WPScan

Mailgun for WordPress < 2.2.1 - Unauthenticated Arbitrary Mailgun List Subscription via add_list AJAX

Check & Log Email < 2.0.15 - Admin+ SQL Injection via d and s Parameters

GiveWP < 4.16.3 - Unauthenticated Recurring Donor Information Disclosure

WP Go Maps < 10.1.04 - Unauthenticated SQL Injection via Markers REST filter

BuddyPress < 14.5.0 - Subscriber+ Private Messages Disclosure via IDOR

ElementsKit Lite < 3.10.01 - Subsite Administrator+ Stored XSS via Megamenu Menu-Item Settings (Multisite)

Academy LMS <= 3.8.2 - Subscriber+ Sensitive Information Disclosure via quiz_attempts REST Endpoint

miniOrange 2FA < 6.2.6 - 2FA Bypass via Attacker-Controlled ga_secret

Ultimate Member < 2.12.1 - Unauthenticated Privilege Escalation via Role Selection Field

Kirki < 6.0.13 - Unauthenticated PHP Object Injection