WPScan

Password Protected < 2.8.4 - Unauthenticated Sensitive Information Exposure via REST API

Subscribe2 < 10.46 - Reflected XSS via email Parameter

WP Events Manager < 2.2.5 - Subscriber+ Payment Bypass via 'qty' Parameter

Subscriptions for WooCommerce < 2.0.1 - Subscriber+ Subscription Detail Disclosure via IDOR

MStore API < 4.21.0 - Unauthenticated Account Takeover via Firebase Phone Authentication

Templately < 3.7.1 - Unauthenticated Administrator Templately Cloud Connection Overwrite

Payment Gateway for Redsys & WooCommerce Lite < 7.0.2 - Unauthenticated Payment Confirmation via Unverified Inespay Callback

WP Events Manager < 2.2.5 - Unauthenticated Payment Bypass and Booking Status Update via IDOR

Subscriptions for WooCommerce < 2.0.1 - Payment Bypass via Attacker-Supplied PayPal Capture Token

Simple CAPTCHA with Cloudflare Turnstile < 1.42.0 - Unauthenticated Turnstile Protection Bypass via Reusable Forminator Cache Key