ThemeRuby Multi Authors <= 1.0.0 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'before' and 'after' Shortcode Attributes

themeruby ThemeRuby Multi Authors – Assign Multiple Writers to Posts

GZSEO <= 2.0.11 - Authenticated (Contributor+) Authorization Bypass to Stored Cross-Site Scripting

aminhashemy GZSEO

Cookie consent for developers <= 1.7.1 - Authenticated (Administrator+) Stored Cross-Site Scripting via Multiple Settings Fields

lovor Cookie consent for developers

Wizit Gateway for WooCommerce <= 1.2.9 - Missing Authentication to Unauthenticated Arbitrary Order Cancellation

wizit Wizit Gateway for WooCommerce

ZT Captcha <= 1.0.4 - Cross-Site Request Forgery to Settings Update

teamzt ZT Captcha

Set Bulk Post Categories <= 1.1 - Cross-Site Request Forgery to Bulk Post Category Update

sauravrox Set Bulk Post Categories

Alchemist Ajax Upload <= 1.1 - Missing Authorization to Unauthenticated Arbitrary Media File Deletion

tandubhai Alchemist Ajax Upload

AIKTP <= 5.0.04 - Missing Authorization to Authenticated (Subscriber+) Multiple Administrator Actions

aiktp AIKTP

Alpha Blocks <= 1.5.0 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'alpha_block_css' Post Meta

robiulawal40 Alpha Blocks

Same Category Posts <= 1.1.19 - Authenticated (Author+) Stored Cross-Site Scripting via Widget Title Placeholder

kometschuh Same Category Posts

Canto Testimonials <= 1.0 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'fx' Shortcode Attribute

cantothemes Canto Testimonials

WP-ClanWars <= 2.0.1 - Authenticated (Administrator+) SQL Injection via 'orderby' Parameter

andddd WP-ClanWars

Kalrav AI Agent <= 2.3.3 - Unauthenticated Arbitrary File Upload via kalrav_upload_file AJAX Action

irisideatechsolutions Kalrav AI Agent

Star Review Manager <= 1.2.2 - Cross-Site Request Forgery to Settings Update

bramdnl Star Review Manager

WP Youtube Video Gallery <= 1.0 - Cross-Site Request Forgery to Plugin Settings Update

waqasvickey0071 WP Youtube Video Gallery

VK Google Job Posting Manager <= 1.2.20 - Authenticated (Author+) Stored Cross-Site Scripting via Job Description Field

vektor-inc VK Google Job Posting Manager

Frontis Blocks <= 1.1.6 - Unauthenticated Server-Side Request Forgery via 'url' Parameter

wpmessiah Frontis Blocks — Block Library for the Block Editor

Alex User Counter <= 6.0 - Cross-Site Request Forgery to Settings Update

adzbierajewski Alex User Counter

Simple Crypto Shortcodes <= 1.0.2 - Cross-Site Request Forgery to Plugin Settings Update

stefanristic Simple Crypto Shortcodes

Administrative Shortcodes <= 0.3.4 - Authenticated (Contributor+) Local File Inclusion via 'slug' Shortcode Attribute

shazdeh Administrative Shortcodes