WPScan

myCred < 2.4.4 - Subscriber+ Import/Export to Email Address Disclosure

Sitemap by click5 < 1.0.36 - Unauthenticated Arbitrary Options Update

Member Hero <= 1.0.9 - Unauthenticated RCE

Church Admin < 3.4.135 - Unauthenticated Plugin's Backup Disclosure

Download Manager < 3.2.39 - Unauthenticated brute force of files master key

Amelia < 1.0.48 - Customer+ SMS Service Abuse and Sensitive Data Disclosure

ThirstyAffiliates < 3.10.5 - Subscriber+ unauthorized image upload + CSRF

Material Design for Contact Form 7 <= 2.6.4 - Subscriber+ Arbitrary Settings Update leading to DoS

Menu Image, Icons made easy < 3.0.8 - Subscriber+ Stored Cross-Site Scripting

LearnPress < 4.1.5 - Arbitrary Image Renaming