WPScan

WX Subscribe <= 1.2.1 - Unauthenticated SQLi via 'attach' Parameter

Subscribe to Comments < 2.3.3 - Unauthenticated Subscription Management Key Disclosure via Forged Comment Cookie

Coinsnap Bitcoin Crowdfunding <= 1.2.0 - Unauthenticated Payment Record Forgery via Webhook Secret Disclosure

Document Gallery <= 5.1.1 - Unauthenticated Non-Public Attachment Disclosure via dg_generate_gallery and dg_generate_icons

Mobile Builder <= 1.4.2 - Unauthenticated SQLi via 'delivery_id' Parameter

Visual Form Builder <= 3.1 - Subscriber+ Arbitrary Form Field Reordering via Missing Authorization

Visual Form Builder <= 3.1 - Subscriber+ Sensitive Data Disclosure via Dashboard Widget

MB Custom Post Types & Custom Taxonomies < 2.12.2 - Subscriber+ Missing Authorization via CPT UI Migration

Salon Booking System < 10.31.3 - Subscriber+ Booking PII Disclosure via REST bookings/upcoming

Salon Booking System < 10.31.9 - Unauthenticated Salon REST API Access via Predictable Access-Token