Erwan LR (WPScan)

NextGEN Gallery < 4.5.0 - Authenticated Plugin Image Settings Update

Botiga Pro < 1.6.5 - Unauthenticated Arbitrary Blog Options Update via Templates Builder REST Route

WP Import Export Lite < 3.9.33 - Authenticated RCE via Export Field PHP Function

Ni WooCommerce Sales Report < 4.2.0 - Unauthenticated SQLi via 'sort' Parameter

WP Directory Kit <= 1.5.7 - Unauthenticated Unpublished Listing Disclosure via map_infowindow

WP Travel < 12.0.2 - Unauthenticated Arbitrary Booking Cancellation

Payment Plugins for PayPal WooCommerce < 2.0.26 - Unauthenticated Customer PII Disclosure via order-pay

AI Website Builder (GitHub build) 1.0.0 - Unauthenticated RCE via Unprotected REST Routes

Pods < 3.3.9.2 - Author+ Arbitrary File Read via Shortcode Display Callback

Brave Popup Builder < 0.8.8 - Unauthenticated Arbitrary Shortcode Execution via UTM Parameter