WPScan

Limit Login Attempts Reloaded < 3.3.5 - Username Denylist Bypass via Case Variant and Account Email

WP Directory Kit < 1.5.7 - Unauthenticated User Email Disclosure via select_2_ajax_user

WP Directory Kit < 1.5.6 - Subscriber+ SQL Injection via section Parameter

Backup Migration < 2.1.7 - Admin+ Privilege Escalation via Post-Restore Auto-Login

JetEngine < 3.8.14 - Author+ Stored XSS via SVG Upload

Events Manager < 7.4.1 - Subscriber+ Booking Consent Record Tampering via SQL Injection

ManageWP Worker < 4.9.37 - Unauthenticated Authentication Bypass via Unsigned Auto-Login Parameters

W3 Total Cache < 2.10.5 - Unauthenticated Arbitrary Directory File Write and .htaccess Overwrite via Path Traversal in the Page Cache Key

WP Photo Album Plus < 9.2.07.002 - Unauthenticated Option Disclosure via gettogo

WP Photo Album Plus < 9.2.07.002 - Unauthenticated Arbitrary ZIP File Deletion via delmyzip Path Traversal