Classic Addons – WPBakery Page Builder <= 3.0 - Authenticated (Editor+) Local File Inclusion
Dynamics 365 Integration <= 1.3.23 - Authenticated (Contributor+) Remote Code Execution and Arbitrary File Read via Twig Server-Side Template Injection
Astra Widgets <= 1.2.15 - Authenticated (Contributor+) Stored Cross-Site Scripting
Store Commerce <= 1.2.3 - Authenticated (Contributor+) Stored Cross-Site Scripting
JobBoard Job listing <= 1.2.6 - Unauthenticated Arbitrary File Upload
Fancy Product Designer <= 6.4.3 - Unauthenticated SQL Injection
Media Library Assistant <= 3.23 - Reflected Cross-Site Scripting via smc_settings_tab, unattachfixit-action, and woofixit-action Parameters
PlainInventory <= 3.1.6 - Unauthenticated PHP Object Injection