WPScan

Base64 Encoder/Decoder <= 0.9.2 - Settings Reset via CSRF

Base64 Encoder/Decoder <= 0.9.2 - Reflected XSS

FluentCart < 1.4.0 - Subscriber+ Subscription Payment-Method Tampering via IDOR

Tablesome < 1.1.31 - Unauthenticated Post Creation and Modification

Database for Contact Form 7, WPforms, Elementor forms < 1.5.3 - Reflected XSS via form_id

Quiz And Survey Master < 11.1.5 - Contributor+ Arbitrary Template Deletion

Event Tickets < 5.28.4 - Editor+ Stored XSS via Ticket Move

TrueBooker Appointment Booking < 1.2.4 - Unauthenticated Account Takeover via Password Reset

BookingPress Pro < 5.7.3 - Unauthenticated Customer PII Disclosure and Booking Tampering via Permission Callback Bug

Calendar < 1.3.18 - Contributor+ Stored XSS via event_link Parameter