WPScan

WordPress Download Manager < 3.3.66 - Author+ Stored XSS via Package Title

Direct Payments for WooCommerce < 2.5.3 - Unauthenticated Cross-Customer Order Tampering via digages AJAX Actions

Admin Columns for ACF Fields <= 0.3.2 - Contributor+ Stored XSS via ACF Field Value Column

Bit Form < 3.1.4 - Admin+ Stored XSS via Conversational Form Progress Label

Authora - Easy Login with Mobile Number < 1.7.7 - Unauthenticated Account Takeover via OTP Disclosure

Mapster WP Maps < 1.24.0 - Unauthenticated Private and Draft Post Content Disclosure

Simply Schedule Appointments < 1.6.12.6 - Unauthenticated Appointment Data Disclosure and Mass Deletion via purge Endpoint

Event Booking Manager for WooCommerce < 5.3.7 - Contributor+ Arbitrary Post Modification via mpwem_quick_edit_event

Event Booking Manager for WooCommerce < 5.3.7 - Author+ Stored XSS via Event Timeline Content

Charitable < 1.8.5.3 - Admin+ Stored XSS via Photo Field ALT Text