moonge

AutoNetTV Relay < 3.0.14 - Unauthenticated Privilege Escalation via Scheduled Sync Cron

TabaPay Gateway <= 1.4.0 - Unauthenticated Account Takeover via Payment Callback

User Session Synchronizer <= 1.4.0 - Unauthenticated Authentication Bypass to Account Takeover via 'ussync-key', 'ussync-token', and 'ussync-ref' Parameters

6Storage Rentals <= 2.27.0 - Unauthenticated Account Takeover via 'email' Parameter

Pronamic Pay <= 10.1.0 - Authenticated (Subscriber+) Privilege Escalation via Gravity Forms 'Update user role' Field

MemberGlut < 1.1.5 - Unauthenticated Privilege Escalation to Administrator

CAFEHAUS API <= 1.0.0 - Unauthenticated Arbitrary User Password Reset

MDJM Event Management <= 1.7.8.4 - Authenticated (Subscriber+) Privilege Escalation via 'set-permissions' and 'change_role' Handlers

Happy Coders OTP Login for WooCommerce < 2.8 - Unauthenticated Account Takeover via hcotp_auto_login_user