WPScan

Shared Files < 1.7.70 - Unauthenticated Limited File Upload

RestrictMate < 1.3.0 - Unauthenticated Privilege Escalation to Administrator

BuddyPress < 14.5.0 - Subscriber+ Private Messages Disclosure via IDOR

Simply Schedule Appointments < 1.6.12.6 - Unauthenticated Appointment Data Disclosure and Mass Deletion via purge Endpoint

Frontend File Manager Plugin <= 23.6 - File Metadata Update via CSRF

ProfileGrid < 5.9.9.8 - Subscriber+ Arbitrary Notification Deletion via IDOR

WooCommerce Product Attachment < 2.3.3 - Unauthenticated Arbitrary Media Download

Classified Listing < 5.4.4 - Contributor+ Unpublished Post Content Disclosure via rtcl_block_css_get_posts

Narrative Publisher <= 1.0.7 - Contributor+ Stored XSS via narrative_post_script Post Meta

Huge IT Login <= 1.0.4 - Unauthenticated Account Takeover