WPScan

Jetpack < 13.8 - Unauthenticated Arbitrary Block & Shortcode Execution

ApplyOnline – Application Form Builder and Manager < 2.6.3 - Unauthenticated Application File Access

Happyforms < 1.26.3 - Admin+ Stored XSS

Jetpack < 13.8, Boost < 3.4.8 - Contributor+ Stored XSS

Giveaways and Contests by RafflePress < 1.12.17 - Admin+ Stored XSS

MB Custom Post Types & Custom Taxonomies < 2.7.7 - Admin+ Stored XSS

Photo Gallery, Images, Slider in Rbs Image Gallery < 3.2.22 - Contributor+ Stored XSS

Hubbub Lite < 1.34.4 - Admin+ Stored XSS

Social Slider Feed < 2.2.9 - Admin+ Stored XSS via Widgets

ARForms Builder < 1.7.1 - Unauthenticated Stored XSS