WPScan

CoolClock < 4.3.8 - Contributor+ Stored XSS via Skin Class Attribute

CoolClock < 4.3.8 - Contributor+ Stored XSS via Custom Skin JSON

YITH WooCommerce Wishlist < 4.18.1 - Unauthenticated Arbitrary Wishlist Rename via change_wishlist_title

WC PayPay Gateway 0.5 - 0.9.3 - Unauthenticated Payment Bypass via Unverified Webhook

Nexi XPay Build 7.6.1 - 7.6.2 - Unauthenticated Saved Payment Token Disclosure via IDOR

MultiVendorX 5.0.0 - 5.0.15 - Store Owner+ Privilege Escalation to Administrator

Advanced Customized Prompts <= 1.0.1 - Subscriber+ WooCommerce Order Item Metadata Tampering

Advanced Customized Prompts <= 1.0.1 - Subscriber+ Stored XSS via Product Popup Configuration

Advanced Customized Prompts <= 1.0.1 - Unauthenticated Account Takeover

Teddy Bear Customize Addon <= 1.0.5 - Unauthenticated Order Data Disclosure