WPScan

Academy LMS < 3.8.1 - Subscriber+ Cross-User Lesson Note and Progress Modification via IDOR

Classified Listing < 5.3.9 - Subscriber+ Payment Receipt Disclosure via IDOR

Bit Form < 3.1.0 - Unauthenticated Workflow Trigger via Authentication Bypass

Bit Form < 3.1.0 - Unauthenticated Arbitrary File Read via Path Traversal

CRT Addons for Elementor < 1.6.7 - Unauthenticated Stored XSS via Contact Form

Bpost Shipping Platform < 3.2.3 - Unauthenticated SQL Injection

WPBot AI ChatBot < 8.2.0 - Subscriber+ RAG Settings Update

Passwordless Login by VentraConnect < 1.4.1 - Unauthenticated Account Takeover via Email OTP Brute Force

Kirki < 6.0.12 - Unauthenticated HTML Injection in Password Reset Email via kirki-forgot-password

Kirki < 6.0.12 - Unauthenticated Arbitrary Comment Modification and Moderation Bypass via Component Library