Premmerce Brands for WooCommerce <= 1.2.13 - Missing Authorization To Authenticated (Subscriber+) Brand Permalink Settings Update

premmerce Premmerce Brands for WooCommerce

Visitor Logic Lite <= 1.0.3 - Unauthenticated PHP Object Injection via 'lpblocks' Cookie

rodgerholl Visitor Logic Lite

WPMasterToolKit (WPMTK) <= 2.13.0 - Authenticated (Contributor+) Code Injection

ludwigyou WPMasterToolKit (WPMTK) – All in one plugin

App Landing Template Blocks for WPBakery Page Builder <= 2.0.2 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode Attributes

themebon App Landing Template Blocks for WPBakery (Visual Composer) Page Builder

Coding Blocks <= 1.1.0 - Cross-Site Request Forgery to Settings Update

octagonsimon Coding Blocks

WPGancio <= 1.12 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode Attributes

lesion WPGancio

URL Media Uploader <= 1.0.1 - Missing Authorization to Authenticated (Contributor+) Safe File Upload

apprhyme URL Media Uploader

Infility Global <= 2.14.23 - Authenticated (Subscriber+) Arbitrary File Upload

infility Infility Global

Player Leaderboard 1.0.0 - 1.0.2 - Authenticated (Contributor+) Local File Inclusion

tharkun69 Player Leaderboard

Foxtool All-in-One: Contact chat button, Custom login, Media optimize images <= 2.5.2 - Cross-Site Request Forgery to Google OAuth Connection

foxtheme Foxtool All-in-One: Contact chat button, Custom login, Media optimize images

Multi Uploader for Gravity Forms <= 1.1.7 - Unauthenticated Arbitrary File Deletion

sh1zen Multi Uploader for Gravity Forms

Campay Woocommerce Payment Gateway <= 1.2.2 - Unauthenticated Payment Bypass

campay Campay Woocommerce Payment Gateway

SimplyConvert <= 1.0 - Authenticated (Administrator+) Stored Cross-Site Scripting via 'simplyconvert_hash' Option

jonahsc SimplyConvert

Like DisLike Voting <= 1.0.1 - Reflected Cross-Site Scripting via $_SERVER['PHP_SELF']

wasiul99 Like DisLike Voting

WP Dropzone <= 1.1.1 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'callback' Shortcode Attribute

nazsabuz WP Dropzone

Complag <= 1.0.2 - Reflected Cross-Site Scripting via $_SERVER['PHP_SELF']

andru1 Complag

Wpik WordPress Basic Ajax Form <= 1.0 - Authenticated (Contributor+) Stored Cross-Site Scripting

awanhrp Wpik WordPress Basic Ajax Form

Ayo Shortcodes <= 0.2 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'color' Shortcode Attribute

ayothemes Ayo Shortcodes

WatchTowerHQ <= 3.15.0 - Authenticated (Administrator+) Arbitrary File Read via 'wht_download_big_object_origin' Parameter

watchtowerhq WatchTowerHQ

BuddyTask <= 1.3.0 - Missing Authorization to Authenticated (Subscriber+) Cross-Group Task Board Access and Manipulation

cytechltd BuddyTask