Artus KG

Groundhogg < 4.5.13 - Unauthenticated Stored XSS via Web Form Dropdown/Radio Field

User Registration & Membership < 5.2.6 - Authenticated Privilege Escalation via Login Settings

Support Genix Lite < 1.4.48 - Unauthenticated Arbitrary File Read via Path Traversal

Login & Register Forms < 4.0.2 - Unauthenticated Registered User Email Address Disclosure via Lost Password Response

Login & Register Forms < 4.0.2 - Unauthenticated Account Takeover via Password Reset Verification State Keyed on a Client-Supplied Address Header

Bit File Manager < 6.9.1 - Subscriber+ Arbitrary File Read and Deletion via Connector Command Request-Source Mismatch

DHL for WooCommerce < 4.0.1 - Unauthenticated Shipping Label Disclosure via Unprotected Uploads Directory

DHL for WooCommerce < 4.0.1 - Unauthenticated Shipping Label Download via IDOR

YMC Filter < 3.12.9 - Author+ Stored XSS via SVG Icon Upload

miniOrange 2FA < 6.2.7 - 2FA Bypass via Password-Only Second-Factor Rebinding