WPScan

Meow Gallery < 5.5.5 - Author+ Draft and Private Post Disclosure via fetch_posts

Meow Gallery < 5.5.5 - Unauthenticated Arbitrary Shortcode Execution via load_gallery_collection REST Route

Tripzzy < 1.5.1 - Unauthenticated Booking Data Tampering

Tripzzy < 1.5.1 - Unauthenticated Arbitrary Comment Deletion

Forminator Forms < 1.57.2.1 - Authenticated Privilege Escalation via Quiz Lead-Form Import

Forminator Forms < 1.57.2.1 - Authenticated RCE via XML-RPC PHP Object Injection

Unlimited Elements For Elementor < 2.0.20 - Subscriber+ PHP Object Injection

Kirki 6.0.0 - 6.3.0 - Author+ Stored XSS via Unsanitized SVG Upload

SAML Single Sign On < 6.0.0 - Unauthenticated Privilege Escalation via Account Matching

NextGEN Gallery < 4.5.0 - Authenticated Arbitrary Gallery Image Deletion via IDOR