WPScan

Sign-up Sheets < 2.4.0 - Arbitrary Sign-up Deletion via CSRF

Yo 1.1 - 1.3.1 - Unauthenticated SQL Injection via username Parameter

TikTok 1.2.0 - 1.4.1 - Unauthenticated OAuth Code Redemption

Import and export users and customers < 2.5.2 - Custom Role Privilege Escalation to Administrator via Frontend Importer

Import and export users and customers < 2.5.2 - Custom Role Privilege Escalation to Administrator via caller_can_promote_users

Meow Gallery < 5.5.5 - Author+ Draft and Private Post Disclosure via fetch_posts

Meow Gallery < 5.5.5 - Unauthenticated Arbitrary Shortcode Execution via load_gallery_collection REST Route

Tripzzy < 1.5.1 - Unauthenticated Booking Data Tampering

Tripzzy < 1.5.1 - Unauthenticated Arbitrary Comment Deletion

Forminator Forms < 1.57.2.1 - Authenticated Privilege Escalation via Quiz Lead-Form Import