WPScan

Bit Form < 3.1.4 - Admin+ Stored XSS via Conversational Form Progress Label

Authora - Easy Login with Mobile Number < 1.7.7 - Unauthenticated Account Takeover via OTP Disclosure

Mapster WP Maps < 1.24.0 - Unauthenticated Private and Draft Post Content Disclosure

Simply Schedule Appointments < 1.6.12.6 - Unauthenticated Appointment Data Disclosure and Mass Deletion via purge Endpoint

Event Booking Manager for WooCommerce < 5.3.7 - Contributor+ Arbitrary Post Modification via mpwem_quick_edit_event

Event Booking Manager for WooCommerce < 5.3.7 - Author+ Stored XSS via Event Timeline Content

Charitable < 1.8.5.3 - Admin+ Stored XSS via Photo Field ALT Text

WebToffee Cookie Consent < 3.5.3 - Consent Log Disclosure/Deletion, Page Creation & License Deactivation via Unprotected REST Routes

WooCommerce Product Attachment < 2.3.3 - Unauthenticated Arbitrary Media Download

Narrative Publisher <= 1.0.7 - Contributor+ Stored XSS via narrative_post_script Post Meta