WPScan

WP Stripe Checkout < 1.2.2.62 - Unauthenticated Forged Payment Completion via an Unset Webhook Signing Secret

GiveWP < 4.19.0.1 - Unauthenticated Unpublished Donation Form Disclosure via Form View Route

GiveWP < 4.19.0.1 - Give Manager+ Path Traversal via Core Settings Import

GiveWP < 4.19.0.1 - Give Worker+ Stored XSS via Form Template Primary Color

GiveWP < 4.19.0.1 - Give Worker+ Arbitrary Page Modification via Campaign Page Capability Grant

GiveWP < 4.19.0.1 - Authenticated Arbitrary Donor Address Modification via donor_manage_addresses

WP VR 8.5.55 - 9.1.2 - Contributor+ Arbitrary Tour Creation and Publishing via Setup Wizard

WP VR 9.0.0 - 9.0.2 - Contributor+ Arbitrary Tour Update and Disclosure via IDOR

WP VR 8.3.0 - 9.0.2 - Contributor+ Arbitrary Tour Update via IDOR

InstaWP Connect < 0.1.4.2 - Authenticated Plugin Settings Update via instawp_update_settings