WPScan

User Registration & Membership < 5.2.6 - Unauthenticated Account Creation While Registration Disabled

miniOrange 2FA < 6.2.7 - 2FA Bypass via Password-Only Second-Factor Rebinding

WP 2FA < 4.1.0 - Two-Factor Authentication Bypass via Passkeys Provider

Ajax Load More < 8.0.1 - Unauthenticated SQL Injection via custom_args

YayPricing < 3.5.7 - Subscriber+ Pricing Configuration Modification and Coupon Code Disclosure

GeoDirectory < 2.8.168 - Contributor+ User Email Disclosure via geodir_json_search_users

WP Custom HTML Pages <= 0.6.2 - Author+ Stored XSS

Login/Signup with Phone Number, OTP Verification < 1.8.71 - Unauthenticated Account Takeover via OTP Brute Force

Sunshine Photo Cart < 3.6.12 - Unauthenticated Private Gallery Comment Disclosure

Bit Form < 3.2.0 - Unauthenticated Stored XSS via SVG Signature Upload