Francesco Carlucci

Password Protected Store for WooCommerce <= 2.2 - Information Exposure via REST API

Charity Addon for Elementor <= 1.3.3 - Authenticated (Contributor+) Post Disclosure

SVG Block <= 1.1.24 - Authenticated (Administrator+) Stored Cross-Site Scripting via SVG File Upload

f(x) Private Site <= 1.2.1 - Sensitive Information Exposure

Tabs for WooCommerce <= 1.0.0 - Authentiated (Shop Manager+) PHP Object Injection in product_has_custom_tabs

BuddyPress WooCommerce My Account Integration. Create WooCommerce Member Pages <= 3.4.20 - Authenticated (Subscriber+) PHP Object Injection in get_simple_request

Oxygen Builder <= 4.8.3 - Missing Authorization to Authenticated (Subscriber+) Stylesheet Update

Memberpress <= 1.11.37 - Unauthenticated Content Restriction Bypass to Sensitive Information Exposure

Categorify <= 1.0.7.4 - Cross-Site Request Forgery via categorifyAjaxAddCategory

Beaver Builder Addons by WPZOOM <= 1.3.4 - Authenticated (Contributor+) Stored Cross-Site Scripting via Heading Widget