WPScan

WP Travel Engine < 6.8.5 - Unauthenticated Booking Details Disclosure and Modification via wte_add_trip_to_cart

TeraWallet - Wallet for WooCommerce < 1.6.10 - Subscriber+ Wallet Balance Inflation via Discounted Top-Up

WP Photo Album Plus < 9.2.07.002 - Unauthenticated Arbitrary ZIP File Deletion via delmyzip Path Traversal

Events Manager < 7.4.1 - Unauthenticated Privilege Escalation to Administrator

WooCommerce Subscriptions < 9.1.0 - Unauthenticated RCE via PHP Object Injection

Gift Cards For WooCommerce Pro < 4.2.10 - Unauthenticated Arbitrary File Upload

Import WP < 2.14.23 - Unauthenticated Sensitive Information Exposure via Export File Download

WP Crowdfunding < 2.2.1 - Subscriber+ Campaign Creation via Missing Authorization

WP Crowdfunding < 2.2.1 - Subscriber+ Order Data Disclosure via IDOR

KiviCare < 4.5.2 - Doctor/Receptionist+ SQL Injection via settings/listing REST Endpoint