WPScan

WP Photo Album Plus < 9.2.07.002 - Unauthenticated Arbitrary ZIP File Deletion via delmyzip Path Traversal

Events Manager < 7.4.1 - Unauthenticated Privilege Escalation to Administrator

WooCommerce Subscriptions < 9.1.0 - Unauthenticated RCE via PHP Object Injection

Gift Cards For WooCommerce Pro < 4.2.10 - Unauthenticated Arbitrary File Upload

Import WP < 2.14.23 - Unauthenticated Sensitive Information Exposure via Export File Download

WP Crowdfunding < 2.2.1 - Subscriber+ Campaign Creation via Missing Authorization

WP Crowdfunding < 2.2.1 - Subscriber+ Order Data Disclosure via IDOR

KiviCare < 4.5.2 - Doctor/Receptionist+ SQL Injection via settings/listing REST Endpoint

Eventin < 4.1.20 - Unauthenticated Account Creation via Waiting List Endpoint

Eventin < 4.1.20 - Contributor+ Customer PII Disclosure via REST API