WPScan

WP Not Login Hide <= 1.0 - Admin+ Stored XSS

POST SMTP Mailer < 2.7.1 - Unauthenticated Cross-site Scripting

Funnelforms Free < 3.4.2 - Form Deletion/Duplication via CSRF

eCommerce Product Catalog Plugin for WordPress < 3.3.26 - Products Deletion via CSRF

rtMedia for WordPress, BuddyPress and bbPress < 4.6.16 - Admin+ RCE

rtMedia for WordPress, BuddyPress and bbPress < 4.6.16 - Subscriber+ RCE

Welcart e-Commerce < 2.9.5 - Unauthenticated PHP Object Injection

Job Manager & Career < 1.4.4 - Directory listing to Sensitive Data Exposure

WP All Export (Free < 1.4.1, Pro < 1.8.6) - Author+ PHAR Deserialization via CSRF

Popup box < 3.8.6 - Admin+ Stored XSS in Categories