WPScan

MultiVendorX < 5.0.11 - Store Owner+ Cross-Store Commission Data Disclosure via commissions REST Endpoint

User Registration & Membership < 5.2.6 - Unauthenticated Account Creation While Registration Disabled

Stripe Payment Forms by WP Full Pay < 8.5.2 - Unauthenticated Payment Intent Amount Manipulation

Create Block Theme < 2.10.0 - Admin+ PHP Code Injection via Pattern Save (Multisite)

WPC Name Your Price for WooCommerce < 2.2.5 - Unauthenticated Price Manipulation via Select Mode

miniOrange 2FA < 6.2.8 - 2FA Bypass via Unlimited Second-Factor Attempts

ImproveSEO <= 2.0.11 - Unauthenticated Arbitrary File Upload Leading to Remote Code Execution

GDPR Cookie Compliance < 5.1.0 - Cookie Deletion and Forced Logout via CSRF

Download Monitor < 5.2.6 - Unauthenticated Download Log Injection

MultiVendorX < 5.0.11 - Store Owner+ Cross-Vendor Store Takeover and Deletion via Missing Authorization