WPScan

Order Tip for WooCommerce < 1.6.0 - Shop Manager+ Arbitrary File Deletion via delete_exported_csv_file_ajax

Brave Popup Builder < 0.8.6 - Subscriber+ Unpublished Popup Disclosure via Preview

Brave Popup Builder < 0.8.6 - Unauthenticated Reflected XSS via UTM Parameters

Content Mask 1.8.0 - 1.8.5.4 - Contributor Publish Capability Bypass via create_new_content_mask

SmilePass Selfie Login <= 1.0.2 - Unauthenticated Authentication Bypass

Social Login & Sharing buttons with Analytics By SoClever <= 1.2.0 - Unauthenticated Authentication Bypass

WP Social Media Login <= 1.0.6 - Unauthenticated Account Takeover via Twitter Login Flow

Firebase Authentication < 1.7.1 - Unauthenticated Account Takeover via Firebase Email Claim

Slider Hero < 9.1.3 - Unauthenticated Stored XSS via Slider Type Change and Add-Slider Handlers

JSON Options <= 0.0.4 - Unauthenticated Arbitrary Options Update