WPScan

Client Invoicing by Sprout Invoices < 20.8.16 - Subscriber+ Private Note Overwrite via si_edit_private_note

Zonify < 1.0.5 - Unauthenticated Account Login Token Disclosure

YayPricing < 3.5.7 - Subscriber+ Stored XSS via save_page_data REST Route

Rox Appointment Booking < 1.2.0 - Unauthenticated Holiday Schedule Modification via REST API

Rox Appointment Booking < 1.2.0 - Unauthenticated Price Manipulation and Payment Method Restriction Bypass

Rox Appointment Booking 1.0.9 - 1.2.2 - Unauthenticated Customer PII Disclosure via IDOR

WPBot 8.4.9 - 8.5.9 - Unauthenticated Chat Visitor PII Disclosure

WPBot < 8.5.7 - Unauthenticated AI Provider API Abuse via Multiple AJAX Actions

Product XML Feed Manager for WooCommerce < 3.1.1 - Contributor+ Arbitrary Product Deletion via Shortcode

Nexi XPay Build 7.6.1 - 7.6.2 - Unauthenticated Saved Payment Token Disclosure via IDOR