WPScan

Salon Booking System < 10.31.9 - Unauthenticated Booking Creation with Arbitrary Customer ID and Status

Salon Booking System < 10.31.9 - Administrator Account Creation via CSRF

Smush < 4.3.4 - Admin+ Network-Wide Plugin Settings Update on Multisite

OTP Login & Register Woocommerce < 2.7.3 - Unauthenticated Account Takeover via OTP Brute Force

affiliate-toolkit < 3.8.9 - Editor+ SQL Injection via orderby Parameter

Product Delivery Date for WooCommerce – Lite < 3.3.2 - Contributor+ Order Information Disclosure via Calendar View AJAX Actions

MAIO < 7.3.22 - Unauthenticated Crawl Analytics Disclosure via Hardcoded API Key

Squeeze < 1.8.1 - Subscriber+ Missing Authorization via squeeze_restore_attachment

Innovs HR < 1.0.3.7.1 - Employee Creation via CSRF

ECS < 4.3.13 - Contributor+ Arbitrary Post Binding and Global Preset Modification via Dynamic Repeater Handlers