WPScan

Post Duplicator < 3.0.18 - Admin+ Privilege Escalation via Unvalidated Capability Assignment

WP BASE Booking of Appointments, Services and Events 6.5.0 - Subscriber+ Privilege Escalation

UniPAY Payment Gateway For WooCommerce < 2.4 - Unauthenticated Order Key and Customer PII Disclosure

Vigilant < 2.11.0 - 2FA Bypass via Third-Party Login Forms

GemBooking < 1.7.1 - Unauthenticated Team Member Double-Booking via Cross-Object Race Condition

Event Tickets Manager for WooCommerce 1.5.4 - 1.5.9 - Unauthenticated Site-wide Event Ticket Price Manipulation

GemBooking < 1.7.1 - Staff+ Arbitrary Post Deletion and Site Settings Update via REST Context Check Bypass

WooCommerce Stripe Payment Gateway 10.9.0 - 11.0.1 - Customer Password Stored in Plaintext via Express Checkout

WP Duplicate <= 1.1.11 - Unauthenticated Arbitrary File Upload via Authentication Bypass

Advanced Appointment Booking & Scheduling < 2.7 - Unauthenticated Arbitrary User Registration