WPScan

GS JWT Authentication <= 1.0.0 - Unauthenticated Privilege Escalation via SQLi

GutenKit 2.5.0 - 2.5.4 - Author+ Stored XSS via Page Settings Custom CSS

WHIZZ <= 1.1.8 - Unauthenticated Arbitrary User Password Reset

Anti-Spam by CleanTalk < 6.91 - Unauthenticated Stored XSS via Comment Author Email

Static Snapshot <= 0.2.1 - Unauthenticated RCE via 'name' Parameter

Ever Accounting < 2.3.3 - Accounting Manager+ Arbitrary File Deletion via CSV Import

MC4WP: Mailchimp for WordPress < 4.15.0 - Unauthenticated Subscription Audience Override

PublishPress Revisions 3.6.0 - 4.2.0 - Contributor+ Unapproved Content Publishing via Revision Workflow

PublishPress Revisions < 4.3.1 - Contributor+ Unpublished Content Disclosure via IDOR

PublishPress Revisions 3.9.0 - 4.2.0 - Subscriber+ Unpublished Content Disclosure