WPScan

JetEngine < 3.8.12 - Contributor+ Stored XSS via jet_engine Shortcode

RT Mega Menu < 1.5.2 - Subscriber+ Stored XSS via Menu Item CSS

King Addons for Elementor < 51.1.76 - Reflected XSS via Posts Grid Widget

Gallery for Google Photos < 1.2.1 - Unauthenticated Google OAuth Token Disclosure

Geo My WP < 4.5.5.3 - Subscriber+ Arbitrary Geolocation Record Modification and Deletion via IDOR

Simple Membership < 4.7.8 - Unauthenticated Administrator Account Takeover via Registration Username Collision

Dokan < 5.0.9 - Vendor+ Arbitrary Order Status Modification via orders/bulk-actions REST Endpoint

Dokan < 5.0.9 - Vendor+ Cross-Vendor Product Attribute Modification via Product Attribute REST API

Simple Membership < 4.7.8 - Unauthenticated Stored XSS via PayPal Subscription Subscriber Name

SM Page Duplicator <= 1.0.0 - Editor+ SQL Injection via Page Duplication