WPScan

GamiPress < 7.9.9.6 - Subscriber+ Arbitrary User Points and Achievement Award via Watch-Video Listeners

Rank Math SEO < 1.0.277.1 - Unauthenticated Password-Protected Post Content Disclosure via Post Metadata and llms.txt

Rank Math SEO < 1.0.277 - Unauthenticated Non-Public Post Schema and Content Disclosure

Rank Math SEO < 1.0.277 - Author+ Robots and Pillar Content Meta Update on Non-Owned Objects via mark_page_as

Rank Math SEO < 1.0.277 - Author+ Non-Public Post Content Disclosure via Abilities API

Rank Math SEO < 1.0.277 - Author+ Term Metadata Update and Cross-Object Post Title Overwrite via updateMetaBulk

Rank Math SEO < 1.0.277 - Author+ Arbitrary Post and User Metadata Overwrite via updateSchemas

RegistrationMagic < 6.0.9.9 - Unauthenticated Stored XSS via Rating Field

FormLayer < 1.0.9 - Unauthenticated Form Configuration Disclosure via Form Submission Response

CatalogX < 6.1.3 - Unauthenticated Email Content Injection via Shared Transient