WPScan

Gallery for Google Photos < 1.2.1 - Unauthenticated Google OAuth Token Disclosure

Geo My WP < 4.5.5.3 - Subscriber+ Arbitrary Geolocation Record Modification and Deletion via IDOR

Simple Membership < 4.7.8 - Unauthenticated Administrator Account Takeover via Registration Username Collision

Dokan < 5.0.9 - Vendor+ Arbitrary Order Status Modification via orders/bulk-actions REST Endpoint

Dokan < 5.0.9 - Vendor+ Cross-Vendor Product Attribute Modification via Product Attribute REST API

Simple Membership < 4.7.8 - Unauthenticated Stored XSS via PayPal Subscription Subscriber Name

SM Page Duplicator <= 1.0.0 - Editor+ SQL Injection via Page Duplication

Blog Floating Button <= 1.4.20 - Unauthenticated Stored XSS via User-Agent Header

SVG Support < 2.5.17 - Author+ Stored XSS via .svgz Sanitization Bypass

Import and export users and customers < 2.4.2 - Custom Role Privilege Escalation to Administrator via CSV Import