Really Simple Security vulnerabilities

The Really Simple Security WordPress plugin before 9.8.3 does not validate a client-supplied address value before using it as a storage key in one of its own options, allowing unauthenticated attackers to grow that option without bound and to slow the site's handling of missing pages.

Really Simple Security plugin for WordPress before 9.8.2 contains a missing authorization check vulnerability that allows authenticated low-privileged attackers to bypass enforced two-factor authentication indefinitely by exploiting an unguarded code path in the profile-page update handler.

The Really Simple Security WordPress plugin before 9.8.0 does not check if the user is allowed to install plugins, allowing a subsite administrator on a multisite network to install and execute arbitrary code in the network-shared plugin directory. Exploitation requires the network administrator to have enabled the plugin's administration menu for subsites, which is not the default.