WPScan

WPFunnels < 3.13.0 - Unauthenticated Price Manipulation via Order Bump Product ID Substitution

Pods < 3.3.9.2 - Author+ Arbitrary File Read via Shortcode Display Callback

Hummingbird < 3.21.2 - Admin+ Network-Wide RCE via Hub Connector on Multisite

Content Views < 4.5.1.2 - Unauthenticated Non-Public Post Content Disclosure via Views Status Filter

Classified Listing < 6.1.1 - Subscriber+ Arbitrary Attachment Deletion and Listing Image Tampering via IDOR

WPFunnels < 3.13.0 - Unauthenticated User Registration via Opt-in Forms

EmbedPress 4.6.0 - 4.6.3 - Contributor+ Google Reviews Modification

EmbedPress 4.6.0 - 4.6.3 - Contributor+ Administrator Email Disclosure via Google Reviews REST Route

Eventin < 4.1.22 - Contributor+ Site Homepage Hijack and Event Taxonomy Manipulation via Missing Authorization

VikWidgetsLoader < 1.12.0 - Contributor+ Stored XSS via Gutenberg Block class_suffix