Convert Plus vulnerability