WPScan

Dokan < 5.0.11 - Vendor+ Cross-Vendor Downloadable Product Access Grant via Order Downloads REST Endpoint

YMC Filter < 3.12.9 - Author+ Stored XSS via SVG Icon Upload

Appointment Hour Booking < 1.5.88 - Unauthenticated Booking Price Manipulation via tcost Parameter

Newsletters < 4.16 - Unauthenticated API Authentication Bypass via Type Juggling

Newsletters < 4.16 - Unauthenticated PHP Object Injection via Date Form Field

Advanced Classifieds & Directory Pro < 3.4.3 - Unauthenticated Non-Public Listing Custom Field Disclosure

CheckView < 2.3.2 - Administrator Account Creation via REST API Authentication Bypass

FoodBoxBooker < 1.0.8 - Subscriber+ Arbitrary User Profile Update

s2Member < 260805 - Contributor+ Stored XSS via Shortcode

Autopay / Blue Media for WooCommerce < 5.0.1 - Unauthenticated Stored XSS via CSS Editor