WPScan

Advanced Custom Fields: Extended < 0.9.2.7 - Unauthenticated Administrator Account Takeover via Front-End User Update Action

Photo Gallery by 10Web < 1.8.44 - Reflected XSS via title and paged Parameters

Amelia < 2.4.9 - Unauthenticated Post-Booking Action Trigger

Appointment Booking Lite < 2.4.8 - Unauthenticated Arbitrary Reservation Deletion

Solace Extra < 1.7.0 - Unauthenticated Draft/Private Site Builder Content Disclosure via get_elementor_content

Gutentor < 4.0.6 - Subscriber+ Password Protected Post Password Disclosure via REST API

WP User Frontend < 4.3.11 - Subscriber+ PHP Object Injection via Frontend Post Edit Form

Ultimate Member < 2.13.0 - Unauthenticated Unapproved Comment Disclosure via Profile Activity

JetBackup 3.1.7.9 - 3.1.23.3 - Subscriber+ Privilege Escalation via Restore Admin User Selection

Comments – wpDiscuz < 7.6.66 - Unauthenticated Comment Disclosure via SQLi