The aapanel WP Toolkit plugin is vulnerable to privilege escalation, allowing subscribers to gain admin privileges. Attachment Manager plugin versions up to 2.1.2 are vulnerable to arbitrary file deletion, potentially leading to remote code execution. Adrian Tobey's Groundhogg plugin, up to version 4.2.1, allows unrestricted upload of dangerous file types, enabling web shell uploads. Alcatel-Lucent OmniAccess Stellar Products have multiple critical vulnerabilities, including command injection with root privileges and session ID spoofing, allowing attackers full control of access points. Arisoft's Contact Form 7 Editor Button suffers from Reflected XSS, and Atakan Au's Import CDN-Remote Images has Stored XSS via CSRF. August Infotech's Multi-language Responsive Contact Form has missing authorization, allowing unauthorized access to functionality. Awethemes' Hillter theme has a deserialization vulnerability enabling object injection. B1.lt plugin versions up to 2.2.56 allow SQL injection for authenticated users. Alone Charity Multipurpose Non-profit WordPress Theme by Bearsthemes has vulnerabilities for arbitrary file deletion and arbitrary file uploads, potentially leading to remote code execution. Bears Backup plugin versions up to 2.0.0 allow unauthenticated attackers to execute arbitrary code on the server. BossSoft CRM 6.0 and Campcodes Online Movie Theater Seat Reservation System 1.0 are vulnerable to SQL injection. Cisco Identity Services Engine Software has an API vulnerability allowing unauthenticated root privilege escalation. CMSJunkie's WP-BusinessDirectory plugin up to 3.1.3 is susceptible to Blind SQL Injection. cmsMinds' Pay with Contact Form 7 has Reflected XSS. Multiple code-projects systems, including AVL Rooms, Church Donation System, and Electricity Billing System, exhibit critical SQL injection vulnerabilities. Finally, chainguard-dev's apko, up to version 0.29.4, had critical file permission issues that could be abused for root escalation.