WPScan

Deema Payment Gateway <= 1.1.2 - Unauthenticated Payment Confirmation Forgery via Unverified Success Return

elegro Crypto Payment <= 1.0.1 - Unauthenticated Arbitrary Order Status Change via IPN Callback

Fast Courier <= 5.2.3 - Unauthenticated Order Fulfillment Update via order-status-update REST Endpoint

File Media Renamer <= 1.3 - Author+ Arbitrary File Rename via save-attachment-compat

Slider Pro <= 1.0.0 - Unauthenticated Sensitive Data Disclosure via sliderpro_multiple_images

Horizontal Scrolling Announcements <= 2.6 - Contributor+ Stored XSS via Style Field

Razorpay for WooCommerce < 4.8.8 - Unauthenticated Order Shipping Modification via IDOR

Simple Shopping Cart < 5.2.6 - Admin+ Stored XSS via PayPal API Credentials

Five Star Business Profile and Schema 2.3.20 - 2.3.21 - Author+ Sensitive Data Disclosure via Schema Field Default Callback

CoCart 4.9.0 - 4.9.6 - Administrator Account Creation via REST API Authentication Bypass