WP Project Manager

Authenticated (Subscriber+) SQL Injection vulnerability <= 2.6.16

Authenticated (Subscriber+) Sensitive Information Exposure via Project Task List REST API vulnerability <= 2.6.15

SQL Injection vulnerability <= 2.6.17

Missing Authorization to Project Milestone and Task Creation/Deletion vulnerability <= 2.6.14

Insecure Direct Object Reference to Unauthenticated Authorization Bypass vulnerability <= 2.6.13