WPScan

Meta Box < 5.13.1 - Contributor+ Arbitrary Attachment Deletion via IDOR

HUSKY - Products Filter Professional for WooCommerce < 1.4.1 - Shop Manager+ Local File Inclusion via meta_filter search_view

ChatBot for eCommerce – WoowBot < 4.8.4 - Unauthenticated Gemini API Key Abuse via qcld_gemini_response

Gallery for Google Photos < 1.2.1 - Unauthenticated Google OAuth Token Disclosure

Codeless Page Builder <= 1.1.4 - Contributor+ Stored XSS via Shortcode Attribute

TaxoPress < 3.51.0 - Contributor+ Private Post Disclosure via IDOR

JS Help Desk – AI-Powered Support & Ticketing System < 3.1.5 - Subscriber+ Cross-User Support Ticket Disclosure via IDOR

SMS Alert Order Notifications – WooCommerce < 3.9.8 - Unauthenticated Account Takeover via Unbound OTP Verification in Signup-with-Mobile

Five Star Restaurant Reservations < 2.7.23 - Booking Manager+ Missing Authorization via rtb_reset_notifications

GeekyBot < 1.2.8 - Unauthenticated Sensitive Information Exposure via Chat History