Khaled Alenazi (Nxploited)

Chama < 1.0.13 - Unauthenticated PHP Object Injection

Simple User Registration <= 6.9 - Unauthenticated Privilege Escalation to Administrator

Notification Bar for WordPress <= 1.1.8 – Unauthenticated Subscriber Data Disclosure

Auto x LINE <= 1.0.0 – Unauthenticated REST API Endpoints Call

Developer Tools <= 1.1.3 – Unauthenticated Arbitrary File Upload

Advanced Custom Fields: Extended < 0.9.2.7 - Unauthenticated Administrator Account Takeover via Front-End User Update Action

WP Social Media Login <= 1.0.6 - Unauthenticated Account Takeover via Twitter Login Flow

Social Login & Sharing buttons with Analytics By SoClever <= 1.2.0 - Unauthenticated Authentication Bypass

SmilePass Selfie Login <= 1.0.2 - Unauthenticated Authentication Bypass

Dokan < 5.0.14 - Shop Manager+ Arbitrary Plugin Installation/Activation via REST API