Wordfence PRISM

WP Map Block <= 3.0.0 - Missing Authorization to Authenticated (Contributor+) Arbitrary Map Publish/Unpublish/Delete via set_status() and bulk() REST Endpoints

Sunshine Photo Cart <= 3.7.4 - Unauthenticated PHP Object Injection via 'key' Parameter

Post Export Import with Media <= 1.17.1 - Authenticated (Administrator+) PHP Object Injection via 'page_data[meta]' Parameter

Booking Package <= 1.7.29 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'id' Shortcode Attribute

Bit integrations <= 2.10.6 - Unauthenticated Stored Cross-Site Scripting via 'notification_content' Field via Public Bit Assist Webhook Callback

Mang Board <= 2.4.3 - Unauthenticated Local File Inclusion via '<mode>_type' Parameter

Team <= 6.0.2 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'ttp_filter_taxonomy' Post Meta via [tlpteam] Shortcode

Mang Board <= 2.4.3 - Authenticated (Custom+) Stored Cross-Site Scripting via 'content' Parameter

Animated Number Counters <= 3.0 - Authenticated (Editor+) SQL Injection via 'counterid' Parameter

Academy LMS <= 4.0.3 - Missing Authorization to Authenticated (Custom+) Arbitrary Academy Comment Deletion via delete_lesson_comment AJAX — Attacker-Controlled course_id vs. Target comment_id