WPScan

Bpost Shipping Platform < 3.2.3 - Unauthenticated SQL Injection

WPBot AI ChatBot < 8.2.0 - Subscriber+ RAG Settings Update

Passwordless Login by VentraConnect < 1.4.1 - Unauthenticated Account Takeover via Email OTP Brute Force

Kirki < 6.0.12 - Unauthenticated HTML Injection in Password Reset Email via kirki-forgot-password

Kirki < 6.0.12 - Unauthenticated Arbitrary Comment Modification and Moderation Bypass via Component Library

All-in-One WP Migration and Backup < 7.106 - Unauthenticated Arbitrary-Location Log File Write via Path Traversal

LearnPress < 4.4.1 - Reflected XSS via c_search

PayPlus Payment Gateway < 8.2.2 - Unauthenticated Order Payment Metadata Tampering

PayPlus Payment Gateway < 8.2.2 - Unauthenticated Order Key Disclosure and Order Status Modification

Unlimited Elements for Elementor < 2.0.11 - Unauthenticated Stored XSS via Google Reviews Widget