WPScan

AI Engine 3.4.0 - 3.7.1 - Unauthenticated Arbitrary AI Query Execution via Editor Assistant

AI Engine 3.3.3 - 3.7.1 - Subscriber+ Arbitrary File Read via 'url' Parameter

AI Engine 2.8.0 - 3.6.0 - Admin+ Multisite Network Administrator Account Takeover via MCP User Tools

Kirki < 6.2.3 - Editor+ Stored XSS via Font Zip Upload

WP Fastest Cache 0.9.0.3 - 1.5.0 - Unauthenticated Stored XSS via Host Header Cache Poisoning

WP Project Manager 2.2.0 - 4.0.6 - Subscriber+ User Activity Feed Disclosure via IDOR

WP Project Manager < 4.0.7 - Subscriber+ Cross-Project Task Disclosure and Task Board Modification via IDOR

WP Project Manager 2.1.0 - 4.0.6 - Unauthenticated Subscriber Account Creation via Trello Import Routes

Pods < 3.3.9.1 - Author+ RCE via Shortcode Display Callback

ProfilePress < 4.17.1 - Unauthenticated Arbitrary Shortcode Execution via Display Name