WPScan

Appointment Hour Booking < 1.5.88 - Unauthenticated Booking Price Manipulation via tcost Parameter

Classified Listing < 5.4.4 - Contributor+ Store Revenue Total Disclosure via rtcl_revenue_order_search

Newsletters < 4.16 - Unauthenticated API Authentication Bypass via Type Juggling

Newsletters < 4.16 - Unauthenticated Server-Side Request Forgery via SNS Bounce Handler

Newsletters < 4.16 - Unauthenticated PHP Object Injection via Date Form Field

WP Maps < 4.9.7 - Subscriber+ Denial of Service

WP Maps < 4.9.7 - Subscriber+ Local File Inclusion

Estatik < 4.3.3 - Login CSRF

Ajax Search Lite < 4.14.5 - Unauthenticated PHP Object Injection via Search Statistics REST Endpoint

Arvow AI SEO Writer < 1.5.4 - Unauthenticated Arbitrary Post Creation via Webhook Secret Type-Juggling