WPScan

Optimole 4.0.0 - 4.2.14 - Subscriber+ Sensitive Data Disclosure via Dashboard Widget

String Locator < 2.6.8 - Unauthenticated PHP Object Injection via Database Editor

User Private Files < 2.1.9 - Subscriber+ User Email Address Disclosure via dpk_upvf_rmv_access

PowerPress 11.13.12 - 11.17.9 - Contributor+ SSRF via Media URL Redirects

MetForm < 4.3.1 - Unauthenticated HTML Injection in Notification Emails via Field Shortcodes

Magee Shortcodes <= 2.1.1 - Unauthenticated Mail Relay via Contact Form

Nexi XPay Build <= 7.6.2 - Unauthenticated Payment Completion and Order Key Disclosure

Nexi XPay Build <= 7.6.2 - Unauthenticated Payment Bypass via NPG Notification Handler

All in One SEO < 5.0.2.1 - Unauthenticated Arbitrary Shortcode Execution via Search Query

Deema Payment Gateway <= 1.1.2 - Unauthenticated Payment Bypass and Order Manipulation via Webhook