WPScan

WP Go Maps < 10.0.10 - Unauthenticated Sensitive Information Disclosure via Marker ID

WP Go Maps < 10.0.10 - Unauthenticated Sensitive Information Disclosure via Datatables AJAX Fallback

Iptanus File Upload < 5.1.7 - File Overwrite via Race Condition

Schema & Structured Data for WP & AMP < 1.60 - Unauthenticated Arbitrary Media Upload

Agile Store Locator < 1.6.6 - Admin+ Stored XSS via map_style

Spam protection, Honeypot, Anti-Spam by CleanTalk < 6.79 - Unauthenticated Stored XSS via Comment Shortcode Bypass

XStore < 9.7.3 - Unauthenticated SQLi

Lazy Blocks < 4.3.0 - Admin+ Stored XSS via Custom Block Frontend HTML

WPForms Lite < 1.10.0.5 – Unauthenticated PayPal Webhook Forgery

Really Simple Security < 9.5.10.1 - Authentication Bypass via Two-Factor OTP Skip