WPScan

Integrate PhonePe with WooCommerce <= 1.2.1 - Unauthenticated Payment Bypass via Transaction ID Reuse

EmbedPress < 4.6.1 - Unauthenticated Blind SSRF

CoCart < 4.9.0 - Unauthenticated Arbitrary Price Manipulation

Noptin < 4.3.3 - Unauthenticated Subscriber PII and confirm_key Disclosure via Actions Page

Stripe Payment Forms by WP Full Pay < 8.5.1 - Cross-Customer Subscription Modification via IDOR

Stripe Payment Forms by WP Full Pay < 8.5.1 - Unauthenticated Customer Portal Subscription and Billing Data Disclosure via Unconfirmed Session

Directorist 8.5 - 8.9.2 - Subscriber+ Arbitrary Image Move via REST v2 Listing Submission

Kirki < 6.0.14 - Unauthenticated User and Comment Author Email Disclosure via kirki_get_apis

Woo Refund And Exchange Lite < 4.6.4 - Unauthenticated Guest Order Message Disclosure and Manipulation

Eventin < 4.1.19 - Unauthenticated Order Completion Without Payment via order_token