Jakub Herman

TenWeb Speed Optimizer < 2.33.5 - Unauthenticated Stored XSS via Critical CSS Token Bypass

Essential Addons for Elementor < 6.7.2 - Unauthenticated Privilege Escalation via Custom Profile Field Mass Assignment

Events Manager < 7.4.1 - Unauthenticated Privilege Escalation to Administrator

Events Manager < 7.4.1 - Subscriber+ Booking Consent Record Tampering via SQL Injection

Kirki < 6.2.1 - Unauthenticated Arbitrary Shortcode Execution via Form Email Actions

InfiniteWP Client < 1.13.6 - Unauthenticated Administrator Account Takeover on Multisite

WP Maps Pro < 6.1.3 - Unauthenticated Local File Inclusion

WP Maps < 4.9.7 - Subscriber+ Local File Inclusion

Ajax Search Lite < 4.14.5 - Unauthenticated PHP Object Injection via Search Statistics REST Endpoint

Content Views < 4.5 - Subscriber+ SQL Injection via preview_request