WPScan

WP Import Export Lite < 3.9.33 - Contributor+ Stored DOM XSS via Custom Field Names

WP Import Export Lite < 3.9.33 - Admin+ SSRF via Import URL Handling

Eventin < 4.1.24 - Unauthenticated Ticket Price Rewrite via order_token

Ni WooCommerce Sales Report < 4.2.0 - Unauthenticated SQLi via 'sort' Parameter

Ni WooCommerce Sales Report < 4.2.0 - Unauthenticated Order and Customer Data Disclosure via 'btn_print' Parameter

Schema & Structured Data for WP & AMP < 1.66 - Unauthenticated Password-Protected Post Content Disclosure via JSON-LD Schema Output

Schema & Structured Data for WP & AMP 1.46 - 1.65 - Unauthenticated Non-Public Comment Content Disclosure via IDOR

Schema & Structured Data for WP & AMP 1.63 - 1.65 - Contributor+ Non-Public Post Content Disclosure via AI Schema Generation

Xpro Elementor Addons < 1.7.9 - Contributor+ Stored XSS via Interactive Circle Widget

Optimole < 4.2.12 - Unauthenticated Stored XSS via Srcset Descriptor Parameter