonomy Manager – AI Autotagger with OpenAI <= 3.40.0 - Authenticated (Editor+) SQL Injection

stevejburge Tag, Category, and Taxonomy Manager – AI Autotagger with OpenAI

Ovatheme Events Manager <= 1.8.6 - Missing Authorization

ovatheme Ovatheme Events Manager

WPFunnels <= 3.6.2 - Unauthorized User Registration

getwpfunnels Easy WordPress Funnel Builder To Collect Leads And Increase Sales – WPFunnels

Course Booking System <= 6.1.5 - Missing Authorization to Unauthenticated Booking Data Export

werbeagenturcommotion Course Booking System

WP2Social Auto Publish <= 2.4.7 - Reflected Cross-Site Scripting via PostMessage

f1logic WP2Social Auto Publish

Download Manager <= 3.3.30 - Unauthenticated Cron Trigger due to Hardcoded Cron Key

codename065 Download Manager