Pablo González Pérez

Zonify < 1.0.5 - Unauthenticated Account Login Token Disclosure

FAQ Builder AYS 1.6.3 - 1.8.4 - Unauthenticated Stored XSS via ays_get_user_information

Icollect <= 1.0.0 - Unauthenticated User and Term Creation via Unrestricted Method Dispatch

Rest Routes <= 5.5.5 - Unauthenticated SQLi via custom-tables/tables/{table_name}

Total Processing Card Payments for WooCommerce <= 7.3 - Unauthenticated SSRF leading to Payment Bypass and Gateway Credential Disclosure

Icollect <= 1.0.0 - Unauthenticated Arbitrary File Read, SSRF and Path Traversal File Write via Default Publishing Password

Arvow AI SEO Writer < 1.5.4 - Unauthenticated Arbitrary Post Creation via Webhook Secret Type-Juggling

ProSolution WP Client < 2.0.6 - Unauthenticated Blind SQLi via 'jobID' Parameter

Child Pages Card < 1.09 - Contributor+ Stored XSS via Shortcode Attributes

WP Custom HTML Pages <= 0.6.2 - Author+ Stored XSS