Booking Calendar <= 10.9.2 - Authenticated (Contributor+) DOM-Based Stored Cross-Site Scripting via 'booking' Shortcode
Homey Login Register <= 2.4.0 - Unauthenticated Privilege Escalation
Js O3 Lite <= 1.5.8.2 - Reflected Cross-Site Scripting
Activity Plus Reloaded for BuddyPress <= 1.1.1 - Authenticated (Subscriber+) Blind Server-Side Request Forgery
CoDesigner WooCommerce Builder for Elementor <= 4.7.17.3 - Authenticated (Author+) Stored Cross-Site Scripting
Background Control <= 1.0.5 - Cross-Site Request Forgery to Arbitrary File Deletion
Groundhogg <= 3.7.3.5 - Authenticated (Author+) Arbitrary File Upload via gh_big_file_upload Function
polka dots <= 1.2 - Reflected Cross-Site Scripting