WPScan

Optima Express 8.6.0 - 8.7.5 - Author+ Stored XSS via faq_script

Optima Express 8.5.0 - 8.7.5 - Unauthenticated Author Account Creation & Application Password Rotation via ihf_clear_cache

Malcure Malware Shield < 19.9.7 - Multisite Subsite Admin+ Arbitrary File Write and Deletion via wpmr_ajax_request

WP YouTube Lyte < 1.7.31 - Contributor+ Stored XSS via Embed Block Attributes

Testimonials Widget <= 4.0.4 - Unauthenticated SSRF via Featured Image URL

Testimonials Widget <= 4.0.4 - Unauthenticated Arbitrary Post Update

Optimole 4.0.0 - 4.2.12 - Author+ Stored XSS via Video Player Block

MCP Server for WordPress < 1.8.2 - Contributor+ Arbitrary Post Title Disclosure via workflows/run REST Route

MCP Server for WordPress < 1.8.2 - Contributor+ Workflow Modification and Deletion via Missing Ownership Check

MCP Server for WordPress < 1.8.2 - Administrator Account Creation via CSRF