Erwan LR (WPScan)

Secure Custom Fields < 6.9.8 - Contributor+ Admin-Restricted Custom Field Update via Post Save Path

Secure Custom Fields < 6.9.8 - Contributor+ Relationship Field Update on Arbitrary Objects via IDOR

Secure Custom Fields < 6.9.8 - Contributor+ Unpublished Post Title and Status Disclosure via Relational Fields

Secure Custom Fields < 6.9.8 - Admin+ Stored XSS via HTML Attribute Name Injection into Field Definition

Mail Mage <= 0.0.25 - Unauthenticated SQLi via 'ewp_unsubscribe' Parameter

Anti-Spam by CleanTalk < 6.91 - Unauthenticated Stored XSS via Comment Author Email

Streamit < 4.5.2 - Unauthenticated Remote Code Execution via Arbitrary Function Call

WP Roster < 2.36 - Unauthenticated Roster Data Modification

GeoDirectory < 2.8.197 - Unauthenticated Password-Protected Listing Content Disclosure

WP Roster < 2.35 - Unauthenticated Roster Member Deletion