WPScan

JetEngine < 3.8.12 - Contributor+ Stored XSS via jet_engine Shortcode

Support Genix Lite < 1.4.48 - Unauthenticated Ticket Attachment Download via Missing Authorization

Paid Member Subscriptions < 3.0.7 - Unauthenticated Sensitive Information Exposure via Residual Export Files

Paid Member Subscriptions < 3.0.7 - Subscriber+ Payment Data Disclosure via IDOR

NewStatPress < 1.4.5 - Unauthenticated Stored XSS via Top Post Widget

Events Made Easy < 3.1.4 - Unauthenticated Person Data Modification via IDOR

King Addons for Elementor < 51.1.76 - Reflected XSS via Posts Grid Widget

YOP Poll < 7.0.6 - Unauthenticated Vote Restriction Bypass via IP Header Spoofing

Mapster WP Maps < 1.24.0 - Unauthenticated Private and Draft Post Content Disclosure

Login/Signup Popup < 3.2.5 - Unauthenticated Account Takeover via Password Reset Rate Limit Bypass