WPScan

WP Social Media Login <= 1.0.6 - Unauthenticated Account Takeover via Twitter Login Flow

Social Login & Sharing buttons with Analytics By SoClever <= 1.2.0 - Unauthenticated Authentication Bypass

SmilePass Selfie Login <= 1.0.2 - Unauthenticated Authentication Bypass

FiboSearch < 1.34.1 - Unauthenticated Password-Protected Product Information Disclosure

Conekta Payment Gateway < 6.2.2 - Unauthenticated Order Payment Completion via Webhook Forgery

ManageWP Worker < 4.9.37 - Unauthenticated Authentication Bypass via Unsigned Auto-Login Parameters

Tutor LMS < 4.0.6 - Instructor+ Arbitrary File Read via Video Path

Forminator Forms < 1.57.0.5 - Admin+ Network-Wide RCE via Hub Connector API Key on Multisite

Forminator Forms < 1.57.0.7 - Authenticated Privilege Escalation via Registration Form Role Bypass

Slider Hero < 9.1.3 - Unauthenticated Stored XSS via Slider Type Change and Add-Slider Handlers