WPScan

Testimonials Widget <= 4.0.4 - Unauthenticated SSRF via Featured Image URL

Testimonials Widget <= 4.0.4 - Unauthenticated Arbitrary Post Update

Optimole 4.0.0 - 4.2.12 - Author+ Stored XSS via Video Player Block

MCP Server for WordPress < 1.8.2 - Contributor+ Arbitrary Post Title Disclosure via workflows/run REST Route

MCP Server for WordPress < 1.8.2 - Contributor+ Workflow Modification and Deletion via Missing Ownership Check

MCP Server for WordPress < 1.8.2 - Administrator Account Creation via CSRF

WP Delicious < 1.10.8 - Contributor+ Stored XSS via Recipe Block Tag Name

Bluff Post <= 1.1.1 - Unauthenticated SQLi via 'table_name' and 'column_name' Parameters

Multiple elFinder Plugins - DOM-based XSS via postMessage Origin Bypass

WP Review Slider Pro < 12.7.12 - Subscriber+ SQLi via Stored Template Filter