WPScan

WP Remote Users Sync < 2.2.0 - Unauthenticated Sensitive Data Disclosure via Public User Export File

Duplicator < 5.1.0 - Reflected XSS via 'logname' Parameter

Duplicator 5.0.0 - 5.0.6 - Unauthenticated Full Path Disclosure via Installer Entry Points

Enable Media Replace < 4.2.3 - Author+ Stored XSS via SVG Upload

WPvivid Backup & Migration < 0.9.137 - Admin+ Arbitrary Database Table Deletion via Snapshot ID

WPvivid Backup & Migration < 0.9.137 - Admin+ Path Traversal via Staging Site Path

WPvivid Backup & Migration 0.9.117 - 0.9.136 - Admin+ Arbitrary File Upload via wpvivid_upload_import_files

Text Typing < 2.2.2 - Contributor+ Stored XSS

WP Roster < 2.36 - Unauthenticated Roster Data Modification

Duplicator < 5.1.0 - Subscriber+ SQLi via Charset and Collation Rewriter During Restore