Vulnerability history

Unauthenticated Authentication Bypass vulnerability

Authenticated (Contributor+) Stored Cross-Site Scripting vulnerability

Broken Access Control vulnerability

Cross Site Scripting (XSS) vulnerability

Authenticated (Subscriber+) Missing Authorization To Limited File Upload via Popup Template Import vulnerability

PHP Object Injection vulnerability

Cross Site Scripting (XSS) Vulnerability

Authenticated (Contributor+) Stored Cross-Site Scripting via Inline SVG vulnerability

Cross Site Scripting (XSS) Vulnerability

Unauthenticated PHP Object Injection via PHAR vulnerability

Authenticated (Contributor+) SVG Upload to Local File Inclusion (Remote Code Execution) vulnerability

Authenticated (Contributor+) Arbitrary File Read vulnerability

Missing Authorization to Unauthenticated Popup Template Export vulnerability

Missing Authorization to Authenticated Library Sync vulnerability

Unauthenticated Arbitrary File Upload vulnerability

Limited Unauthenticated Authentication Bypass to Account Takeover vulnerability

Unauth. Arbitrary File Upload vulnerability

Unauthenticated Account Takeover vulnerability

Multiple Auth. Broken Access Control vulnerability

Multiple Auth. Broken Access Control vulnerability

Unauth. Arbitrary File Download vulnerability

Authenticated Privilege Escalation and Post deletion vulnerability

Insufficient Access Control leading to Authenticated Arbitrary Plugin Deactivation and Settings Modification

Information Disclosure, Modification, and Denial of Service (DoS) vulnerabilities