Subscriber Privilege Escalation in WP User Profiles <= 2.7.3 versions.
Unauthenticated Cross Site Scripting (XSS) in Form Block <= 1.8.1 versions.
Editor Privilege Escalation in Import and export users and customers <= 2.5.5 versions.
Unauthenticated PHP Object Injection in Haaken <= 1.5 versions.
Unauthenticated Cross Site Scripting (XSS) in GiveWP <= 4.17.0 versions.
Unauthenticated Cross Site Scripting (XSS) in LearnPress <= 4.4.9 versions.
Cross-Site Request Forgery (CSRF) vulnerability in Blubrry Podcasting PowerPress Podcasting powerpress allows Cross Site Request Forgery.This issue affects PowerPress Podcasting: from n/a through 11.17.9.
Unauthenticated Broken Access Control in picu <= 3.10.1 versions.
Unauthenticated Privilege Escalation in GiveWP <= 4.17.0 versions.
Unauthenticated Cross Site Scripting (XSS) in picu <= 3.10.1 versions.
Unauthenticated Cross Site Scripting (XSS) in Charitable <= 1.8.12.3 versions.
Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Sirv Sirv sirv allows Blind SQL Injection.This issue affects Sirv: from n/a through 8.2.5.
Unauthenticated Broken Access Control in PowerPress Podcasting <= 11.17.9 versions.
Unauthenticated Sensitive Data Exposure in Groundhogg <= 4.8.3 versions.
Deserialization of Untrusted Data vulnerability in Smackcoders Inc. WP Ultimate Exporter wp-ultimate-exporter allows Object Injection.This issue affects WP Ultimate Exporter: from n/a through 3.0.
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Tomlister Payflex Payment Gateway payflex-payment-gateway allows Reflected XSS.This issue affects Payflex Payment Gateway: from n/a through 2.7.1.
Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in WP BASE WP BASE Booking wp-base-booking-of-appointments-services-and-events allows Blind SQL Injection.This issue affects WP BASE Booking: from n/a through 6.4.0.
Subscriber Broken Access Control in WPO365 <= 44.1 versions.
Deserialization of Untrusted Data vulnerability in Vektor Inc. VK Google Job Posting Manager vk-google-job-posting-manager allows Object Injection.This issue affects VK Google Job Posting Manager: from n/a through 1.3.1.
Deserialization of Untrusted Data vulnerability in WP Spell Check WP Spell Check wp-spell-check allows Object Injection.This issue affects WP Spell Check: from n/a through 12.1.