WPScan

CoolClock < 4.3.8 - Contributor+ Stored XSS via Skin Class Attribute

GTranslate < 3.0.10 - Admin+ Stored XSS

Teddy Bear Customize Addon <= 1.0.5 - Unauthenticated Account Takeover

Teddy Bear Customize Addon <= 1.0.5 - Unauthenticated Arbitrary File Upload

Teddy Bear Customize Addon <= 1.0.5 - Unauthenticated Order Data Disclosure

Advanced Customized Prompts <= 1.0.1 - Unauthenticated Account Takeover

Advanced Customized Prompts <= 1.0.1 - Subscriber+ Stored XSS via Product Popup Configuration

Advanced Customized Prompts <= 1.0.1 - Subscriber+ WooCommerce Order Item Metadata Tampering

MultiVendorX 5.0.0 - 5.0.15 - Store Owner+ Privilege Escalation to Administrator

YITH WooCommerce Wishlist < 4.18.1 - Unauthenticated Arbitrary Wishlist Rename via change_wishlist_title