Jonas Benjamin Friedli

AI Engine <= 3.1.8 - Authenticated (Editor+) Server-Side Request Forgery

Time Clock – A WordPress Employee & Volunteer Time Clock Plugin <= 1.3.1 - Authenticated (Custom+) Stored Cross-Site Scripting

Crypto Tool <= 2.22 - Missing Authentication to Unauthenticated Limited File Deletion

Multiple Roles per User <= 1.0 - Missing Authorization to Authenticated (Custom+) Privilege Escalation

Time Tracker <= 3.1.0 - Missing Authorization to Authenticated (Subscriber+) Arbitrary Options Update and Limited Data Deletion

ShopEngine Elementor WooCommerce Builder Addon – All in One WooCommerce Solution <= 4.8.3 - Insufficient Authorization to Authenticated (Editor+) Settings Update

Supervisor <= 1.3.2 - Missing Authorization to Authenticated (Subscriber+) Settings Update

MPWizard – Create Mercado Pago Payment Links <= 1.2.1 - Cross-Site Request Forgery to Arbitrary Post Deletion

SupportCandy – Helpdesk & Customer Support Ticket System <= 3.3.7 - Authentication Bypass to Support Session Takeover

Smart Docs <= 1.1.1 - Authenticated (Admin+) Stored Cross-Site Scripting