WPScan

Injection Guard < 1.2.8 - Reflected XSS via $_SERVER['REQUEST_URI']

PPWP < 1.9.11 - Subscriber+ Access Bypass via REST API

Multiple Plugins from itayamar - Supply Chain Compromise

WP Shopify < 1.5.4 - Reflected XSS

Latepoint < 5.1.94 - Unauthenticated LFI

OpenStreetMap for Gutenberg and WPBakery Page Builder <= 1.2.0 - Contributor+ Stored XSS

SureForms < 1.7.2 - Reflected XSS

My Reservation System <= 2.3 - Reflected XSS

WordPress Qwizcards <= 3.9.4 - Reflected XSS

Stop User Enumeration < 1.7.3 - Protection Bypass