WPScan

User Activity Log <= 2.2 - Unauthenticated Limited Arbitrary Option Update

Pure WC Variation Swatches <= 1.1.7 - Unauthenticated Settings Update

WPBookit <= 1.0.7 - Customer Deletion via CSRF

Bookingor <= 1.0.12 - Subscriber+ Category Deletion

Dreamer Blog <= 1.2 - Subscriber+ Arbitrary Plugin Installation

Studiocart <= 2.9.0 - Reflected XSS

Export All URLs < 5.1 - Unauthenticated Sensitive Data Exposure

Shared Files < 1.7.58 - Contributor+ Arbitrary File Download

Responsive Plus < 3.4.3 - Unauthenticated Arbitrary Shortcode Execution

WP Lightbox 2 < 3.0.7 - Admin+ Stored XSS