WPScan

Nested Pages < 3.2.15 - Editor+ Stored XSS via Post Title

Visualizer: Tables and Charts Manager < 4.0.6 - Contributor+ Server-Side Request Forgery via JSON Import

Database for Contact Form 7, WPforms, Elementor forms < 1.5.5 - Authenticated SQL Injection via id Parameter

Quiz And Survey Master < 11.2.2 - Contributor+ Stored XSS via Polar Question

Paid Member Subscriptions < 3.0.8 - Subscriber+ Cross-User Subscription Hijack via process_checkout

Create Block Theme < 2.10.0 - Admin+ PHP Code Injection via Pattern Save (Multisite)

Personal QR Message <= 1.0 - Unauthenticated Arbitrary File Upload

Simple Google Calendar Outlook Events Widget < 3.1.0 - Unauthenticated SSRF via calendar_id

EmbedPress < 4.6.1 - Unauthenticated Blind SSRF

MonsterInsights < 11.1.0 - Unauthenticated Measurement Protocol Secret Update via Empty-Key HMAC Bypass