István Márton

Magic Action Box <= 2.17.2 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode

GTG Product Feed for Shopping <= 1.2.4 - Missing Authorization to Unauthenticated Plugin Settings Update

Rover IDX <= 3.0.0.2903 - Authenticated (Subscriber+) Missing Authorization via Multiple Functions

Vertical marquee plugin <= 7.1 - Authenticated (Subscriber+) SQL Injection via Shortcode

CE21 Suite <= 2.2.0 - Missing Authorization to Unauthenticated Plugin Settings Change

WP 2FA with Telegram <= 3.0 - Two-Factor Authentication Bypass

Advanced AJAX Page Loader <= 2.7.7 - Cross-Site Request Forgery to Arbitrary File Upload

Funnelforms Free <= 3.7.3.2 - Authenticated (Administrator+) Arbitrary File Upload

SendPress Newsletters <= 1.22.3.31 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode

Mikado Core <= 1.5.2 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode