WPScan

SM Page Duplicator <= 1.0.0 - Editor+ SQL Injection via Page Duplication

Blog Floating Button <= 1.4.20 - Unauthenticated Stored XSS via User-Agent Header

SVG Support < 2.5.17 - Author+ Stored XSS via .svgz Sanitization Bypass

Import and export users and customers < 2.4.2 - Custom Role Privilege Escalation to Administrator via CSV Import

Link Library < 7.9.3 - Unauthenticated SQL Injection via the Front-End Link Submission Form

Simply Schedule Appointments < 1.6.12.11 - Contributor+ Sensitive Data Disclosure via Admin Shortcode

Academy LMS < 3.8.3 - Subscriber+ Arbitrary Lesson Content Disclosure via lessons REST Endpoint

ProfileGrid < 6.0.0.0 - Subscriber+ Group Join Request Disclosure via pm_get_all_requests_from_group

Clearfy < 2.4.3 - Admin+ PHP Object Injection via Settings Import

Chama < 1.0.13 - Unauthenticated Arbitrary User Password Reset