Subscriber Privilege Escalation in Import and export users and customers <= 2.5.2 versions.
Unauthenticated Arbitrary File Download in NextGEN Gallery <= 4.5.0 versions.
Editor PHP Object Injection in Responsive Slider Gallery <= 1.5.5 versions.
Contributor PHP Object Injection in 10Web Booster – Website speed optimization, Cache & Page Speed optimizer <= 2.33.6 versions.
Unauthenticated Broken Access Control in GravityExport Lite for Gravity Forms <= 2.7.2 versions.
Contributor SQL Injection in Easy Pricing Tables <= 4.1.2 versions.
Author SQL Injection in Quiz Cat <= 3.1.1 versions.
Unauthenticated Cross Site Scripting (XSS) in WordPress Persistent Login <= 3.1.3 versions.
Unauthenticated Cross Site Scripting (XSS) in Site Reviews <= 8.3.1 versions.
Contributor PHP Object Injection in SEO Plugin by Squirrly SEO <= 14.2.5 versions.
Shop manager PHP Object Injection in Cost of Goods for WooCommerce <= 3.5.2 versions.
Unauthenticated Cross Site Scripting (XSS) in WP Statistics <= 14.16.13 versions.
Author PHP Object Injection in Minimum and Maximum Quantity for WooCommerce <= 2.1.2 versions.
Shop manager PHP Object Injection in Music Player for WooCommerce <= 1.9.1 versions.
Unauthenticated SQL Injection in WP Data Access <= 5.5.84 versions.
Unauthenticated Cross Site Scripting (XSS) in Notification for Telegram <= 3.5.2 versions.
Unauthenticated Cross Site Scripting (XSS) in JW Player for WordPress <= 2.3.11 versions.
Administrator SQL Injection in WP Activity Log <= 5.6.6 versions.
Unauthenticated Cross Site Scripting (XSS) in WPFunnels <= 3.13.1 versions.
A vulnerability was identified in SourceCodester Online Reviewer Management System 1.0. Impacted is an unknown function of the file /reviewer_0/admins/assessments/examproper/btn_functions.php. The manipulation of the argument access_code leads to sql injection. The attack can be initiated remotely. The exploit is publicly available and might be used.