WPScan

AI Engine < 3.6.6 - Subscriber+ Arbitrary File Read via Audio Transcription

AI Engine < 3.6.4 - Unauthenticated Cross-Session Chatbot File Deletion via Forgeable Session Cookie

Solace Extra < 1.6.1 - Subscriber+ Multiple Missing Authorization via Site-Wide Nonce Exposure

Download Monitor < 5.2.6 - Unauthenticated Download Log Injection

WP Directory Kit < 1.5.5 - Subscriber+ SQL Injection via data_fields_list Parameter

Dokan < 5.0.11 - Vendor+ Cross-Vendor Downloadable Product Access Grant via Order Downloads REST Endpoint

YMC Filter < 3.12.9 - Author+ Stored XSS via SVG Icon Upload

Appointment Hour Booking < 1.5.88 - Unauthenticated Booking Price Manipulation via tcost Parameter

Newsletters < 4.16 - Unauthenticated API Authentication Bypass via Type Juggling

Newsletters < 4.16 - Unauthenticated PHP Object Injection via Date Form Field