Wordfence and Defiant detail critical flaws in WooCommerce Wholesale Lead Capture and The Events Calendar, both reachable without credentials.
The Avada Builder plugin flaws allow low level users to read server files and unauthenticated attackers to steal database credentials.