WPScan

Essential Real Estate < 5.3.5 - Unauthenticated Arbitrary Email Sending

Essential Real Estate < 5.3.5 - Unauthenticated Unpublished Listing Image Disclosure

Essential Real Estate < 5.3.5 - Customer+ Arbitrary Paid Package Activation and Forged Paid Invoice via ere_free_package_ajax

Essential Real Estate < 5.3.5 - Customer+ Invoice PII Disclosure via IDOR

EWWW Image Optimizer 8.7.4 - 8.9.0 - Author+ Stored XSS via 'data-script' Lazy Load Attribute

MCB Stats <= 1.0.0 - Unauthenticated Stored XSS via User-Agent

Mail Mage <= 0.0.25 - Unauthenticated SQLi via 'ewp_unsubscribe' Parameter

Advanced Custom Fields (ACF®) < 6.8.11 - Unauthenticated Stored XSS via HTML Attribute Name Injection

Wurdey <= 1.0.0 - Unauthenticated Administrator Authentication Bypass

Real Estate Website Builder <= 1.4.3 - Unauthenticated Account Takeover via User Email Update