WPScan

GiveWP < 4.16.9 - Unauthenticated Arbitrary Shortcode Execution via Donor Name

RestroPress < 3.4.6 - Unauthenticated Price Manipulation via Cart Add-ons

WooCommerce Online Product Designer 1.7.0 - < 2.15.0 - Unauthenticated Arbitrary File Upload

Import and export users and customers < 2.5.2 - Custom Role Privilege Escalation to Administrator via Frontend Importer

Import and export users and customers < 2.5.2 - Custom Role Privilege Escalation to Administrator via caller_can_promote_users

Mailchimp for WooCommerce < 6.1.1 - Unauthenticated Broken Access Control in REST API

Rede Itaú for WooCommerce < 5.4.7 - Unauthenticated Order Status Manipulation via PIX Webhook

Hydra Booking < 1.2.4 - Hydra Host+ Cross-Host Account Modification and Deletion via IDOR

Meow Gallery < 5.5.5 - Author+ Draft and Private Post Disclosure via fetch_posts

Meow Gallery < 5.5.5 - Unauthenticated Arbitrary Shortcode Execution via load_gallery_collection REST Route