WPScan

WPvivid Backup & Migration < 0.9.138 - Admin+ Path Traversal via Local Backup Directory Setting

Premium Packages < 7.3.1 - Unauthenticated Guest Order Status Disclosure

Premium Packages < 7.3.1 - Unauthenticated Cross-User Saved Cart Disclosure via IDOR

Premium Packages < 7.3.1 - Subscriber+ Guest Order Takeover

Stape Conversion Tracking 2.3.0 - 2.3.10 - Unauthenticated SSRF and Same-Origin XSS via Proxy Sub-Path

EventPrime < 4.3.6.1 - Unauthenticated Pending Post Disclosure via Public Post Status Override

Simple Download Monitor < 4.1.3 - Contributor+ Private Download Item Title and Description Disclosure via [sdm_show_download_info] Shortcode

All-in-One Video Gallery < 5.0.0 - Contributor+ Stored XSS via Shortcode Attribute

VikWidgetsLoader < 1.12.3 - Contributor+ Stored XSS via Speakers and Cookies Policy Blocks

CryptoCloud - Crypto Payment Gateway 3.0.0 - 3.0.1 - Unauthenticated Arbitrary Order Payment Forgery via Empty-Default Webhook Secret