WPScan

WP Import Export Lite < 3.9.35 - Authenticated Privilege Escalation via User Import

Estatik < 4.3.5 - Reflected XSS via get_listings hash Parameter

Unbounce Landing Pages 1.1.1 - 1.1.4 - Subscriber+ Reverse-Proxy Target Hijack via set_unbounce_domains

Ultimate Member < 2.13.1 - Unauthenticated Stored XSS via Profile Page Title

Botiga Pro < 1.6.5 - Unauthenticated Arbitrary Blog Options Update via Templates Builder REST Route

UsersWP - Social Login < 1.5.10 - Unauthenticated Account Takeover via Unverified Provider Email

Master Blocks 1.4.1 - 1.4.1.4 - Unauthenticated Stored XSS via White Label Settings

VikRentItems Flexible Rental Management System < 1.2.4 - Unauthenticated SQLi

Bookly < 28.2 - Unauthenticated AI Assistant Conversation Disclosure and Message Injection via IDOR

WPGraphQL Smart Cache < 2.3.2 - Unauthenticated Persisted Query Registration and Alias Squatting