WPScan

ElementsKit Lite < 3.10.01 - Subsite Administrator+ Stored XSS via Megamenu Menu-Item Settings (Multisite)

ElementsKit Lite < 3.10.01 - Subsite Administrator+ PHP Code Injection via Custom Widget Builder (Multisite)

WebToffee Cookie Consent < 3.5.3 - Consent Log Disclosure/Deletion, Page Creation & License Deactivation via Unprotected REST Routes

SVG Support < 2.5.17 - Author+ Stored XSS via .svgz Sanitization Bypass

WC Buckaroo BPE Gateway < 4.9.0 - Subscriber+ Unauthorized Order Refund

Everest Toolkit <= 1.2.3 - Admin+ Arbitrary File Upload

Theme Demo Import <= 1.1.3 - Admin+ Arbitrary File Upload

Direct Payments for WooCommerce < 2.5.3 - Unauthenticated Cross-Customer Order Tampering via digages AJAX Actions

Webinfos <= 1.2 - Unauthenticated Arbitrary File Upload

Kirki < 6.0.13 - Unauthenticated SQL Injection