WPScan

Master Slider <= 3.11.2 - Contributor+ Stored XSS via ms_slider Shortcode Attributes

Nimble Builder <= 3.3.8 - Subscriber+ Non-Public Content Disclosure via sek_get_nimble_content_for_seo_plugins

Business Name Generator <= 1.3 - Admin+ Stored XSS via Button Color Setting

JetFormBuilder 3.5.6.2 - 3.6.5.2 - Admin+ Arbitrary File Deletion via Server-Side Validation Callback

WP Import Export Lite < 3.9.35 - Authenticated Privilege Escalation via User Import

Estatik < 4.3.5 - Reflected XSS via get_listings hash Parameter

Unbounce Landing Pages 1.1.1 - 1.1.4 - Subscriber+ Reverse-Proxy Target Hijack via set_unbounce_domains

Ultimate Member < 2.13.1 - Unauthenticated Stored XSS via Profile Page Title

Botiga Pro < 1.6.5 - Unauthenticated Arbitrary Blog Options Update via Templates Builder REST Route

UsersWP - Social Login < 1.5.10 - Unauthenticated Account Takeover via Unverified Provider Email