Peter Thaleikis

aDirectory – WordPress Directory Listing Plugin <= 2.3 - Missing Authorization to Authenticated (Subscriber+) Arbitrary Post Deletion

Gallery Styles <= 1.3.4 - Authenticated (Contributor+) Stored Cross-Site Scripting

Financial Calculator <= 2.2.1 - Authenticated (Contributor+) Stored Cross-Site Scripting

SMSAlert - WooCommerce <= 3.7.5 - Authenticated (Contributor+) Stored Cross-Site Scripting via sa_subscribe Shortcode

Library Bookshelves <= 5.10 - Authenticated (Contributor+) Stored Cross-Site Scripting

Out of the Block: OpenStreetMap <= 2.8.3 - Authenticated (Contributor+) Stored Cross-Site Scripting via ootb_query Shortcode

Store Locator Widget <= 2025r1 - Authenticated (Contributor+) Stored Cross-Site Scripting

PowerBI Embed Reports <= 1.1.7 - Authenticated (Contributor+) Stored Cross-Site Scripting

Cision Block <= 4.3.0 - Authenticated (Contributor+) Stored Cross-Site Scripting via id Parameter

Hide My WP Ghost – Security & Firewall <= 5.3.01 - Reflected Cross-Site Scripting via URL