Erwan LR (WPScan)

Copy & Delete Posts < 1.5.6 - Authenticated Arbitrary Post Content and Password Disclosure

Content Protector (Passster) < 4.3.9 - Unauthenticated Protected Content Disclosure via REST Path Allowlist Bypass

KiviCare < 4.5.4 - Patient+ Arbitrary Media Attachment Read via IDOR

KiviCare < 4.5.4 - Patient+ Cross-Patient Appointment Modification via IDOR

ProSolution WP Client < 2.0.11 - Reflected XSS via 'page' Parameter

TrueBooker Appointment Booking < 1.2.7 - Unauthenticated Appointment and Payment Record Deletion via update_appointment_booked

JetEngine < 3.8.14 - Author+ Stored XSS via SVG Upload

WP Directory Kit < 1.5.7 - Unauthenticated User Email Disclosure via select_2_ajax_user

ECS < 4.3.10 - Contributor+ Arbitrary Post Meta Disclosure via Dynamic Repeater ACF Source

WP Directory Kit < 1.5.7 - Admin+ SQL Injection via section Parameter