Yaswanth Reddy Sunkara

WP Directory Kit < 1.5.8 - Listing Admin+ Stored XSS via Category and Location Title and Icon Fields

Newsletters < 4.18.1 - Unauthenticated Subscriber Record Overwrite and PII Disclosure via IDOR

Visualizer < 4.0.8 - Contributor+ Stored XSS via JSON Data Source

WP Directory Kit <= 1.5.7 - Editor+ SQL Injection via Elementor Category and Location Widget Settings

WP Directory Kit <= 1.5.7 - Contributor+ Non-Public Listing Field Disclosure via Shortcodes

Visualizer < 4.0.6 - Contributor+ Arbitrary Chart Deletion via deleteChart

Groundhogg < 4.7.2 - Open Redirect via 'redirect_to' Parameter

Quentn WP 1.2.13 - 1.2.14 - Unauthenticated SQLi via 'qntn_wp' Parameter

Quentn WP < 1.2.15 - Admin+ SQLi via 'orderby'/'order' Parameter

Post Grid, Slider & Carousel Ultimate < 1.8.1 - Contributor+ Stored XSS via Header Title Field