WPScan

GeoDirectory < 2.8.194 - Unauthenticated Non-Public Listing Disclosure via Recently Viewed Listings AJAX Action

GeoDirectory < 2.8.194 - Contributor+ Stored XSS via gd_map Shortcode width Attribute

GeoDirectory < 2.8.194 - Admin+ RCE via DB Text Export

GeoDirectory < 2.8.194 - Unauthenticated Guest-Submitted Listing Modification

WP VR 8.5.49 - 9.0.2 - Contributor+ Stored XSS via Hotspot Content

Otter Blocks < 3.2.8 - Unauthenticated Restricted Block Content Disclosure via REST API

Profile Builder 4.0.0 - 4.0.4 - Subscriber+ Comment reCAPTCHA Bypass

Advanced Custom Fields: Extended 0.9.2.4 - 0.9.2.7 - Unauthenticated Arbitrary Shortcode Execution via Form Success Message

Otter Blocks < 3.2.8 - Contributor+ Stored XSS via Block Style Attributes

Otter Blocks 3.1.1 - 3.2.7 - Unauthenticated Non-Public Content Disclosure via REST API