WPScan

RegistrationMagic < 6.0.9.4 - Unauthenticated Form Submission Disclosure via IDOR

miniOrange Social Login and Register < 7.8.0 - Unauthenticated Account Takeover

WOLF - WordPress Posts Bulk Editor and Manager < 1.1.0 - Stored XSS via CSRF

Search Atlas SEO < 2.6.12 - Subscriber+ Google Indexing API Access

LatePoint < 5.6.8 - Unauthenticated Booking Object Mass Assignment via Public Booking Funnel

Customer Switching for WooCommerce < 2.1.3 - Customer+ Privilege Escalation to Administrator via Insecure Operator Resolution

Sync Post With Other Site < 1.9.3 - Contributor+ Arbitrary Page Creation/Modification

WP Real IP-based Access Control <= 1.3.1 - Unauthenticated Stored XSS via acl_ctrl_addr

Tutor LMS < 4.0.0 - Subscriber+ Cross-Course Q&A Content Disclosure and Reply Injection

WP Delicious < 1.10.2 - Unauthenticated Arbitrary Post Meta Update via recipe_likes