WPScan

FAQ Builder AYS 1.6.3 - 1.8.4 - Unauthenticated Stored XSS via ays_get_user_information

Theme My Login 7.0 - 7.1.15 - Subscriber+ Unauthorised Multisite Site Creation and Privilege Escalation

Brave Popup Builder < 0.8.8 - Unauthenticated Arbitrary Shortcode Execution via UTM Parameter

Simple Membership MailChimp Integration < 1.9.8 - API Key Update via CSRF

JetStyleManager < 1.3.9 - Skin Deletion and Modification via CSRF

WC Vendors < 2.7.2.1 - Vendor+ Cross-Vendor Product and Arbitrary Post Modification via IDOR

WC Vendors < 2.7.2.1 - Vendor+ Cross-Vendor Order Shipment Status Change

WC Vendors < 2.7.2.1 - Order Shipment Status Change via CSRF

MasterStudy LMS < 3.7.46 - Unauthenticated Student Statistics Disclosure via student/stats REST Route

MasterStudy LMS < 3.7.46 - Instructor+ Cross-Course Curriculum Deletion and Tampering via IDOR