WPScan

FluentBoards < 1.95.3 - Subscriber+ Cross-Board Task Disclosure via IDOR

JS Help Desk < 3.1.4 - Contributor+ User Email Disclosure

JS Help Desk < 3.1.4 - Unauthenticated Arbitrary Ticket File Attachment Upload

JS Help Desk < 3.1.4 - Subscriber+ Ticket Reply Modification via IDOR

JS Help Desk < 3.1.4 - Subscriber+ Sensitive Information Disclosure via checkAIReplyTicketsBySubject

FluentCart < 1.5.3 - Unauthenticated Order PII Disclosure via Print Routes

WP Photo Album Plus < 9.2.04.003 - Subscriber+ Stored XSS via Photo Comment

Ultimate Addons for WPBakery Page Builder < 3.21.5 - Contributor+ Stored XSS via ult_buttons Shortcode

AcyMailing < 10.11.1 - Unauthenticated SQL Injection via subscription[] Parameter

ShopMonitor.io < 1.2.0 - Unauthenticated Administrator Account Takeover via Password-Reset Email Reroute