Pablo González Pérez

To Do List Member 1.4 - 1.6 - Unauthenticated Stored XSS, File Listing and Deletion via Unprotected Upload Handler

GenieWords 1.5.27 - 1.5.34 - Unauthenticated Stored XSS and Configuration Overwrite

BE REST Endpoints <= 1.0.0 - Unauthenticated Stored XSS and Widget Manipulation

Zonify < 1.0.5 - Unauthenticated Account Login Token Disclosure

FAQ Builder AYS 1.6.3 - 1.8.4 - Unauthenticated Stored XSS via ays_get_user_information

Icollect <= 1.0.0 - Unauthenticated User and Term Creation via Unrestricted Method Dispatch

Rest Routes <= 5.5.5 - Unauthenticated SQLi via custom-tables/tables/{table_name}

Total Processing Card Payments for WooCommerce <= 7.3 - Unauthenticated SSRF leading to Payment Bypass and Gateway Credential Disclosure

Icollect <= 1.0.0 - Unauthenticated Arbitrary File Read, SSRF and Path Traversal File Write via Default Publishing Password

Arvow AI SEO Writer < 1.5.4 - Unauthenticated Arbitrary Post Creation via Webhook Secret Type-Juggling