Subscriber Broken Access Control in Groundhogg < 4.4.1 versions.
Subscriber Insecure Direct Object References (IDOR) in KiviCare <= 4.2.1 versions.
Subscriber Sensitive Data Exposure in WP SMS <= 7.2.1 versions.
Unauthenticated Broken Access Control in WPAdverts <= 2.3.0 versions.
Subscriber Broken Access Control in rtMedia for WordPress, BuddyPress and bbPress <= 4.7.9 versions.
Unauthenticated Broken Access Control in Tutor LMS <= 3.9.7 versions.
Subscriber Broken Access Control in Ultra Addons for WPForms <= 1.0.11 versions.
Subscriber Broken Access Control in RepairBuddy <= 4.1132 versions.
Subscriber Cross Site Scripting (XSS) in Shipment Tracker for Woocommerce <= 1.5.3.2 versions.
Subscriber Arbitrary File Upload in WpStream < 4.11.2 versions.
Unauthenticated Broken Access Control in Booking Activities <= 1.16.48.1 versions.
Subscriber Broken Access Control in Motors < 1.4.107 versions.
Subscriber Cross Site Scripting (XSS) in JupiterX Core <= 4.14.1 versions.
Author Arbitrary File Download in Download Monitor <= 5.1.9 versions.
Contributor Arbitrary File Deletion in Meta Box – WordPress Custom Fields Framework <= 5.11.1 versions.
Unauthenticated Cross Site Scripting (XSS) in WP Google Review Slider <= 18.0 versions.
Subscriber Broken Access Control in Rank Math SEO <= 1.0.271 versions.
Unauthenticated Broken Access Control in Essential Addons for Elementor < 6.6.0 versions.
Subscriber Broken Access Control in Bookify <= 1.1.1 versions.
Subscriber Broken Access Control in bunny.net <= 2.3.6 versions.