WPScan

Synchrony Financing 1.0.5 - 1.1.1 - Unauthenticated Order Takeover via admin_order_callback REST Route

Modern Events Calendar (Lite & Pro) < 7.37.0 - Subscriber+ SQLi via mec_attendees AJAX Action

Payment Gateway for Idram < 2.1.6 - Unauthenticated Payment Confirmation Forgery via Empty-Default Merchant Secret

LatePoint < 5.7.5 - Agent+ Customer PII Disclosure via IDOR

Falang multilanguage for WordPress < 1.4.6 - Subscriber+ Stored XSS via Term Translation

Ettrick Escape Room Booking < 1.3.1 - Unauthenticated Payment Confirmation Bypass

Booking Package < 1.7.31 - Unauthenticated Booking PII Disclosure and Cancellation via Predictable Token

Booking Package < 1.7.31 - Unauthenticated Subscription Deactivation via Missing Authorization

Booking Package < 1.7.31 - Unauthenticated Calendar Account Information Disclosure

Moloni < 5.0.14 - Subscriber+ Arbitrary Order Invoice Generation via genInvoice