Divyesh Prajapati

The issue arises from the use of the merge function in src/SearchParameters/index.js, specifically in the `SearchParameters. parseNumbers` function, without protection against prototype properties, leading to Prototype Pollution. This is only exploitable if the implementation allows users to define arbitrary search patterns.

A cross-site scripting (XSS) issue exists due to insufficient input validation in the `column title` function. This allows remote attackers to inject arbitrary web script or HTML via a crafted attachment name.

A cross-site scripting (XSS) issue exists, allowing remote attackers to inject arbitrary web script or HTML. This is due to a vulnerability in the `wp get attachment link` function. The estimated number of potentially affected devices worldwide is not specified.

The issue allows remote attackers to bypass intended redirection restrictions.

The issue allows remote attackers to bypass intended access restrictions and remove a category attribute from a post.

The issue allows remote attackers to bypass intended password-change restrictions by leveraging knowledge of a cookie.

The issue allows remote attackers to obtain sensitive revision-history information by leveraging the ability to read a post, related to `wp-admin/includes/ajax-actions.php` and `wp-admin/revision.php`.