Ivan Cese

Career Section <= 1.6 - Cross-Site Request Forgery to Arbitrary File Deletion

Clubmember <= 0.2 - Authenticated (Admin+) Stored Cross-Site Scripting

The Bucketlister <= 0.1.5 - Missing Authorization to Authenticated (Subscriber+) Bucket List Modification

The Bucketlister <= 0.1.5 - Authenticated (Contributor+) SQL Injection via `category` and `id` Shortcode Attributes

ProjectList <= 0.3.0 - Authenticated (Editor+) SQL Injection via 'id' Parameter

Download Panel <= 1.3.3 - Missing Authorization to Authenticated (Subscriber+) Arbitrary Plugin Settings Modification

Nari Accountant <= 1.0.12 - Authenticated (Editor+) Stored Cross-Site Scripting

GetContentFromURL <= 1.0 - Authenticated (Contributor+) Server-Side Request Forgery via 'url' Shortcode Attribute

WaveSurfer-WP <= 2.8.3 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'src' Shortcode Attribute

MeetingList <= 0.11 - Authenticated (Admin+) Stored Cross-Site Scripting