WPScan

BuddyPress < 14.5.0 - Subscriber+ Private Messages Disclosure via IDOR

ElementsKit Lite < 3.10.01 - Subsite Administrator+ Stored XSS via Megamenu Menu-Item Settings (Multisite)

Academy LMS <= 3.8.2 - Subscriber+ Sensitive Information Disclosure via quiz_attempts REST Endpoint

miniOrange 2FA < 6.2.6 - 2FA Bypass via Attacker-Controlled ga_secret

Ultimate Member < 2.12.1 - Unauthenticated Privilege Escalation via Role Selection Field

Kirki < 6.0.13 - Unauthenticated PHP Object Injection

Kirki < 6.0.13 - Unauthenticated SQL Injection

ElementsKit Lite < 3.10.01 - Subsite Administrator+ PHP Code Injection via Custom Widget Builder (Multisite)

wpForo Forum < 3.1.2 - Subscriber+ Cross-User AI Chat Message Deletion via IDOR

Frontend Admin by DynamiApps < 3.29.9 - Unauthenticated Stored Cross-Site Scripting via Form Field