WPScan

Motors < 1.4.124 - Listing Manager+ Stored XSS via Badge Color

Motors – Car Dealership & Classified Listings < 1.4.124 - Subscriber+ Cross-User Post Meta Modification via stm_make_featured

BuildKit < 1.0.29 - Contributor+ Stored SQLi via list_content Parameter

Giveaways and Contests by RafflePress < 1.12.27 - Unauthenticated reCAPTCHA Secret Key Disclosure via Giveaway Page

Giveaways and Contests by RafflePress < 1.12.27 - Unauthenticated Stored Open Redirect via 'parent_url' Parameter

CMP - Coming Soon & Maintenance < 4.1.20 - Unauthenticated Maintenance Mode Bypass via Login URL Match

WP Mail Logging < 1.17.0 - Unauthenticated HTML Injection

WP User Frontend < 4.3.12 - Subscriber+ Post Creation via Subscription-Gated Form

The Events Calendar 6.12.0 - 6.17.5 - Unauthenticated Arbitrary Shortcode Execution via 'view_data' Parameter

Popup Maker WP 1.2.2.1 - 1.4.5 - Subscriber+ Zero-Argument PHP Callable Invocation via Missing Authorization