Demo Importer Plus <= 2.0.9 - Authenticated (Author+) Blind XML External Entity Injection via SVG File Upload

kraftplugins Demo Importer Plus

CubeWP – All-in-One Dynamic Content Framework <= 1.1.27 - Unauthenticated Information Exposure

cubewp1211 CubeWP Framework

Spin Wheel <= 2.1.0 - Unauthenticated Client-Side Prize Manipulation via 'prize_index' Parameter

bdthemes Spin Wheel – Interactive spinning wheel that offers coupons

CM E-Mail Blacklist <= 1.6.2 - Authenticated (Administrator+) Stored Cross-Site Scripting via 'black_email' Parameter

creativemindssolutions CM E-Mail Blacklist – Simple email filtering for safer registration

Advanced Ads – Ad Manager & AdSense <= 2.0.15 - Authenticated (Admin+) SQL Injection

monetizemore Advanced Ads – Ad Manager & AdSense

Team Section Block <= 2.0.0 - Authenticated (Contributor+) Stored Cross-Site Scripting via Social Network Link

bplugins Team Section Block – Showcase Team Members with Layout Options

User Registration Using Contact Form 7 <= 2.5 - Authenticated (Subscriber+) Information Exposure

zealopensource User Registration Using Contact Form 7

Phrase TMS Integration for WordPress <= 4.7.5 - Missing Authorization to Authenticated (Subscriber+) Log Deletion

memsource Phrase TMS Integration for WordPress

Community Events <= 1.5.6 - Missing Authorization to Unauthenticated Arbitrary Event Approval via 'eventlist' Parameter

jackdewey Community Events

Payment Button for PayPal <= 1.2.3.41 - Missing Authorization to Unauthenticated Arbitrary Order Creation

naa986 Payment Button for PayPal

Gutenberg Thim Blocks <= 1.0.1 - Authenticated (Contributor+) Arbitrary File Read via 'iconSVG' Parameter

thimpress Thim Blocks

Church Admin <= 5.0.28 - Authenticated (Administrator+) Blind Server-Side Request Forgery via 'audio_url' Parameter

andy_moyle Church Admin

RepairBuddy <= 4.1116 - Insecure Direct Object Reference to Authenticated (Subscriber+) Arbitrary Signature Upload to Orders

sweetdaisy86 RepairBuddy – Repair Shop CRM & Booking Plugin for WordPress

Feeds for YouTube Pro <= 2.6.0 - Unauthenticated Arbitrary File Read via Path Traversal

Awesome Motive YouTube Feed Pro

Quick Contact Form <= 8.2.6 - Unauthenticated Open Mail Relay

saadiqbal Quick Contact Form

Filr – Secure document library <= 1.2.11 - Authenticated (Administrator+) Stored Cross-Site Scripting via HTML Upload

wpchill Filr – Secure document library

RegistrationMagic <= 6.0.7.1 - Privilege Escalation via admin_order

metagauss RegistrationMagic – Custom Registration Forms, User Registration, Payment, and User Login

Wallet System for WooCommerce <= 2.7.2 - Missing Authorization to Authenticated (Subscriber+) Arbitrary Wallet Balance Manipulation

wpswings Wallet System for WooCommerce – Digital Wallet, Buy Now Pay Later (BNPL), Instant Cashback, Referral program, Partial & Subscription Payments

WP Hotel Booking <= 2.2.7 - Unauthenticated Sensitive Information Exposure via 'email' Parameter

thimpress WP Hotel Booking

Information Disclosure in Secure Access Between 12.70 and 14.20

Absolute Security Secure Access