WPScan

Login with QR <= 1.0.0 - Unauthenticated Authentication Bypass via 'autologin_code' Parameter

HT Mega 3.2.0 - 3.2.5 - Contributor+ Stored XSS via Section Headline Tag

Newsletter < 9.3.8 - Unauthenticated Subscriber PII Disclosure and Modification via Predictable Tracking Signature Key

Dewa Kirim <= 1.0.0 - Unauthenticated Stored XSS via Checkout Coordinates

Comments Import & Export 2.1.11 - 2.5.3 - Author+ Comment PII Disclosure via Export

Dictionary <= 1.0 - Unauthenticated Stored XSS via Direct Dictionary Update

wpShopGermany IT-RECHT KANZLEI < 2.4 - Unauthenticated RCE via Predictable API Token

PuppyFW <= 0.4.4 - Subscriber+ Arbitrary Blog Options Update and Deletion Leading to Privilege Escalation

Paid Member Subscriptions < 3.0.9 - Unauthenticated Membership Payment Bypass via PayPal Standard Amount and Currency Mismatch

Autopay < 5.0.1 - Unauthenticated Cross-Customer Order Payment Parameter Disclosure and Deletion