WPScan

AI Engine < 3.6.6 - Subscriber+ Arbitrary File Read via Audio Transcription

AI Engine < 3.6.4 - Editor+ Sensitive Information Disclosure of API Key and Bearer Tokens

AI Engine < 3.6.4 - Unauthenticated Cross-Session Chatbot File Deletion via Forgeable Session Cookie

Term Pages < 2.0.0 - Unauthenticated SQL Injection via tp_lookup

Solace Extra < 1.6.1 - Subscriber+ Multiple Missing Authorization via Site-Wide Nonce Exposure

WP Custom HTML Pages <= 0.6.2 - Author+ Stored XSS

Custom Fields for WooCommerce < 1.5.1 - Unauthenticated Arbitrary File Deletion via Path Traversal

MultiVendorX < 5.0.11 - Store Owner+ Cross-Store Commission Data Disclosure via commissions REST Endpoint

User Registration & Membership < 5.2.6 - Unauthenticated Account Creation While Registration Disabled

Stripe Payment Forms by WP Full Pay < 8.5.2 - Unauthenticated Payment Intent Amount Manipulation