Wp advertising management <= 1.0.3 - Reflected Cross-Site Scripting
Scratch & Win – Giveaways and Contests <= 2.7.1 - Cross-Site Request Forgery via reset_installation Function
Photo Gallery Slideshow & Masonry Tiled Gallery <= 1.0.15 - Authenticated (Subscriber+) Limited Server-Side Request Forgery
JobBoard Job listing <= 1.2.6 - Unauthenticated Arbitrary File Upload
Store Commerce <= 1.2.3 - Authenticated (Contributor+) Stored Cross-Site Scripting
Astra Widgets <= 1.2.15 - Authenticated (Contributor+) Stored Cross-Site Scripting
Dynamics 365 Integration <= 1.3.23 - Authenticated (Contributor+) Remote Code Execution and Arbitrary File Read via Twig Server-Side Template Injection
Classic Addons – WPBakery Page Builder <= 3.0 - Authenticated (Editor+) Local File Inclusion