Vulnerability history

Authenticated (Subscriber+) Stored Cross-Site Scripting vulnerability

Missing Authorization to Authenticated (Subscriber+) Arbitrary Listing Deletion vulnerability

Subscriber+ Arbitrary Listing Deletion vulnerability

Subscriber+ Cross-User Favorites Read and Write vulnerability

Unauthenticated Sensitive Data Disclosure vulnerability

Subscriber+ Paid Order and Payment Record Forgery vulnerability

Subscriber+ SSRF vulnerability

Subscriber+ Order and Financial Record Disclosure vulnerability

Subscriber+ Arbitrary Post Meta Write vulnerability

Subscriber+ Arbitrary Image Move vulnerability

PHP Object Injection vulnerability

Broken Access Control vulnerability

Broken Access Control vulnerability

Open Redirection vulnerability

Missing Authorization to Authenticated (Subscriber+) Data Export and Slug Update vulnerability

Authenticated (Subscriber+) Arbitrary File Move vulnerability

Missing Authorization to Unauthenticated Arbitrary Post Publishing vulnerability

Privilege Escalation and Account Takeover via Weak OTP vulnerability

Unauthenticated User Information Exposure vulnerability

Broken Access Control vulnerability

Missing Authorization to Unauthenticated Settings Change vulnerability

CSV Injection

Broken Access Control

Arbitrary Content Deletion vulnerability

Authenticated Privilege Escalation Vulnerability

Authenticated Arbitrary Post Deletion Vulnerability

Auth. Insecure Direct Object References (IDOR) vulnerability

Unauthenticated Email Address Disclosure vulnerability

Authenticated Arbitrary E-mail Sending vulnerability

Authenticated Arbitrary File Upload vulnerability

Cross-Site Request Forgery (CSRF) vulnerability leading to Remote File Upload