WPScan

IVPAY payments <= 1.0.8 - Unauthenticated SQLi via 'payment_id' Parameter

Easy Social Icons < 4.0.3 - Author+ Stored XSS via SVG Upload

Car Dealer <= 4.73 - Unauthenticated Private/Draft/Pending Post Content Disclosure via cardealer_single_car_ajax

Dokan < 5.3.3 - Unauthenticated Order PII Disclosure and Note Manipulation via Orders REST Endpoint

Dokan < 5.3.3 - Unauthenticated Email Sender Spoofing via Store Contact Form

Dokan < 5.3.3 - Admin+ Cross-Site Vendor Activation

CatFolders < 2.5.7 - Author+ SQLi via 'sortFile' Setting

CatFolders < 2.5.7 - Subscriber+ Folder Ownership Reset and User Restriction Disable via catf_run_merge

WP PageNavi Style <= 1.4 - Stored XSS via CSRF

WP Event Manager < 3.4.2 - Subscriber+ Arbitrary Post Takeover via event_organizer_ids