Usama Arshad

AWP Classifieds < 4.4.9 - Unauthenticated Listing Contact Email Disclosure via Place Ad Page

WP-Invoice <= 4.3.1 - Subscriber+ User PII Disclosure via Unprotected AJAX Handlers

SendPress <= 1.26.1.20 - Unauthenticated Newsletter Sending Log Disclosure via Hardcoded Token

WPCafe < 3.0.21 - Unauthenticated Product Data Disclosure via REST API

User Private Files < 2.1.9 - Subscriber+ User Email Address Disclosure via dpk_upvf_rmv_access

Pie Register < 3.8.4.14 - Unauthenticated User Email Disclosure via Invitation Code

Connections Business Directory <= 10.4.67 - Unauthenticated Non-Public Directory Entry Disclosure via cn-api/v1 REST Routes

Optima Express 8.6.0 - 8.7.5 - Author+ Stored XSS via faq_script

wpForo Forum 3.0.0 - 3.1.5 - Unauthenticated AI Credit Exhaustion via IP Rate Limit Bypass

Masteriyo LMS < 3.4.2 - Subscriber+ Quiz Answer Key Disclosure