WPScan

Woo Refund And Exchange Lite < 4.6.4 - Unauthenticated Guest Order Message Disclosure and Manipulation

Kirki < 6.0.14 - Unauthenticated User and Comment Author Email Disclosure via kirki_get_apis

Directorist 8.5 - 8.9.2 - Subscriber+ Arbitrary Image Move via REST v2 Listing Submission

Stripe Payment Forms by WP Full Pay < 8.5.1 - Unauthenticated Customer Portal Subscription and Billing Data Disclosure via Unconfirmed Session

Stripe Payment Forms by WP Full Pay < 8.5.1 - Cross-Customer Subscription Modification via IDOR

Noptin < 4.3.3 - Unauthenticated Subscriber PII and confirm_key Disclosure via Actions Page

Royal Elementor Addons < 1.7.1066 - Unauthenticated Taxonomy Term Disclosure

WP Social Media Login <= 1.0.6 - Unauthenticated Account Takeover via Twitter Login Flow

Social Login & Sharing buttons with Analytics By SoClever <= 1.2.0 - Unauthenticated Authentication Bypass

SmilePass Selfie Login <= 1.0.2 - Unauthenticated Authentication Bypass