WPScan

Rox Appointment Booking < 1.2.0 - Unauthenticated Price Manipulation and Payment Method Restriction Bypass

Rox Appointment Booking < 1.2.0 - Unauthenticated Holiday Schedule Modification via REST API

YayPricing < 3.5.7 - Subscriber+ Stored XSS via save_page_data REST Route

Zonify < 1.0.5 - Unauthenticated Account Login Token Disclosure

Client Invoicing by Sprout Invoices < 20.8.16 - Subscriber+ Private Note Overwrite via si_edit_private_note

Add User Autocomplete < 1.2 - Subscriber+ Privilege Escalation

WP Highlight Box <= 1.0 - Contributor+ Stored XSS via highlight-box Shortcode

User Registration & Membership < 5.2.8 - Unauthenticated User Data Disclosure via Membership Thank You Page

User Registration & Membership < 5.2.8 - Subscriber+ Privilege Escalation via Membership Purchase

WP Component <= 2.2.4 - Unauthenticated Privilege Escalation via Arbitrary Blog Option Update