WPScan

CMP - Coming Soon & Maintenance < 4.1.18 - Unauthenticated Maintenance Mode Disable via cmp_disable_comingsoon_ajax

CMP - Coming Soon & Maintenance < 4.1.18 - Editor+ Privilege Escalation via cmp_ajax_import_settings

CMP - Coming Soon & Maintenance < 4.1.18 - Editor+ Stored XSS via niteoCS_socialmedia

Document Embedder < 2.3.1 - Unauthenticated Private Document Download via Token Oracle

ShopApper <= 0.4.62 - Subscriber+ Customer Data Disclosure via IDOR

ShopApper <= 0.4.62 - Subscriber+ Arbitrary Product Stock Update

Smush < 4.3.2 - Admin+ Network-Wide RCE via Hub Connector on Multisite

Defender Security < 6.2.0 - Admin+ Network-Wide RCE via Hub Connector on Multisite

JetBackup 3.1.18.8 - 3.1.23.3 - Admin+ Multisite Network Backup Download

WP OAuth Server < 6.3.1 - Unauthenticated OAuth Token and User Data Disclosure via Debug Log File