Jonas Benjamin Friedli

CubeWP – All-in-One Dynamic Content Framework <= 1.1.27 - Unauthenticated Information Exposure

Bookster – WordPress Appointment Booking Plugin <= 2.1.1 - Authenticated (Administrator+) SQL Injection via 'raw'

Kognetiks Chatbot <= 2.3.5 - Missing Authorization to Unauthenticated Limited File Uploads and Conversation Erasing

Login with YourMembership - YM SSO Login <= 1.1.7 - Missing Authorization to Unauthenticated Sensitive Information Exposure via 'moym_display_test_attributes'

Keyy Two Factor Authentication (like Clef) <= 1.2.3 - Authenticated (Subscriber+) Privilege Escalation via Account Takeover

Shelf Planner <= 2.8.1 - Unauthenticated Information Exposure via Log Files

atec Debug <= 1.2.22 - Authenticated (Administrator+) Arbitrary File Deletion

Football Pool <= 2.12.4 - Authenticated (Administrator+) Stored Cross-Site Scripting

Shelf Planner <= 2.8.1 - Missing Authorization to Unauthenticated Settings Update

Broken Link Notifier <= 1.3.0 - Unauthenticated Server-Side Request Forgery