WPScan

Events Made Easy < 3.1.4 - Unauthenticated Person Data Modification via IDOR

Paid Member Subscriptions < 3.0.7 - Subscriber+ Payment Data Disclosure via IDOR

Paid Member Subscriptions < 3.0.7 - Unauthenticated Sensitive Information Exposure via Residual Export Files

FluentCart < 1.5.3 - Unauthenticated Order PII Disclosure via Print Routes

JS Help Desk < 3.1.4 - Subscriber+ Ticket Reply Modification via IDOR

Remote API <= 0.2 - Unauthenticated PHP Object Injection via remote-api Query Parameter

Bit Form < 3.1.2 - Unauthenticated Inactive Form Submission

WP Hotel Booking < 2.3.2 - Hotel Manager+ SQL Injection via Booking List Search

Hotel Booking Lite < 6.0.4 - Subscriber+ Sensitive Data Disclosure via Admin Calendar AJAX Action

Hide My WP Ghost < 7.0.05 - IP Address Spoofing via Trusted Proxy Headers Leading to Protection Mechanism Bypass