WPScan

Breeze Cache < 2.5.6 - Unauthenticated Stored XSS via Minify Library

User Registration & Membership < 5.2.2 - Subscriber+ Cross-User Role and Membership Tier Modification via IDOR

User Registration & Membership < 5.2.2 - Unauthenticated PayPal Webhook Signature Verification Bypass Leading to Membership Activation

Tutor LMS < 3.9.13 - Subscriber+ Arbitrary Auto-Approved Comment Creation

Database for Contact Form 7, WPforms, Elementor forms < 1.5.2 - Unauthenticated PHP Object Injection via Entry File Field

Tutor LMS < 3.9.13 - Subscriber+ Arbitrary Quiz Attempt Modification via IDOR

Tutor LMS < 3.9.13 - Instructor+ Arbitrary Post Overwrite via IDOR

Tutor LMS < 3.9.13 - Subscriber+ Unauthorized Course Enrollment and Private Course Content Disclosure via Droip/Kirki Integration

WP Job Portal < 2.5.5 - Subscriber+ Arbitrary Job Approval, Featuring and Rejection

WP Job Portal < 2.5.5 - Subscriber+ Employer Email Disclosure via IDOR