WPScan

FiboSearch < 1.34.1 - Unauthenticated Password-Protected Product Information Disclosure

Conekta Payment Gateway < 6.2.2 - Unauthenticated Order Payment Completion via Webhook Forgery

ManageWP Worker < 4.9.37 - Unauthenticated Authentication Bypass via Unsigned Auto-Login Parameters

Tutor LMS < 4.0.6 - Instructor+ Arbitrary File Read via Video Path

Forminator Forms < 1.57.0.5 - Admin+ Network-Wide RCE via Hub Connector API Key on Multisite

Forminator Forms < 1.57.0.7 - Authenticated Privilege Escalation via Registration Form Role Bypass

Slider Hero < 9.1.3 - Unauthenticated Stored XSS via Slider Type Change and Add-Slider Handlers

Firebase Authentication < 1.7.1 - Unauthenticated Account Takeover via Firebase Email Claim

WooCommerce Bookings < 3.9.0 - Subscriber+ Draft Bookable Product Creation via Missing Authorization

Content Mask 1.8.0 - 1.8.5.4 - Contributor Publish Capability Bypass via create_new_content_mask