Vulnerability history

Content Injection vulnerability

Authenticated (Subscriber+) PHP Object Injection to Administrator Account Takeover vulnerability

Insecure Direct Object Reference to Unauthenticated Sensitive Information Exposure vulnerability

Authenticated (Administrator+) PHP Object Injection vulnerability

Authenticated (Custom+) Stored Cross-Site Scripting vulnerability

Authenticated (Subscriber+) Arbitrary Shortcode Execution vulnerability

Editor+ Blind SSRF vulnerability

Unauthenticated Stored Cross-Site Scripting vulnerability

Arbitrary Code Execution vulnerability

Unauthenticated Blind Server-Side Request Forgery vulnerability

Author+ Stored XSS vulnerability

Unauthenticated Stored Cross-Site Scripting vulnerability

Unauthenticated Non-Public Post Content Disclosure vulnerability

Unauthenticated Stored XSS vulnerability

Editor+ SQLi vulnerability

Authenticated Collaboration Comment Status Modification vulnerability

Unauthenticated User and Comment Author Email Disclosure vulnerability

Unauthenticated Arbitrary Shortcode Execution via Form Email Actions vulnerability

Editor+ Stored XSS via Font Zip Upload vulnerability

Missing Authorization to Authenticated (Subscriber+) Sensitive Information Disclosure via 'context' Parameter vulnerability

Authenticated (Editor+) Path Traversal to Arbitrary File Read via 'data' Parameter vulnerability

Cross Site Scripting (XSS) vulnerability

Unauthenticated SQL Injection vulnerability

Freeform Page Builder, Website Builder & Customizer plugin <= 6.2.0 - Freeform Page Builder, Website Builder & Customizer <= 6.2.0 - Authenticated (Contributor+) Stored Cross-Site Scripting vulnerability

Unauthenticated PHP Object Injection vulnerability

Authenticated (Editor+) Path Traversal to Arbitrary File Write (Zip Slip) vulnerability

Arbitrary File Deletion vulnerability

Insecure Direct Object Reference to Unauthenticated Sensitive Information Disclosure vulnerability

Authenticated (Editor+) Path Traversal to Arbitrary Directory Deletion vulnerability

PHP Object Injection vulnerability

Cross Site Scripting (XSS) vulnerability

SQL Injection vulnerability

Broken Access Control vulnerability

Missing Authorization to Unauthenticated Sensitive Information Exposure vulnerability

Missing Authorization to Unauthenticated Arbitrary Email Content Injection (Mail Relay / Phishing) vulnerability

Insecure Direct Object References (IDOR) vulnerability

Server Side Request Forgery (SSRF) vulnerability

Unauthenticated Privilege Escalation via 'handle_forgot_password' vulnerability

Missing Authorization to Authenticated (Subscriber+) Sensitive Form Submission Data Exposure vulnerability

Unauthenticated Limited Arbitrary File Read and Deletion vulnerability