WPScan

Filter Gallery < 1.1.5 - Subscriber+ Arbitrary Post Overwrite and Plugin Option Deletion via Fail-Open Nonce Check

Clean Login < 1.19 - Unauthenticated CAPTCHA Bypass via Empty Session Comparison

Clean Login < 1.19 - Unauthenticated Account Creation with Registration Disabled

Autopay < 5.0.1 - Unauthenticated Cross-Customer Order Payment Parameter Disclosure and Deletion

Paid Member Subscriptions < 3.0.9 - Unauthenticated Membership Payment Bypass via PayPal Standard Amount and Currency Mismatch

Bookit < 2.6.0.5 - Bookit Staff+ Appointment PII Disclosure

Bookit < 2.6.0.5 - Bookit Staff+ Arbitrary Appointment Deletion via Missing Authorization

All Bootstrap Blocks 1.3.20 - 1.3.31 - Contributor+ LFI via lightspeed Block Attributes

All Bootstrap Blocks <= 1.3.31 - Contributor+ Stored XSS via areoi/button type Attribute

PuppyFW <= 0.4.4 - Subscriber+ Arbitrary Blog Options Update and Deletion Leading to Privilege Escalation