Custom Frames <= 1.0.1 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'class' Shortcode Parameter

blakelong Custom Frames

Doubly <= 1.0.46 - Authenticated (Subscriber+) PHP Object Injection via ZIP File Import

unitecms Doubly – Cross Domain Copy Paste for WordPress

Extensive VC Addons for WPBakery page builder <= 1.9.1 - Unauthenticated Local File Inclusion via 'shortcode_name' Parameter

nenad-obradovic Extensive VC Addons for WPBakery page builder

Lucky Draw Contests <= 4.2 - Cross-Site Request Forgery to Plugin Settings Update

owais4377 Lucky Draw Contests

Colibri Page Builder <= 1.0.335 - Authenticated (Contributor+) Stored Cross-Site Scripting

extendthemes Colibri Page Builder

WP3D Model Import Viewer <= 1.0.7 - Authenticated (Contributor+) Arbitrary File Upload

wp3d WP3D Model Import Viewer

AnnunciFunebri Impresa <= 4.7.0 - Missing Authorization to Authenticated (Subscriber+) Arbitrary Plugin Options Deletion

pcantoni AnnunciFunebri Impresa

Postem Ipsum <= 3.0.1 - Missing Authorization to Authenticated (Subscriber+) Privilege Escalation in postem_ipsum_generate_users

franciscopalacios Postem Ipsum

Userback <= 1.0.15 - Missing Authorization to Authenticated (Subscriber+) Plugin's Configuration Exposure

userback Userback

Quick Testimonials <= 2.1 - Authenticated (Admin+) Stored Cross-Site Scripting

themeregion Quick Testimonials

Eyewear prescription form <= 6.0.1 - Missing Authorization to Unauthenticated Arbitrary WooCommerce Product Creation

dugudlabs Eyewear prescription form

a3 Lazy Load <= 2.7.5 - Authenticated (Contributor+) Stored Cross-Site Scripting

a3rev a3 Lazy Load

Popover Windows <= 1.2 - Missing Authorization to Authenticated (Subscriber+) Popover Configuration Update via AJAX Actions

melodicmedia Popover Windows

Emplibot – AI Content Writer with Keyword Research, Infographics, and Linking | SEO Optimized | Fully Automated <= 1.0.9 - Authenticated (Admin+) Server-Side Request Forgery

emplibot Emplibot – AI Content Writer with Keyword Research, Infographics, and Linking | SEO Optimized | Fully Automated

Image Slider by Ays- Responsive Slider and Carousel <= 2.7.0 - Cross-Site Request Forgery to Arbitrary Slider Deletion

ays-pro Image Slider by Ays- Responsive Slider and Carousel

Design Import/Export <= 2.2 - Authenticated (Administrator+) SQL Injection via XML File Import

uxl Design Import/Export – Styles, Templates, Template Parts and Patterns

WP Directory Kit <= 1.4.7 - Unauthenticated SQL Injection

listingthemes WP Directory Kit

HT Slider for Elementor <= 1.7.4 - Authenticated (Contributor+) Stored Cross-Site Scripting

htplugins HT Slider For Elementor

Custom Post Type UI <= 1.18.1 - Authenticated (Administrator+) Stored Cross-Site Scripting via 'label' Import Parameter

webdevstudios Custom Post Type UI

GenerateBlocks <= 2.1.2 - Authenticated (Contributor+) Information Exposure via Metadata

edge22 GenerateBlocks