WPScan

Event Tickets < 5.29.0.1 - Contributor+ Seating Layout and Ticket Inventory Modification via IDOR

Orbit Fox by ThemeIsle < 3.0.8 - Author+ Stored XSS via SVG Upload

Content Protector (Passster) < 4.3.6 - Unauthenticated Non-Public Post Content Disclosure via Captcha REST Endpoint

Content Protector (Passster) < 4.3.6 - Unauthenticated Category-Locked Content Disclosure via Core REST API

Content Protector (Passster) < 4.3.6 - Unauthenticated Protected Content Disclosure via Content-Lock Block data-content Attribute

User Registration & Membership < 5.2.6 - Unauthenticated Account Creation While Registration Disabled

miniOrange 2FA < 6.2.7 - 2FA Bypass via Password-Only Second-Factor Rebinding

WP 2FA < 4.1.0 - Two-Factor Authentication Bypass via Passkeys Provider

Ajax Load More < 8.0.1 - Unauthenticated SQL Injection via custom_args

YayPricing < 3.5.7 - Subscriber+ Pricing Configuration Modification and Coupon Code Disclosure