WPScan

GeoDirectory < 2.8.120 - Contributor+ Stored XSS

WordPress Qwizcards <= 3.9.4 - Reflected XSS

Ace User Management <= 2.0.3 - Subscriber+ Authentication Bypass via Password Rest

PPWP < 1.9.11 - Subscriber+ Access Bypass via REST API

SureForms < 1.7.2 - Reflected XSS

Sharable Password Protected Posts < 1.1.1 - Unauthenticated Password Protect Post Access

Easy Contact Form Lite < 1.1.29 - Contributor+ Stored XSS

BuddyPress Docs < 2.2.5 - Subscriber+ Arbitrary Document Read/Update

Password Reset with Code < 0.0.17 - Insecure Password Reset Code Creation

Ivory Search < 5.5.10 - Admin+ Stored XSS