WPScan

Tripzzy < 1.5.1 - Unauthenticated Arbitrary Comment Deletion

Forminator Forms < 1.57.2.1 - Authenticated Privilege Escalation via Quiz Lead-Form Import

Forminator Forms < 1.57.2.1 - Authenticated RCE via XML-RPC PHP Object Injection

UsersWP - Social Login < 1.5.10 - Unauthenticated Account Takeover via Unverified Provider Email

Botiga Pro < 1.6.5 - Unauthenticated Arbitrary Blog Options Update via Templates Builder REST Route

Ultimate Member < 2.13.1 - Unauthenticated Stored XSS via Profile Page Title

Unbounce Landing Pages 1.1.1 - 1.1.4 - Subscriber+ Reverse-Proxy Target Hijack via set_unbounce_domains

Unlimited Elements For Elementor < 2.0.20 - Subscriber+ PHP Object Injection

Ultimate Addons for Contact Form 7 3.2.4 - 3.5.50 - Unauthenticated Arbitrary File Upload via Signature Field

Kirki 6.0.0 - 6.3.0 - Author+ Stored XSS via Unsanitized SVG Upload