Vulnerability history

Cross Site Scripting (XSS) vulnerability

Authenticated (Contributor+) SQL Injection via 'order' Shortcode Attribute vulnerability

SQL Injection vulnerability

Unauthenticated Donation Payment-Status Manipulation via Square Webhook Signature Bypass vulnerability

Broken Access Control vulnerability

Admin+ Stored XSS vulnerability

Authenticated (Subscriber+) Insecure Direct Object Reference to Arbitrary Attachment Deletion vulnerability

Authenticated (Custom+) SQL Injection vulnerability

Insufficient Verification of Data Authenticity to Unauthenticated Donation Status Forgery via Stripe Webhook vulnerability

Authenticated (Subscriber+) SQL Injection vulnerability

Authenticated (Administrator+) Stored Cross-Site Scripting via Plugin's Privacy Settings vulnerability

Cross Site Scripting (XSS) Vulnerability

Cross Site Scripting (XSS) Vulnerability

Reflected Cross-Site Scripting vulnerability

Insecure Direct Object Reference to Account Takeover and Privilege Escalation vulnerability

Broken Access Control vulnerability

Broken Access Control vulnerability

Cross Site Scripting (XSS) vulnerability

Unauthenticated Privilege Escalation Vulnerability

Cross Site Scripting (XSS)

Unauthenticated Stored Cross-Site Scripting (XSS) vulnerability

Authenticated Stored Cross-Site Scripting (XSS) vulnerability

Unauthorized Access vulnerability leading to Sensitive Information Disclosure