WPScan

WP Photo Album Plus < 9.2.07.002 - Reflected XSS via lbstart

WP Photo Album Plus < 9.2.07.002 - Unauthenticated Option Disclosure via gettogo

Events Manager < 7.4.1 - Subscriber+ Booking Consent Record Tampering via SQL Injection

WP Directory Kit < 1.5.6 - Subscriber+ SQL Injection via section Parameter

Royal Elementor Addons < 1.7.1065 - Contributor+ Stored XSS via Icon Box Widget

Pinpoint Booking System <= 2.9.9.7.1 - Unauthenticated Arbitrary Booking Price Manipulation

Eventin < 4.1.20 - Editor+ Local File Inclusion via speaker_template Setting

WP Directory Kit < 1.5.6 - Unauthenticated SQL Injection via search_location and search_category

Ezoic < 2.23.1 - Unauthenticated Database Export via Content Export REST Routes

WPC Admin Columns < 2.3.4 - Subscriber+ Arbitrary User/Post/Term Meta Disclosure