István Márton

News Announcement Scroll <= 9.0.0 - Authenticated (Contributor+) SQL Injection via Shortcode

Linkz.ai <= 1.1.8 - Missing Authorization to Authenticated (Subscriber+) Plugin Settings Update via AJAX

OTP Login Woocommerce & Gravity Forms <= 2.2 - Authentication Bypass to Privilege Escalation

ZM Ajax Login & Register <= 2.0.2 - Authentication Bypass

JQuery Accordion Menu Widget <= 3.1.2 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode

WooCommerce Multivendor Marketplace – REST API <= 1.5.3 - Missing Authorization to Authenticated (Subscriber+) Arbitrary Order/Order Note Disclosure, Order Note Addition via REST API

Gutenberg Forms <= 2.2.9 - Unauthenticated Arbitrary File Upload

Groundhogg <= 2.7.9.8 - Cross-Site Request Forgery to Disable All Plugins

BAN Users <= 1.5.3 - Missing Authorization to Authenticated (Subscriber+) Settings Update & Privilege Escalation

Piotnet Forms <= 1.0.28 - Unauthenticated Arbitrary File Upload