WPScan

IDB Ecommerce (wpStoreCart 5) <= 5.0.7 - Unauthenticated PHP Object Injection via bundled wpsc-membership-pro paypal.php

WP Images Upload on Piclect <= 1.0 - Unauthenticated Arbitrary File Upload

WP Component <= 2.2.4 - Unauthenticated Privilege Escalation via Arbitrary Blog Option Update

WP Highlight Box <= 1.0 - Contributor+ Stored XSS via highlight-box Shortcode

Add User Autocomplete < 1.2 - Subscriber+ Privilege Escalation

Client Invoicing by Sprout Invoices < 20.8.16 - Subscriber+ Private Note Overwrite via si_edit_private_note

Zonify < 1.0.5 - Unauthenticated Account Login Token Disclosure

YayPricing < 3.5.7 - Subscriber+ Stored XSS via save_page_data REST Route

Rox Appointment Booking < 1.2.0 - Unauthenticated Holiday Schedule Modification via REST API

Rox Appointment Booking < 1.2.0 - Unauthenticated Price Manipulation and Payment Method Restriction Bypass