WPScan

Firebase Authentication < 1.7.1 - Unauthenticated Account Takeover via Firebase Email Claim

WooCommerce Bookings < 3.9.0 - Subscriber+ Draft Bookable Product Creation via Missing Authorization

Content Mask 1.8.0 - 1.8.5.4 - Contributor Publish Capability Bypass via create_new_content_mask

Brave Popup Builder < 0.8.6 - Unauthenticated Reflected XSS via UTM Parameters

Brave Popup Builder < 0.8.6 - Subscriber+ Unpublished Popup Disclosure via Preview

Post Grid, Slider & Carousel Ultimate < 1.8.1 - Contributor+ Stored XSS via Header Title Field

Tutor LMS < 4.0.6 - Instructor+ Cross-Instructor Private Course Disclosure via IDOR

Eventin < 4.1.21 - Contributor+ Server-Side Request Forgery

Drag and Drop Multiple File Upload for Contact Form 7 < 1.3.9.9 - Unauthenticated RCE via Control Character Filename Bypass

Dokan < 5.0.14 - Vendor+ Reverse Withdrawal Ledger Manipulation via Client-Supplied Amount