Pablo González Pérez

To Do List Member 1.4 - 1.6 - Unauthenticated Content Injection via Import

Tripzzy < 1.5.1 - Unauthenticated Booking Data Tampering

Tripzzy < 1.5.1 - Unauthenticated Arbitrary Comment Deletion

MgoSync 2.1.5 - 2.1.6 - Unauthenticated WooCommerce API Credential Disclosure

Rede Itaú for WooCommerce < 5.4.7 - Unauthenticated Order Status Manipulation via PIX Webhook

Dewa Kirim <= 1.0.0 - Unauthenticated Stored XSS via Checkout Coordinates

Dictionary <= 1.0 - Unauthenticated Stored XSS via Direct Dictionary Update

To Do List Member 1.4 - 1.6 - Unauthenticated Stored XSS, File Listing and Deletion via Unprotected Upload Handler

GenieWords 1.5.27 - 1.5.34 - Unauthenticated Stored XSS and Configuration Overwrite

BE REST Endpoints <= 1.0.0 - Unauthenticated Stored XSS and Widget Manipulation