WPScan

Newsletters < 4.18.1 - Unauthenticated Subscriber Record Overwrite and PII Disclosure via IDOR

Zportals < 6.4.2 - Subscriber+ Arbitrary Plugin Settings Update

Zportals < 6.4.2 - Subscriber+ User Email Disclosure

YAHMAN Add-ons < 0.9.31 - Unauthenticated Arbitrary File Upload via Blog Card Cache

Better Payment < 2.3.4 - Unauthenticated Payment Amount Manipulation

Directorist 8.5 - 8.9.4 - Subscriber+ Order and Financial Record Disclosure via REST Orders Endpoint

Payment Plugins for PayPal WooCommerce < 2.0.27 - Unauthenticated Payment Hijacking via Unvalidated PayPal Order ID

MasterStudy LMS < 3.7.50 - Subscriber+ Stored HTML Injection via Course Discussions

MasterStudy LMS < 3.7.50 - Subscriber+ Quiz Attempt Grade Disclosure via IDOR

WP OAuth Server < 6.4.0 - Subscriber+ Cross-User Account Takeover via OIDC ID Token Substitution