WPScan

SureForms < 2.11.1 - Unauthenticated Payment Amount Bypass

Newsletters < 4.15 - Unauthenticated PHP Object Injection via Subscriber Custom Field

WP 2FA < 3.1.1.2 - Account Takeover via 2FA Setup Email Binding

Breeze Cache < 2.5.6 - Unauthenticated Stored XSS via Minify Library

User Registration & Membership < 5.2.2 - Subscriber+ Cross-User Role and Membership Tier Modification via IDOR

User Registration & Membership < 5.2.2 - Unauthenticated PayPal Webhook Signature Verification Bypass Leading to Membership Activation

Tutor LMS < 3.9.13 - Subscriber+ Arbitrary Auto-Approved Comment Creation

Database for Contact Form 7, WPforms, Elementor forms < 1.5.2 - Unauthenticated PHP Object Injection via Entry File Field

Tutor LMS < 3.9.13 - Subscriber+ Arbitrary Quiz Attempt Modification via IDOR

Tutor LMS < 3.9.13 - Instructor+ Arbitrary Post Overwrite via IDOR