Shop manager SQL Injection in Persian Woocommerce SMS <= 7.2.2 versions.

Unauthenticated Broken Access Control in Qubely <= 1.8.14 versions.

Subscriber Broken Access Control in TemplateSpare <= 4.2.2 versions.

Rejected reason: This CVE ID has been rejected. GitLab determined that the reported behavior does not constitute a vulnerability: linking a group SAML identity requires the user to explicitly consent to that group controlling their GitLab account for sign-in, and management of group SAML identities by a group Owner is therefore expected behavior rather than an authorization bypass. No GitLab version was affected.

Unauthenticated Broken Access Control in Graphina <= 3.1.12 versions.

Contributor Cross Site Scripting (XSS) in BSK PDF Manager <= 3.8 versions.

Contributor Cross Site Scripting (XSS) in LIQUID SPEECH BALLOON <= 1.2.5 versions.

Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Themeisle Visualizer allows Blind SQL Injection. This issue affects Visualizer: from n/a through 4.0.1.

Unauthenticated Broken Access Control in Civi Framework <= 2.2.0 versions.

Contributor Broken Access Control in Avada Custom Branding <= 1.2 versions.

Unauthenticated Insecure Direct Object References (IDOR) in Formidable Forms Signature Online Contract Automation <= 2.0.1 versions.

Contributor Cross Site Scripting (XSS) in Manual - Documentation, Knowledge Base & Education WordPress Theme <= 7.5.4 versions.

Unauthenticated Sensitive Data Exposure in WP Social Ninja <= 4.3.0 versions.

Unauthenticated SQL Injection in WP OAuth Server <= 6.2.0 versions.

The Timeline Blocks for Gutenberg plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'titleTag' attribute of the timeline-blocks/tb-timeline-blocks block in all versions up to, and including, 1.1.10 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.

Author Cross Site Scripting (XSS) in Photo Gallery <= 2.7.7.29 versions.

Contributor Cross Site Scripting (XSS) in Accept Donations with PayPal & Stripe <= 1.5.5 versions.

Unauthenticated Cross Site Scripting (XSS) in Easy PayPal Buy Now Button <= 2.0.4 versions.

Unauthenticated Server Side Request Forgery (SSRF) in PeproDev Ultimate Invoice <= 2.2.6 versions.

Unauthenticated Cross Site Scripting (XSS) in AffiliateWP <= 2.35.0 versions.