WPScan

Salon Booking System 10.17 - 10.31.10 - Salon Staff+ Privilege Escalation to Administrator via Case-Insensitive User Meta Key

Salon Booking System < 10.31.11 - Salon Staff+ Administrator Role Demotion via Customer Editor

Salon Booking System < 10.31.11 - Salon Staff+ Stored XSS and SSRF via Salon REST 'image_url'

Salon Booking System < 10.31.11 - Subscriber+ Coupon Code Disclosure via Discounts REST Route

Modern Events Calendar Lite < 7.37.0 - Subscriber+ Sensitive Data Disclosure via mec_event_bookings and mec_attendees AJAX Actions

Modern Events Calendar Lite < 7.36.4 - Subscriber+ Arbitrary Post Modification via IDOR

AI Engine < 3.7.9 - Editor+ Arbitrary Post Deletion via reject_media

WP Photo Album Plus < 9.2.11.002 - Reflected XSS via 'wppa-cat' Parameter

AI Engine < 3.7.9 - Editor+ Arbitrary Post Modification via update_media_metadata and approve_media

Modern Events Calendar (Lite & Pro) < 7.37.0 - Subscriber+ SQLi via mec_fes_csv_export