Truefy Embed <= 1.1.0 - Cross-Site Request Forgery to 'truefy_embed_options_update' Settings Update

truefy Truefy Embed

Resource Library for Logged In Users <= 1.4 - Cross-Site Request Forgery to Multiple Administrative Actions

doubledome Resource Library for Logged In Users

Kirim.Email WooCommerce Integration <= 1.2.9 - Cross-Site Request Forgery to Settings Update

developerke Kirim.Email WooCommerce Integration

Easy Map Creator <= 3.0.2 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode Attributes

qrevo Easy Map Creator

IMAQ Core <= 1.2.1 - Cross-Site Request Forgery to URL Structure Update

imaqpress IMAQ CORE

Premmerce Brands for WooCommerce <= 1.2.13 - Missing Authorization To Authenticated (Subscriber+) Brand Permalink Settings Update

premmerce Premmerce Brands for WooCommerce

Visitor Logic Lite <= 1.0.3 - Unauthenticated PHP Object Injection via 'lpblocks' Cookie

rodgerholl Visitor Logic Lite

WPMasterToolKit (WPMTK) <= 2.13.0 - Authenticated (Contributor+) Code Injection

ludwigyou WPMasterToolKit (WPMTK) – All in one plugin

App Landing Template Blocks for WPBakery Page Builder <= 2.0.2 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode Attributes

themebon App Landing Template Blocks for WPBakery (Visual Composer) Page Builder

Coding Blocks <= 1.1.0 - Cross-Site Request Forgery to Settings Update

octagonsimon Coding Blocks

WPGancio <= 1.12 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode Attributes

lesion WPGancio

URL Media Uploader <= 1.0.1 - Missing Authorization to Authenticated (Contributor+) Safe File Upload

apprhyme URL Media Uploader

Infility Global <= 2.14.23 - Authenticated (Subscriber+) Arbitrary File Upload

infility Infility Global

Player Leaderboard 1.0.0 - 1.0.2 - Authenticated (Contributor+) Local File Inclusion

tharkun69 Player Leaderboard

Foxtool All-in-One: Contact chat button, Custom login, Media optimize images <= 2.5.2 - Cross-Site Request Forgery to Google OAuth Connection

foxtheme Foxtool All-in-One: Contact chat button, Custom login, Media optimize images

Multi Uploader for Gravity Forms <= 1.1.7 - Unauthenticated Arbitrary File Deletion

sh1zen Multi Uploader for Gravity Forms

Campay Woocommerce Payment Gateway <= 1.2.2 - Unauthenticated Payment Bypass

campay Campay Woocommerce Payment Gateway

SimplyConvert <= 1.0 - Authenticated (Administrator+) Stored Cross-Site Scripting via 'simplyconvert_hash' Option

jonahsc SimplyConvert

Like DisLike Voting <= 1.0.1 - Reflected Cross-Site Scripting via $_SERVER['PHP_SELF']

wasiul99 Like DisLike Voting

WP Dropzone <= 1.1.1 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'callback' Shortcode Attribute

nazsabuz WP Dropzone