WPScan

Subscriptions for WooCommerce < 2.0.1 - Subscriber+ Subscription Detail Disclosure via IDOR

MStore API < 4.21.0 - Unauthenticated Account Takeover via Firebase Phone Authentication

Templately < 3.7.1 - Unauthenticated Administrator Templately Cloud Connection Overwrite

Payment Gateway for Redsys & WooCommerce Lite < 7.0.2 - Unauthenticated Payment Confirmation via Unverified Inespay Callback

WP Events Manager < 2.2.5 - Unauthenticated Payment Bypass and Booking Status Update via IDOR

Subscriptions for WooCommerce < 2.0.1 - Payment Bypass via Attacker-Supplied PayPal Capture Token

Simple CAPTCHA with Cloudflare Turnstile < 1.42.0 - Unauthenticated Turnstile Protection Bypass via Reusable Forminator Cache Key

Content Protector (Passster) < 4.3.7 - Contributor+ Protected Content Disclosure via Core REST API

WPC Name Your Price for WooCommerce < 2.2.5 - Unauthenticated Price Manipulation via Select Mode

miniOrange 2FA < 6.2.8 - 2FA Bypass via Unlimited Second-Factor Attempts