Jakub Herman

Kirki < 6.2.1 - Unauthenticated Arbitrary Shortcode Execution via Form Email Actions

TenWeb Speed Optimizer < 2.33.5 - Unauthenticated Stored XSS via Critical CSS Token Bypass

Bookly < 27.8 - Unauthenticated SQL Injection via staff_id

Events Manager < 7.3.7 - Unauthenticated SQL Injection via PHP Object Injection in Booking Registration

All-in-One WP Migration and Backup < 7.106 - Unauthenticated Arbitrary-Location Log File Write via Path Traversal

Redux Framework < 4.5.13 - Subscriber+ Privilege Escalation to Administrator