Michael Mazzolini

Starter Templates <= 4.4.41 - Authenticated (Author+) Arbitrary File Upload via WXR Upload Bypass

BuddyBoss Platform <= 2.7.70 - Authenticated (Subscriber+) Stored Cross-Site Scripting via 'link_title'

Contact Form Plugin by Fluent Forms for Quiz, Survey, and Drag & Drop WP Form Builder <= 5.2.6 - Unauthenticated Stored Cross-Site Scripting via Form Subject

TagDiv Composer <= 5.3 - Unauthenticated Arbitrary PHP Object Instantiation

Give <= 3.22.0 - Missing Authorization to Unauthenticated Arbitrary Earning Reports Disclosure via give_reports_earnings Function

Advanced Ads <= 2.0.12 - Unauthenticated Limited Code Execution

Royal Addons for Elementor <= 1.7.1049 - Authenticated (Author+) Arbitrary File Upload via main.php Upload Bypass

Everest Forms <= 3.1.1 - Authenticated (Subscriber+) Arbitrary Shortcode Execution

Aruba HiSpeed Cache <= 3.0.2 - Reflected Cross-Site Scripting

Social Sharing Plugin – Sassy Social Share <= 3.3.69 - Reflected Cross-Site Scripting via heateor_mastodon_share Parameter