Ramuel Gall

Metform Elementor Contact Form Builder <= 3.3.1 - Authenticated (Subscriber+) Information Disclosure via 'mf_transaction_id' shortcode

Metform Elementor Contact Form Builder <= 3.3.0 - Authenticated (Contributor+) Stored Cross-Site Scripting via mf shortcode

Metform Elementor Contact Form Builder <= 3.3.1 - Authenticated (Subscriber+) Information Disclosure via mf shortcode

Bricks <= 1.8.1 - Cross-Site Request Forgery via reset_settings

Shield Security <= 17.0.17 - Unauthenticated Stored Cross-Site Scripting

VK Blocks <= 1.57.0.5 - Authenticated(Contributor+) Settings Update

Royal Elementor Addons <= 1.3.59 - Insufficient Access Control to Template Activation

Under Construction <= 3.96 - Cross-Site Request Forgery via admin_action_ucp_dismiss_notice

The BackupWordPress plugin for WordPress is vulnerable to information disclosure in versions up to, and including 3.12. This is due to missing authorization on the heartbeat_received() function that triggers on WordPress heartbeat. This makes it possible

Time-based Blind SQL Injection in Spam protection, AntiSpam, FireWall by CleanTalk < 5.153.4