WPScan

NEX-Forms < 9.2.3 - Unauthenticated Stored XSS via Form Submission

User Registration & Membership < 5.2.3 - Unauthenticated Privilege Escalation via Unbound members_data Membership ID

PhonePe Payment Solutions < 3.1.0 - Unauthenticated Payment Bypass via Forged Callback

User Registration & Membership < 5.2.3 - Unauthenticated Limited User Deletion via Stripe Subscription Handler

WPS Bookings for WooCommerce < 3.11.7 - Subscriber+ Arbitrary Booking Order Cancellation via IDOR

Royal Elementor Addons < 1.7.1063 - Unauthenticated Private Mega Menu Template Disclosure

AI Chatbot & Workflow Automation by AIWU < 1.5.4 - Unauthenticated Privilege Escalation via MCP OAuth

Customer Reviews for WooCommerce < 5.113.0 - Unauthenticated Arbitrary Media Upload via cr_upload_media

Redux Framework < 4.5.13 - Subscriber+ Privilege Escalation to Administrator

Abandoned Cart Lite for WooCommerce < 6.8.2 - Unauthenticated Account Takeover via Malleable Recovery-Link Token