Nguyen Duy Quoc Khanh

The issue arises from the plugin's failure to filter the `delete entries` parameter from user requests, leading to an SQL Injection vulnerability. There is no information provided about the estimated number of potentially affected devices worldwide or details about real-world incidents where this issue was exploited.

The issue allows high privilege users, such as admins, to perform PHP Object Injection when a suitable gadget is present. This is due to the plugin unserializing user input provided via the settings.

The issue allows high privilege users, such as admins, to upload arbitrary files on the server, even when they should not be allowed to, for example in a multisite setup. This is due to the plugin not properly validating images to be uploaded.

The issue allows high privilege users, such as admins, to perform PHP Object Injection when a suitable gadget is present. This is due to the plugin unserializing user input provided via the settings.

The issue arises from the unserialization of the content of an imported settings file, which could lead to PHP object injections issues when a user imports a malicious settings file and a suitable gadget chain is present on the blog. This could potentially occur intentionally or unintentionally.

The issue allows high-privilege users, such as admins, to perform PHP Object Injection when a suitable gadget is present. This is due to the plugin unserializing user input provided via the settings.

The issue arises from the unserialize of the content of an imported file, which could lead to PHP object injection when a user imports a malicious file and a suitable gadget chain is present on the blog. This occurs when a user, intentionally or not, imports a malicious file.

The issue arises from the plugin's failure to properly sanitise and escape a parameter before using it in a SQL statement, leading to a SQL injection. This can be exploited by users with a role as low as admin.

The issue allows high privilege users, such as admins, to perform PHP Object Injection when a suitable gadget is present. This is due to the plugin unserializing user input provided via the settings.

The issue is related to a SQL injection that occurs because a parameter is not properly escaped before being used in a SQL statement. This can be exploited by high privilege users.

The issue arises from the plugin unserializing the content of an imported file, potentially leading to PHP object injection issues when a malicious file is imported by an admin, and a suitable gadget chain is present on the blog.

The issue arises from the unserialization of the content of an imported file, potentially leading to a PHP object injection issue. This can occur when an admin imports a malicious file, and a suitable gadget chain is present on the blog.

The issue arises from the unserialization of the content of an imported file, potentially leading to PHP object injections when a high-privilege user imports a malicious Customizer Styling file and a suitable gadget chain is present on the blog.

The issue arises from the unserialization of user input in a REST API endpoint, which is accessible to unauthenticated users. This could lead to PHP Object Injection when a suitable gadget is present, resulting in remote code execution (RCE). To exploit this, attackers must have knowledge of the site secrets, enabling them to generate a valid hash via the `wp hash()` function.

The issue arises from the unserialization of the content of an imported file, potentially leading to PHP object injection issues if a malicious file is imported and a suitable gadget chain is present on the site.

The issue arises from improper sanitization and escaping of a parameter before its use in a SQL statement, resulting in a SQL injection that can be exploited by high-privilege users, such as administrators.

The issue arises from the unserialization of the content of an imported file, potentially leading to PHP object injections when an admin imports a malicious file and a suitable gadget chain is present on the blog. This could occur intentionally or unintentionally.

The issue concerns a lack of validation for ids used in SQL statements, potentially leading to SQL injection. This could be exploited by high-privilege users, such as admins.