Truoc Phan

tagDiv Composer <= 5.4.5 - Authenticated (Contributor+) Stored Cross-Site Scripting

tagDiv Opt-In Builder <= 1.7 - Authenticated (Subscriber+) SQL Injection via subscriptionCouponId Parameter

tagDiv Composer <= 5.3 - Reflected Cross-Site Scripting via 'data'

tagDiv Composer <= 5.3 - Reflected Cross-Site Scripting via 'account_id' and 'account_username'

tagDiv Composer <= 5.3 - Cross-Site Request Forgery to Stored Cross-Site Scripting

WP Hotel Booking <= 2.1.2 - Authenticated (Subscriber+) Arbitrary File Upload

MStore API – Create Native Android & iOS Apps On The Cloud <= 4.15.2 - Authentication Bypass to Account Takeover

WooCommerce - Social Login <= 2.7.5 - Authentication Bypass to Account Takeover

ProfileGrid – User Profiles, Groups and Communities <= 5.8.9 - Authenticated (Subscriber+) Authorization Bypass to Privilege Escalation

InstaWP Connect – 1-click WP Staging & Migration <= 0.1.0.44 - Authentication Bypass to Admin