OWASP Juice Shop is a great intermediate between "ok I've done Webgoat and some OverTheWire servers" and "let me at the ctfs." It's ctf-style but it's hints give more guardrails. And you get infinite time to play on it. I'm sure you're aware of juice shop but I was surprised it wasn't mentioned here.
Good call. Added Juice Shop!
We're a place where coders share, stay up-to-date and grow their careers.
We strive for transparency and don't collect excess data.