Dmitrii Ignatyev

PowerPress < 11.17.2 - Contributor+ Stored XSS via Podcast Player Block

NextScripts: Social Networks Auto-Poster < 4.4.8 - Authenticated Social Account Credential Disclosure and Data Deletion

WP YouTube Lyte < 1.7.31 - Contributor+ Stored XSS via Embed Block Attributes

Optimole 4.0.0 - 4.2.12 - Author+ Stored XSS via Video Player Block

Sydney <= 2.56 - Missing Authorization to Authenticated (Subscriber+) Limited Theme Options Update

Gutenverse <= 4.0.8 - Authenticated (Contributor+) Stored Cross-Site Scripting via Post Comment Block 'suffixMain' Attribute

Custom Field Template <= 2.7.8 - Authenticated (Contributor+) Insecure Direct Object Reference to Arbitrary Media File Deletion via 'file_field' Parameter

Pochipp <= 1.20.2 - Reflected Cross-Site Scripting via 'keyword' Parameter

Master Addons for Elementor <= 3.2.2 - Missing Authorization to Authenticated (Contributor+) Arbitrary Post Modification/Deletion via 'popup_id' Parameter

Xpro Elementor Addons < 1.7.9 - Contributor+ Stored XSS via Interactive Circle Widget