Product Feed Manager vulnerabilities

The Product Feed Manager plugin by WPFunnels Team (up to version 7.14.1) has a missing authorization vulnerability, allowing exploitation of incorrectly configured access control security levels.

The WordPress plugin Product Feed Manager in versions up to 7.12.0 contains an SQL Injection vulnerability accessible to users with Contributor privileges. A Contributor can inject malicious SQL queries through a vulnerable parameter.

The WordPress plugin Product Feed Manager in versions up to 7.14.1 contains a PHP Object Injection vulnerability exploitable by a shop manager-level user. This may lead to injection of a malicious PHP object.

Unauthenticated Cross-Site Scripting (XSS) vulnerability in the Product Feed Manager plugin up to version 7.6.1. Allows an attacker to inject malicious scripts.