Erwan LR (WPScan)

WP Ultimate Review < 2.4.5 - Unauthenticated Arbitrary Shortcode Execution via Reviewer Email

Click n Chat 1.0.4 - 1.1.2 - Unauthenticated SQLi via 'sort_by'/'sort_order' Parameters

WX Subscribe <= 1.2.1 - Unauthenticated SQLi via 'attach' Parameter

Smush < 4.3.4 - Admin+ Network-Wide Plugin Settings Update on Multisite

click5 CRM add-on to Ninja Forms <= 1.0.1 - Unauthenticated Stored XSS via post_notifications

click5 CRM add-on to WPForms <= 1.0.3 - Unauthenticated Stored XSS via post_notifications

click5 CRM add-on to Gravity Forms <= 1.0.3 - Unauthenticated Stored XSS via post_notifications

click5 CRM add-on to Contact Form 7 <= 1.0.4 - Unauthenticated Stored XSS via post_notifications

Paymendo Bank Transfer <= 1.1 - Subscriber+ SQLi via 'orderBy' Parameter

Ultimate Multisite < 2.17.0 - Unauthenticated Authentication Bypass via 'email_address' Parameter