WPScan

Dynamic Pricing With Discount Rules for WooCommerce < 5.0.0 - Reflected XSS via wdpAjax

Frontend Admin by DynamiApps < 3.29.9 - Unauthenticated Stored Cross-Site Scripting via Form Field

Pixelavo < 1.5.4 - Unauthenticated Facebook CAPI Event Injection via pixelavo_event AJAX

Participants Database < 2.7.8.4 - Unauthenticated SQL Injection via List Search

ElementsKit Lite < 3.10.01 - Subsite Administrator+ Stored XSS via Megamenu Menu-Item Settings (Multisite)

ElementsKit Lite < 3.10.01 - Subsite Administrator+ PHP Code Injection via Custom Widget Builder (Multisite)

WebToffee Cookie Consent < 3.5.3 - Consent Log Disclosure/Deletion, Page Creation & License Deactivation via Unprotected REST Routes

SVG Support < 2.5.17 - Author+ Stored XSS via .svgz Sanitization Bypass

WC Buckaroo BPE Gateway < 4.9.0 - Subscriber+ Unauthorized Order Refund

Everest Toolkit <= 1.2.3 - Admin+ Arbitrary File Upload