WPScan

MetForm < 4.1.9 - Unauthenticated Email Header Injection via Notification Reply-To

WPCafe 3.0.10 - 3.0.17 - Unauthenticated Order Disclosure and Modification via food-orders REST API

Persian Elementor < 2.8.2 - Unauthenticated ZarinPal Payment Callback Authority Bypass

Visualizer < 4.0.6 - Contributor+ Arbitrary Post/Page Modification via IDOR

SSL Zen < 4.7.40 - Subscriber+ TLS Private Key Disclosure

Featured Image with URL < 1.0.6 - Contributor+ Stored XSS via Image Alt Text

Visualizer < 4.0.6 - Contributor+ Arbitrary Chart Deletion via deleteChart

AI Builder 2.4.1 - 2.7.7 - Contributor+ Stored XSS via Post JavaScript

Gutenverse News < 3.3.3 - Unauthenticated Stored XSS via Comment Content

Simple CAPTCHA with Cloudflare Turnstile 1.2.2 - 1.42.1 - Unauthenticated Arbitrary Shortcode Execution via Contact Form 7 Field Repopulation