Alex Thomas

WP EasyCart <= 5.4.10 - Authenticated (Administrator+) SQL Injection via 'orderby'

Weaver Show Posts <= 1.6 - Authenticated(Contributor+) Stored Cross-Site Scripting via Display Name

Elementor Addons, Widgets and Enhancements – Stax <= 1.4.3 - Cross-Site Request Forgery via toggle_widget

WPCS – WordPress Currency Switcher Professional <= 1.1.9 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode

WP EasyCart <= 5.4.8 - Cross-Site Request Forgery via process_delete_product

WPCS – WordPress Currency Switcher Professional <= 1.1.9 - Missing Authorization to Arbitrary Custom Drop-Down Currency Switcher Deletion

ShiftController Employee Shift Scheduling <= 4.9.25 - Reflected Cross-Site Scripting via Query String

Directorist <= 7.5.4 - Authenticated (Subscriber+) Insecure Direct Object Reference to Arbitrary Post Deletion in listing_task

WP EasyCart <= 5.4.8 - Cross-Site Request Forgery via process_bulk_delete_product

Houzez <= 4.1.6 - Authenticated (Subscriber+) PHP Object Injection via Saved Search