Unauthenticated Sensitive Data Exposure in Print Invoice & Delivery Notes for WooCommerce <= 7.1.1 versions.

A weakness has been identified in Tenda CH22 1.0.0.1. This affects the function formWrlExtraSet of the file /goform/WrlExtraSet. Executing a manipulation of the argument GO can lead to stack-based buffer overflow. The attack can be executed remotely. The exploit has been made available to the public and could be used for attacks.

Subscriber Arbitrary File Upload in Travel Booking <= 2.2.5 versions.

Subscriber Arbitrary File Upload in Quform <= 2.23.0 versions.

Subscriber PHP Object Injection in Uncanny Automator Pro <= 7.3.0.6 versions.

Subscriber PHP Object Injection in RealHomes <= 4.5.3 versions.

Subscriber Arbitrary File Deletion in JS Help Desk <= 3.1.1 versions.

Subscriber PHP Object Injection in EventPrime <= 4.3.4.1 versions.

Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in FunnelKit Funnel Builder by FunnelKit allows Blind SQL Injection. This issue affects Funnel Builder by FunnelKit: from n/a through 3.15.0.5.

Unauthenticated Cross Site Scripting (XSS) in TablePress <= 3.3.1 versions.

Improper Access Control vulnerability in Themeisle PPOM for WooCommerce allows Exploiting Incorrectly Configured Access Control Security Levels. This issue affects PPOM for WooCommerce: from n/a through 33.0.18.

A security flaw has been discovered in Tenda CH22 1.0.0.1. The impacted element is the function formCertLocalPrecreate of the file /goform/CertLocalPrecreate of the component Parameter Handler. Performing a manipulation of the argument standard results in stack-based buffer overflow. Remote exploitation of the attack is possible. The exploit has been released to the public and may be used for attacks.

Contributor Remote Code Execution (RCE) in Post Snippets <= 4.0.19 versions.

Unauthenticated Insecure Direct Object References (IDOR) in Payment Gateway Based Fees and Discounts for WooCommerce <= 3.0.0 versions.

Unauthenticated Cross Site Scripting (XSS) in perfmatters <= 2.6.3 versions.

Subscriber Cross Site Scripting (XSS) in ListingPro <= 2.9.11 versions.

Unauthenticated Cross Site Scripting (XSS) in Automatic < 3.135.1 versions.

Unauthenticated Cross Site Scripting (XSS) in Blog2Social <= 8.9.2 versions.

Unauthenticated Cross Site Scripting (XSS) in Customer Reviews for WooCommerce <= 5.110.1 versions.

Customer Cross Site Scripting (XSS) in Advanced Order Export For WooCommerce <= 4.0.9 versions.