WPScan

WP All Export (Free < 1.4.1, Pro < 1.8.6) - Author+ PHAR Deserialization via CSRF

Word Balloon < 4.20.3 - Avatar Removal via CSRF

WP All Export (Free < 1.4.1, Pro < 1.8.6) - Remote Code Execution via CSRF

affiliate-toolkit < 3.4.3 - Unauthenticated SSRF

Popup box < 3.8.6 - Admin+ Stored XSS in Popup Settings

Simple Social Buttons < 5.1.1 - Unauthenticated Password Protected Post Access

Popup box < 3.8.6 - Admin+ Stored XSS in Categories

WP Hotel Booking < 2.0.9 - Contributor+ Arbitrary Post Deletion

Assistant < 1.4.4 - Editor+ SSRF

Filr – Secure document library < 1.2.3.6 - Author+ RCE via file upload with phar ext