Karthik Ramakrishnan

Forminator Forms < 1.57.2.1 - Subscriber+ Form Stripe Field Migration via migrate_stripe

Ninja Forms 3.15.3 - Unauthenticated PHP Object Injection via CSV Export

Forminator Forms < 1.57.2.1 - Authenticated Privilege Escalation via Quiz Lead-Form Import

Forminator Forms < 1.57.2.1 - Authenticated RCE via XML-RPC PHP Object Injection

SAML Single Sign On < 6.0.0 - Unauthenticated Privilege Escalation via Account Matching

Ultimate Member < 2.13.1 - Unauthenticated Stored XSS via Profile Page Title

MasterStudy LMS 3.6.2 - < 3.7.50 - Instructor+ Student PII Disclosure via IDOR

Eventin < 4.1.24 - Contributor+ User Creation via Speaker Creation

Eventin < 4.1.24 - Unauthenticated Order and Attendee Status Reset via Payment REST Endpoint

WPLP Cookie Consent < 4.4.4 - Arbitrary Post Deletion via CSRF