WPScan

Optima Express 8.6.0 - 8.7.5 - Author+ Stored XSS via faq_script

NextScripts: Social Networks Auto-Poster < 4.4.8 - Authenticated Social Account Credential Disclosure and Data Deletion

PowerPress < 11.17.2 - Contributor+ Stored XSS via Podcast Player Block

Bluff Post <= 1.1.1 - Unauthenticated SQLi via 'table_name' and 'column_name' Parameters

WP Directory Kit < 1.5.8 - Listing Admin+ Stored XSS via Category and Location Title and Icon Fields

File Manager 7.2.2 - 8.0.4 - Unauthenticated Database Backup Disclosure

WP Review Slider Pro < 12.7.12 - Subscriber+ Stored XSS via Review Import

WP Review Slider Pro < 12.7.12 - Subscriber+ Stored XSS via Review Form Fields

WP Review Slider Pro < 12.7.12 - Subscriber+ SQLi via Stored Template Filter

Multiple elFinder Plugins - DOM-based XSS via postMessage Origin Bypass