WordPress Newsletter Manager plugin <= 1.5.1 - Unauthenticated Insecure Deserialisation vulnerability

Unauthenticated Insecure Deserialisation vulnerability found by Jerome Bruander NinTechNet in WordPress Newsletter Manager plugin versions = 1.5.1. Solution 2020-12-31 - we were unable to find a patched version of this plugin. WordPress.org notification: "This plugin has been closed as of October...

WP Security Audit Log < 4.0.2 - Broken Access Control in First-Time Install Wizard

Broken access control vulnerability affecting version 4.0.1 and below that could lead to privilege escalation, sensitive data exposure and insecure deserialisation. To exploit the vulnerability, the wizard must not have been completed, otherwise it won’t work...