WPScan

Simple Membership < 4.7.8 - Unauthenticated Stored XSS via PayPal Subscription Subscriber Name

Simple Membership < 4.7.8 - Unauthenticated Administrator Account Takeover via Registration Username Collision

RT Mega Menu < 1.5.2 - Subscriber+ Stored XSS via Menu Item CSS

Blog Floating Button <= 1.4.20 - Unauthenticated Stored XSS via User-Agent Header

WP Go Maps < 10.1.04 - Unauthenticated SQL Injection via Markers REST filter

Profile Builder < 3.16.4 - Unauthenticated Account Takeover via Auto-Login After Registration

Admin Columns for ACF Fields <= 0.3.2 - Contributor+ Stored XSS via ACF Field Value Column

Geo My WP < 4.5.5.3 - Subscriber+ Arbitrary Geolocation Record Modification and Deletion via IDOR

Product Feed Manager for WooCommerce < 7.6.1 - Contributor+ SQL Injection via Feed Filter

Simply Schedule Appointments < 1.6.12.11 - Contributor+ Sensitive Data Disclosure via Admin Shortcode