István Márton

IMGspider <= 2.3.10 - Authenticated (Contributor+) Arbitrary File Upload via 'upload'

ThemeMakers PayPal Express Checkout <= 1.1.9 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode

Buy Me a Coffee – Button and Widget Plugin <= 3.7 - Cross-Site Request Forgery

Cardealer <= 1.6.4 - Cross-Site Request Forgery to User Update via update_user_profile

CE21 Suite <= 2.2.0 - JWT Token Disclosure

BSK PDF Manager <= 3.4.1 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode

Comments by Startbit <= 1.4 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode

WP Ultimate CSV Importer <= 7.9.8 - Arbitrary Usermeta Update to Authenticated (Author+) Privilege Escalation

EmbedPress <= 3.8.2 - Missing Authorization to Authenticated (Subscriber+) Plugin Settings Delete via admin_post_remove and remove_private_data

CAOS | Host Google Analytics Locally <= 4.7.14 - Missing Authorization to Unauthenticated Plugin Settings Update