WPScan

Welcart e-Commerce < 2.11.34 - Author+ Stored XSS via Product Name

Form Maker by 10Web < 1.15.45 - Subscriber+ SQL Injection via display_name

WP Photo Album Plus < 9.2.07.002 - Reflected XSS via lbstart

WP Photo Album Plus < 9.2.07.002 - Unauthenticated Option Disclosure via gettogo

Events Manager < 7.4.1 - Subscriber+ Booking Consent Record Tampering via SQL Injection

WP Directory Kit < 1.5.6 - Subscriber+ SQL Injection via section Parameter

Royal Elementor Addons < 1.7.1065 - Contributor+ Stored XSS via Icon Box Widget

Pinpoint Booking System <= 2.9.9.7.1 - Unauthenticated Arbitrary Booking Price Manipulation

Eventin < 4.1.20 - Editor+ Local File Inclusion via speaker_template Setting

WP Directory Kit < 1.5.6 - Unauthenticated SQL Injection via search_location and search_category