WPScan

Simple Membership < 4.7.8 - Unauthenticated Administrator Account Takeover via Registration Username Collision

Dokan < 5.0.9 - Vendor+ Arbitrary Order Status Modification via orders/bulk-actions REST Endpoint

Dokan < 5.0.9 - Vendor+ Cross-Vendor Product Attribute Modification via Product Attribute REST API

Simple Membership < 4.7.8 - Unauthenticated Stored XSS via PayPal Subscription Subscriber Name

SM Page Duplicator <= 1.0.0 - Editor+ SQL Injection via Page Duplication

Blog Floating Button <= 1.4.20 - Unauthenticated Stored XSS via User-Agent Header

SVG Support < 2.5.17 - Author+ Stored XSS via .svgz Sanitization Bypass

Import and export users and customers < 2.4.2 - Custom Role Privilege Escalation to Administrator via CSV Import

Link Library < 7.9.3 - Unauthenticated SQL Injection via the Front-End Link Submission Form

Simply Schedule Appointments < 1.6.12.11 - Contributor+ Sensitive Data Disclosure via Admin Shortcode