WPScan

Persian Elementor < 2.8.2 - Unauthenticated ZarinPal Payment Callback Authority Bypass

MetForm < 4.1.9 - Unauthenticated Email Header Injection via Notification Reply-To

CoolClock < 4.3.8 - Contributor+ Stored XSS via Custom Skin JSON

CoolClock < 4.3.8 - Contributor+ Stored XSS via Skin Class Attribute

GTranslate < 3.0.10 - Admin+ Stored XSS

Teddy Bear Customize Addon <= 1.0.5 - Unauthenticated Account Takeover

Teddy Bear Customize Addon <= 1.0.5 - Unauthenticated Arbitrary File Upload

Teddy Bear Customize Addon <= 1.0.5 - Unauthenticated Order Data Disclosure

Advanced Customized Prompts <= 1.0.1 - Unauthenticated Account Takeover

Advanced Customized Prompts <= 1.0.1 - Subscriber+ Stored XSS via Product Popup Configuration