WPScan

Advanced Customized Prompts <= 1.0.1 - Subscriber+ Stored XSS via Product Popup Configuration

Advanced Customized Prompts <= 1.0.1 - Unauthenticated Account Takeover

Teddy Bear Customize Addon <= 1.0.5 - Unauthenticated Order Data Disclosure

Teddy Bear Customize Addon <= 1.0.5 - Unauthenticated Arbitrary File Upload

Teddy Bear Customize Addon <= 1.0.5 - Unauthenticated Account Takeover

GTranslate < 3.0.10 - Admin+ Stored XSS

Site Reviews 7.2.2 - 8.2.2 - Unauthenticated PHP Object Injection via Form Signature

Registration Form for WooCommerce 1.1.0 - 1.1.2 - Contributor+ Privilege Escalation via Unvalidated tgwcfb_id

zipMoney(Zip Co) Payments Plugin for WooCommerce < 2.4.0 - Unauthenticated Arbitrary Option Deletion

miniOrange 2FA (Free & Pro) - 2FA Bypass via Session-Scoped OTP Lockout