Wordfence PRISM

YMC Filter <= 3.12.19 - Authenticated (Author+) Stored DOM-Based Cross-Site Scripting via 'post_title' Parameter

Cooked <= 1.16.1 - Authenticated (Contributor+) Stored Cross-Site Scripting via [cooked-timer] Shortcode Content

Bulk Page Generator <= 3.1.0 - Missing Authorization to Authenticated (Subscriber+) Arbitrary Page Creation/Modification/Deletion via 'authorize' Parameter / Suite OAuth Flow

Tourfic <= 3.0.1 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'type' Shortcode Attribute

Tainacan <= 1.3.0 - Authenticated (Subscriber+) Path Traversal to Arbitrary File Read via 'guid' Parameter

FluentCart A New Era of eCommerce <= 1.7.0 - Authenticated (Administrator+) SQL Injection via 'products.variants' Array Keys

Customer Email Verification for WooCommerce <= 3.3.0 - Unauthenticated Privilege Escalation to 'alg_wc_ev_verify_email' Parameter

Mail Mint <= 1.31.4 - Authenticated (Custom+) SQL Injection via 'filters' Parameter

FluentCart A New Era of eCommerce <= 1.7.0 - Insecure Direct Object Reference to Unauthenticated Sensitive Information Disclosure via 'order_id' and 'billing_address_id' Parameters

WP Booking System <= 2.1.0.1 - Authenticated (Administrator+) SQL Injection via 'orderby' Parameter