WPScan

Forminator Forms < 1.57.2.1 - Authenticated RCE via XML-RPC PHP Object Injection

Unlimited Elements For Elementor < 2.0.20 - Subscriber+ PHP Object Injection

Kirki 6.0.0 - 6.3.0 - Author+ Stored XSS via Unsanitized SVG Upload

SAML Single Sign On < 6.0.0 - Unauthenticated Privilege Escalation via Account Matching

NextGEN Gallery < 4.5.0 - Authenticated Arbitrary Gallery Image Deletion via IDOR

NextGEN Gallery < 4.5.0 - Authenticated Plugin Image Settings Update

NextGEN Gallery < 4.5.0 - Contributor+ Image Metadata Disclosure via IDOR

NextGEN Gallery < 4.5.0 - Authenticated Cross-Gallery Settings Modification via IDOR

NextGEN Gallery < 4.5.0 - Authenticated Arbitrary File Upload via ZIP Import

Import and export users and customers < 2.4.5 - Admin+ SSRF via bp_avatar