WPScan

Theme Demo Import <= 1.1.3 - Admin+ Arbitrary File Upload

Direct Payments for WooCommerce < 2.5.3 - Unauthenticated Cross-Customer Order Tampering via digages AJAX Actions

Webinfos <= 1.2 - Unauthenticated Arbitrary File Upload

Kirki < 6.0.13 - Unauthenticated SQL Injection

Kirki < 6.0.13 - Unauthenticated PHP Object Injection

wpForo Forum < 3.1.2 - Subscriber+ Cross-User AI Chat Message Deletion via IDOR

wpForo Forum < 3.1.2 - Subscriber+ Stored XSS via Profile Location Field

miniOrange 2FA < 6.2.6 - 2FA Bypass via Attacker-Controlled ga_secret

Lenxel WP <= 1.0.31 - Unauthenticated Account Takeover via Arbitrary Password Reset

Academy LMS <= 3.8.2 - Subscriber+ Sensitive Information Disclosure via quiz_attempts REST Endpoint