WPScan

Orbit Fox by ThemeIsle < 3.0.8 - Author+ Stored XSS via SVG Upload

Admin Safety Guard < 1.4.0 - Unauthenticated User Data Disclosure via 2fa/app/users REST Route

Dokan < 5.0.11 - Vendor+ Cross-Vendor Downloadable Product Access Grant via Order Downloads REST Endpoint

Bit Form < 3.2.0 - Unauthenticated Stored XSS via SVG Signature Upload

LogMyTrip <= 1.9 - Unauthenticated SQL Injection via 'tid' Cookie

Dokan < 5.0.9 - Vendor+ Cross-Vendor Product Attribute Modification via Product Attribute REST API

Dokan < 5.0.9 - Vendor+ Arbitrary Order Status Modification via orders/bulk-actions REST Endpoint

Academy LMS < 3.8.3 - Subscriber+ Arbitrary Lesson Content Disclosure via lessons REST Endpoint

WP Statistics < 14.16.10 - Subscriber+ Sensitive Data Disclosure via Metabox AJAX Handlers

Sunshine Photo Cart < 3.6.12 - Unauthenticated Private Gallery Comment Disclosure