WPScan

WP Travel Engine < 6.8.5 - Unauthenticated Booking Details Disclosure and Modification via wte_add_trip_to_cart

Charitable < 1.8.12 - Unauthenticated Donation Payment-Status Manipulation via Square Webhook Signature Bypass

Payment Gateway for PayPal on WooCommerce < 9.2.1 - Unauthenticated Payment Bypass via PayPal Advanced Return Handler

Simple File List <= 6.3.11 - Unauthenticated Stored XSS via File Description

Simple File List <= 6.3.11 - Unauthenticated Arbitrary File Read and Move via Path Traversal

FiboSearch < 1.34.1 - Unauthenticated Password-Protected Product Information Disclosure

Product Feed PRO for WooCommerce < 13.5.7 - Unauthenticated Feed Configuration Disclosure

Dokan < 5.0.14 - Vendor+ Reverse Withdrawal Ledger Manipulation via Client-Supplied Amount

Dokan < 5.0.14 - Shop Manager+ Arbitrary Plugin Installation/Activation via REST API

Dokan < 5.0.14 - Unauthenticated Commission Settings Disclosure via Store Categories REST Endpoint