WPScan

rtMedia for WordPress, BuddyPress and bbPress < 4.6.16 - Subscriber+ RCE

Royal Elementor Addons and Templates < 1.3.81 - Unauthenticated Arbitrary Post Read

WP Custom Cursors <= 3.2 - Admin+ Stored XSS

File Manager < 6.3 - Admin+ Arbitrary OS File/Folder Access + Path Traversal

Job Manager & Career < 1.4.4 - Directory listing to Sensitive Data Exposure

DeMomentSomTres WordPress Export Posts With Images <= 20220825 - Subscriber+ unauthorized data export

WP All Export (Free < 1.4.1, Pro < 1.8.6) - Author+ PHAR Deserialization via CSRF

Word Balloon < 4.20.3 - Avatar Removal via CSRF

WP All Export (Free < 1.4.1, Pro < 1.8.6) - Remote Code Execution via CSRF

affiliate-toolkit < 3.4.3 - Unauthenticated SSRF