Vulnerability history

Unauthenticated Arbitrary File Deletion via Path Traversal via custom_directory_name Merge Tag vulnerability

Authenticated (Contributor+) Stored Cross-Site Scripting via 'tag' Shortcode Attribute vulnerability

Subscriber+ Arbitrary Membership Plan Deletion vulnerability

Cross Site Scripting (XSS) vulnerability

Unauthenticated Privilege Escalation via 'item_id' Parameter vulnerability

Unauthenticated Stored Cross-Site Scripting vulnerability

Authenticated (Subscriber+) Arbitrary Password Reset via Encrypted Object Token vulnerability

Privilege Escalation vulnerability

Broken Access Control vulnerability

Subscriber+ Taxonomy Term Creation/Modification/Deletion vulnerability

Authenticated (Administrator+) SQL Injection vulnerability

Missing Authorization to Authenticated (Subscriber+) Account Takeover vulnerability

Unauthenticated Privilege Escalation vulnerability

Unauthenticated Privilege Escalation vulnerability

Authenticated (Editor+) PHP Object Injection via 'post_content' of Admin Form Posts vulnerability

Unauthenticated Privilege Escalation vulnerability

Unauthenticated Stored Cross-Site Scripting vulnerability

Unauthenticated Stored Cross-Site Scripting via 'update_field' vulnerability

Unauthenticated Privilege Escalation to Administrator via Role Form Field vulnerability

Missing Authorization to Unauthenticated Arbitrary Data Deletion via 'delete post' Form Element vulnerability

Unauthenticated Arbitrary Options Update vulnerability

SQL Injection vulnerability

Arbitrary File Download Vulnerability

Reflected Cross Site Scripting (XSS) vulnerability

Unauthenticated SQL Injection vulnerability

Improper Missing Encryption Exception Handling to Form Manipulation vulnerability

Unauthenticated Arbitrary File Upload vulnerability

Reflected Cross Site Scripting (XSS) vulnerability

Toggle The Debug Mode via Cross-Site Request Forgery (CSRF) vulnerability

Sensitive Information Disclosure vulnerability