Usama Arshad

Royal MCP < 1.5.10 - Contributor+ Private and Draft Content Disclosure and publish_posts Bypass via elementor_clone_page

News Kit Addons For Elementor < 1.4.9 - Subscriber+ Plugin Installation and Activation via nekit_install_importer

News Kit Addons For Elementor <= 1.4.7 - Subscriber+ Arbitrary Post Meta Update via nekit_update_mega_menu_form

Cart Abandonment Recovery for WooCommerce < 2.2.0 - Unauthenticated Authentication Bypass via Unsigned Recovery Token

Easy Property Listings < 3.5.27 - Subscriber+ Sensitive Data Disclosure via Contact CRM AJAX Handlers

Easy Property Listings < 3.5.28 - Unauthenticated Hidden Listing Details Disclosure via REST API

ThirstyAffiliates < 3.12.1 - Unauthenticated Non-Public Affiliate Link Destination Disclosure and Click Statistic Injection

Tasty Recipes Lite 1.2 - 1.2.10 - Contributor+ Taxonomy Term Creation, Renaming and Deletion

Modern Events Calendar Lite < 7.37.0 - Subscriber+ Sensitive Data Disclosure via mec_event_bookings and mec_attendees AJAX Actions

GamiPress 7.9.5 - 8.0.5 - Unauthenticated Private Activity Log Disclosure