István Márton

Startklar Elementor Addons <= 1.7.13 - Unauthenticated Arbitrary File Upload

UserPro <= 5.1.1 - Sensitive Information Disclosure via Shortcode

UltimateAI <= 2.8.3 - Limited User Password Change due to Improper Empty and Missing Default Value Check

Category and Taxonomy Meta Fields <= 1.0.0 - Authenticated (Editor+) Stored Cross-Site Scripting

WP Directorybox Manager <= 2.5 - Authentication Bypass

Funnelforms Free <= 3.7.3.2 - Authenticated (Administrator+) Arbitrary File Deletion

ARMember Premium <= 6.7 - Cross-Site Request Forgery via multiple functions

Cardealer <= 1.6.4 - Missing Authorization to Authenticated (Subscriber+) Change and Delete JS and CSS Files

Allow PHP in Posts and Pages <= 3.0.4 - Authenticated (Subscriber+) Remote Code Execution via Shortcode

Groundhogg <= 2.7.9.8 - Missing Authorization to Non-Arbitrary File Upload