Unauthenticated Sensitive Data Exposure in Byteflows Travel &amp; Hotel Booking <= 1.0.0 versions.

Unauthenticated Broken Access Control in Payment Gateway for PayPal on WooCommerce <= 9.1.4 versions.

Subscriber Broken Authentication in Hide My WP Ghost <= 7.0.06 versions.

Unauthenticated Broken Authentication in miniOrange Discord Integration <= 2.2.4 versions.

Unauthenticated PHP Object Injection in Thrive Quiz Builder <= 10.9.3.0 versions.

Subscriber Remote Code Execution (RCE) in Advanced Views <= 3.8.11 versions.

Subscriber Arbitrary File Deletion in Kali Forms <= 2.4.18 versions.

Subscriber Privilege Escalation in WP BASE Booking <= 6.3.1 versions.

Unauthenticated Privilege Escalation in SMS Alert Order Notifications <= 3.9.6 versions.

Subscriber Insecure Direct Object References (IDOR) in Paid Member Subscriptions <= 3.0.7 versions.

Unauthenticated SQL Injection in GamiPress <= 7.9.7 versions.

Administrator SQL Injection in Sender – Newsletter, SMS and Email Marketing Automation for WooCommerce <= 2.10.22 versions.

Unauthenticated Broken Access Control in CoCart – Headless ecommerce <= 4.8.4 versions.

Unauthenticated Broken Access Control in Thrive Product Manager <= 10.9.2 versions.

Unauthenticated Broken Access Control in Post My CF7 Form <= 6.2.0 versions.

Unauthenticated SQL Injection in Relevanssi Light <= 1.2.2 versions.

Unauthenticated Other Vulnerability Type in Booking and Rental Manager <= 2.7.2 versions.

Unauthenticated Unknown in Falcon – WordPress Optimizations & Tweaks <= 2.10.0 versions.

Unauthenticated Broken Access Control in Stripe For WooCommerce <= 4.0.7 versions.

GitLab has remediated an issue in GitLab CE/EE affecting all versions from 17.11 before 18.11.6, 19.0 before 19.0.3, and 19.1 before 19.1.1 that under certain conditions could have allowed an authenticated user with developer-role permissions to bypass package protection rules and overwrite protected Maven package metadata due to incorrect authorization checks.