WPScan

Event Booking Manager for WooCommerce < 5.3.7 - Contributor+ Arbitrary Post Modification via mpwem_quick_edit_event

Event Booking Manager for WooCommerce < 5.3.7 - Author+ Stored XSS via Event Timeline Content

Charitable < 1.8.5.3 - Admin+ Stored XSS via Photo Field ALT Text

WebToffee Cookie Consent < 3.5.3 - Consent Log Disclosure/Deletion, Page Creation & License Deactivation via Unprotected REST Routes

WooCommerce Product Attachment < 2.3.3 - Unauthenticated Arbitrary Media Download

Narrative Publisher <= 1.0.7 - Contributor+ Stored XSS via narrative_post_script Post Meta

Huge IT Login <= 1.0.4 - Unauthenticated Account Takeover

ChatBot for eCommerce – WoowBot < 4.8.4 - Unauthenticated Gemini API Key Abuse via qcld_gemini_response

SMS Alert Order Notifications – WooCommerce < 3.9.8 - Unauthenticated Account Takeover via Unbound OTP Verification in Signup-with-Mobile

Five Star Restaurant Reservations < 2.7.23 - Booking Manager+ Missing Authorization via rtb_reset_notifications