Workreap (theme's plugin)

Arbitrary File Deletion vulnerability <= 3.3.5

Authenticated (Subscriber+) Arbitrary File Upload via 'workreap_temp_upload_to_media' vulnerability <= 3.3.2

Authentication Bypass via 'workreap_verify_user_account' vulnerability <= 3.3.1

Unauthenticated Privilege Escalation via Account Takeover vulnerability <= 3.2.5