WPScan

Post Carousel 4.0.0 - 4.0.7 - Contributor+ Private and Protected Post Content Disclosure via saved-templates-duplicate IDOR

SEO Flow by LupsOnline 3.0.0 - 3.0.2 - Unauthenticated Privilege Escalation via API Key Authentication

My Private Site < 4.2.3 - Unauthenticated Sensitive Information Exposure via RSS Feeds and Sitemap

IPGP Visitors Origin < 1.6 - Reflected XSS

Accept Stripe Payments < 2.1.4 - Open Redirect via IPN Handler

Accept Stripe Payments < 2.1.4 - Unauthenticated Product Substitution via IDOR

Music Store – WordPress eCommerce < 1.4.5 - Unauthenticated SQLi via paypal-data Handler

Masteriyo LMS 1.18.0 - 2.3.3 - Instructor+ Stored XSS via Course Custom Fields

Greenshift < 13.2.0 - Contributor+ SSRF via get-csv-to-json REST Endpoint

Greenshift < 13.2.0 - Contributor+ Stored XSS via Block Animation customProps Attribute