Tptnhan

The issue arises from a missing capability check on the ` submit uninstall reason action()` function, allowing authenticated attackers with Subscriber-level access and above to submit a deactivation reason on behalf of a site. This enables unauthorized submission of data.

The issue is due to missing or incorrect nonce validation on the `dpfl listingStatusChange()` function, making it possible for unauthenticated attackers to update listing statuses via a forged request. This can be achieved if an attacker can trick a site administrator into performing an action, such as clicking on a link.

The issue is related to a missing capability check on the `reorder route()` function, allowing unauthenticated attackers to modify data by reordering posts.

The issue is related to a missing capability check on the 'clear ecpay debug log' AJAX action. This allows authenticated attackers with Subscriber-level access and above to clear the plugin's log files, resulting in unauthorized loss of data.

The issue allows unauthorized modification of data due to a missing capability check on the `wooh action settings save frontend()` function. This makes it possible for unauthenticated attackers to update limited plugin settings.

The issue allows authenticated attackers with Subscriber-level access and above to modify plugin settings or reset plugin widgets to their default state. This is due to a missing capability check on the `save options` and `reset widgets` functions.

The issue is a Stored Cross-Site Scripting vulnerability due to insufficient input sanitization and output escaping in the `rfbwp save settings()` function. This allows authenticated attackers with Subscriber-level access and above to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.

The issue is related to unauthorized access of data due to a missing capability check on the `get layouts()` function. This allows authenticated attackers, with Subscriber-level access and above, to obtain a detailed listing of layout templates.

The issue is related to unauthorized modification of data due to a missing capability check on the `import mpfe template()` function. This allows authenticated attackers with Subscriber-level access and above to import templates.

The issue is related to unauthorized use of functionality due to a missing capability check on several AJAX actions. This allows authenticated attackers with Subscriber-level access and above to access logs, update plugin-related user settings, and general plugin settings.

The issue arises from a missing capability check on the `cancel import()` function, allowing authenticated attackers with Subscriber-level access and above to cancel and import or check on the status. This enables unauthorized access.

The issue is related to a missing capability check on the `removeorder` AJAX action, allowing authenticated attackers with Subscriber-level access and above to delete orders. This makes it possible for attackers to modify data without proper authorization.

The issue arises from a missing capability check on the `buy one click export options` AJAX action, allowing authenticated attackers with Subscriber-level access and above to export plugin settings. This results in unauthorized access of data.

The issue is related to a missing capability check on the `buy one click import options` AJAX action, allowing authenticated attackers with Subscriber-level access and above to import plugin settings, thus enabling unauthorized modification of data.

The issue is related to a missing capability check on the `remove unused thumbnails()` function, allowing unauthenticated attackers to delete thumbnails in the `video-wc-gallery-thumb` directory. This enables unauthorized modification of data.

The issue is related to a missing capability check on the `wprss ajax send premium support` function, allowing authenticated attackers with Subscriber-level access and above to send premium support requests with controlled subject lines and email addresses, potentially impersonating the site owner. This could also lead to the leakage of license information.