Maciej Komorowski

Everest Forms <= 3.6.3 - Unauthenticated Arbitrary File Read via 'Signature' Field Meta Key Branch of attach_entry_files

Motors <= 1.4.125 - Authenticated (Subscriber+) Arbitrary File Deletion via 'stm_user_avatar_path' User Meta

Appointment Booking Plugin <= 5.7.6 - Unauthenticated Stored Cross-Site Scripting via Customer Email Field

AAA Autoload Optimizer <= 1.7.0 - Authenticated (Subscriber+) Stored Cross-Site Scripting via 'option_page' Parameter via 'all' Hook

Redux Framework <= 4.5.16 - Authenticated (Custom+) Stored Cross-Site Scripting via theme_opts Parameter via User Profile

Salon Booking System <= 10.31.9 - Unauthenticated Stored Cross-Site Scripting via Custom Checkout Field (Html/File Type) via Public Booking AJAX

Anti-Spam by CleanTalk <= 6.88 - Unauthenticated Stored Cross-Site Scripting via Comment Content via ContactsEncoder Greedy Regex

Simple Membership <= 4.8.4 - Authenticated (Subscriber+) Stored Cross-Site Scripting via Country Field