WPScan

wpForo Forum < 3.1.2 - Subscriber+ Stored XSS via Profile Location Field

miniOrange 2FA < 6.2.6 - 2FA Bypass via Attacker-Controlled ga_secret

Lenxel WP <= 1.0.31 - Unauthenticated Account Takeover via Arbitrary Password Reset

Academy LMS <= 3.8.2 - Subscriber+ Sensitive Information Disclosure via quiz_attempts REST Endpoint

Ultimate Member < 2.12.1 - Unauthenticated Privilege Escalation via Role Selection Field

Builderall for WordPress < 3.0.2 - Unauthenticated OAuth Access Token Poisoning via Public REST Routes

Clever Mega Menu for Visual Composer <= 1.0.1 - Subscriber+ Menu Item Meta Update via save_clever_menu_item

Spectra (Ultimate Addons for Gutenberg) < 2.20.0 - Contributor+ Stored CSS Injection via Block Attributes

Dataverse Integration < 2.91 - Contributor+ Server-Side Template Injection (SSTI) to Information Disclosure

Creative Mail 1.6.5 - 1.6.9 - Unauthenticated SQLi