UKO

wpForo Forum <= 3.2.2 - Unauthenticated SQL Injection via 'href[locale]' Parameter

JS Help Desk <= 5.0.2 - Authenticated (Subscriber+) Stored DOM-Based Cross-Site Scripting via 'jsticket_message' Ticket Field via VenoBox data-title

LifterLMS <= 10.3.2 - Authenticated (Subscriber+) Stored Cross-Site Scripting via Content Question Answer

Greenshift <= 13.2.2 - Unauthenticated Stored DOM-Based Cross-Site Scripting via Comment Author URL via Interaction Layer attach-attribute to Counter data-prefix

TranslatePress <= 3.3.8 - Unauthenticated Stored Cross-Site Scripting via Comment Content via trp-gettext Marker Smuggling and PCRE Backtrack Bypass

Ultimate Member <= 2.14.1 - Authenticated (Subscriber+) Stored Cross-Site Scripting via Custom Textarea Profile Field

wpForo Forum <= 3.2.2 - Authenticated (Subscriber+) Stored Cross-Site Scripting via Reply Body in Moderation Forms

Real Testimonials <= 4.1.0 - Unauthenticated Stored Cross-Site Scripting via JPEG IPTC Caption + '[gallery]' Shortcode Chain

WS Form LITE <= 1.12.18 - Unauthenticated Stored Cross-Site Scripting via Text Field Array Value

Real Testimonials <= 4.1.0 - Unauthenticated Stored Cross-Site Scripting via 'tpro_client_name' Parameter