WPScan

Download Counter Button <= 1.8.6.7 - Unauthenticated Arbitrary File Download

Dreamer Blog <= 1.2 - Subscriber+ Arbitrary Plugin Installation

NS Maintenance Mode for WP <= 1.3.1 - Unauthenticated Subscribers Export

NS Maintenance Mode for WP <= 1.3.1 - Admin+ Stored XSS

Find Me On <= 2.0.9.1 - Subscriber+ SQL Injection

Studiocart <= 2.9.0 - Reflected XSS

Order Notification for WooCommerce < 3.6.3 - Unauthenticated WooCommerce REST Permission Bypass

Export All URLs < 5.1 - Unauthenticated Sensitive Data Exposure

Shared Files < 1.7.58 - Contributor+ Arbitrary File Download

Responsive Plus < 3.4.3 - Unauthenticated Arbitrary Shortcode Execution