Jonas Benjamin Friedli

Orion SMS OTP Verification <= 1.1.7 - Authentication Bypass via Account Takeover

User Sync – Remote User Sync <= 1.0.2 - Cross-Site Request Forgery to Plugin Deactivation

Theme Editor <= 3.0 - Cross-Site Request Forgery to Remote Code Execution

The Hack Repair Guy's Plugin Archiver <= 2.0.4 - Cross-Site Request Forgery to Arbitrary Directory Deletion in /wp-content

Developer Loggers for Simple History <= 0.5 - Authenticated (Admin+) Local File Inclusion

Hide Categories Or Products On Shop Page <= 1.0.7 - Cross-Site Request Forgery to Settings Update

FitVids for WordPress <= 4.0.1 - Authenticated (Admin+) Stored Cross-Site Scripting

Code Engine <= 0.3.5 - Authenticated (Contributor+) Remote Code Execution

LWS Cleaner <= 2.4.1.3 - Authenticated (Administrator+) Arbitrary File Deletion via 'lws_cl_delete_file'

Everest Backup – WordPress Cloud Backup, Migration, Restore & Cloning Plugin <= 2.3.8 - Missing Authorization to Unauthenticated Backup Failure