Farid Narimanov

Masteriyo LMS < 2.3.3 - Instructor+ Stored XSS via Quiz Description

ShopEngine < 4.9.3 - Customer PII Disclosure via Forced Authentication

WP Helper Premium < 4.7.6 - Unauthenticated Order Data Disclosure and Order Manipulation via Missing Order Key Validation

Product Input Fields for WooCommerce < 2.0.2 - Unauthenticated Arbitrary File Upload

User Access Manager < 2.3.15 - Unauthenticated Restricted Content Disclosure via REST API

WPC Admin Columns < 2.3.4 - Subscriber+ Arbitrary User/Post/Term Meta Disclosure

WP Photo Album Plus < 9.2.09.002 - Subscriber+ Cross-Album File Upload via Missing Authorization

Block User Account < 2.0.1 - Subscriber+ Account Block Bypass via Application Passwords

RSS Aggregator by Feedzy < 5.2.6 - Author+ Cross-User Import Job Manipulation and Post Deletion

WP Data Access < 5.5.79 - Unauthenticated Sensitive Data Disclosure via Autocomplete Column Authorization Bypass