Kuba

User Frontend <= 4.3.13 - Authenticated (Subscriber+) Privilege Escalation via post_content Parameter

Redux Framework <= 4.5.15 - Missing Authorization to Authenticated (Subscriber+) Sensitive Information Disclosure via /wp-admin/profile.php inline redux_<opt_name> JavaScript

Photo Reviews for WooCommerce <= 1.2.31 - Unauthenticated File Deletion via 'wcpr_image_upload_id' Parameter

AMP for WP <= 1.1.18 - Authenticated (Subscriber+) Arbitrary Shortcode Execution via Author Biographical Info

WP Customer Area <= 8.4.0 - Authenticated (Subscriber+) Stored Cross-Site Scripting via 'display_name' Parameter

Booking for Appointments and Events Calendar <= 2.4.12 - Unauthenticated Sensitive Information Exposure in 'page' Parameter

WP Data Access <= 5.5.88 - Missing Authorization to Unauthenticated Sensitive Information Exposure via 'rel_tab' Parameter

UsersWP <= 1.2.78 - Unauthenticated Account Access via Predictable Dummy User Password Disclosed through Registration Form Hash

Uncanny Toolkit for LearnDash <= 3.8.2 - Unauthenticated Authentication Bypass via 'email' Parameter

Ninja Forms <= 3.15.5 - Unauthenticated Arbitrary Shortcode Execution via 'formData' Field Value via Success Message Merge Tag