WPScan

BackupSheep <= 1.8 - Unauthenticated Arbitrary File Deletion and Backup Exfiltration via Empty Integration Key

Cache Enabler < 1.8.17 - Unauthenticated Arbitrary File and Directory Deletion via cache_enabler_clear_page_cache_by_url

Paytm Payment Gateway < 2.8.9 - Unauthenticated Stored XSS via Payment Callback

Paytm Payment Gateway < 2.8.9 - Unauthenticated SQLi via Payment Callback

Download Manager < 3.3.71 - Author+ Stored XSS via Package Icon

If-So Dynamic Content 1.8 - 1.10.1 - Reflected XSS via render_ifso_shortcodes

If-So Dynamic Content 1.9.9 - 1.10.1 - Editor+ Stored XSS via Conversion Name

Pro Like Button < 2.0 - Unauthenticated SQLi via 'postid' Parameter

WP Fusion Lite < 3.48.0 - Subscriber+ User Email Disclosure and Cross-User CRM Data Deletion

WP Fusion Lite 3.37.14 - 3.47.14 - Unauthenticated CRM Integration Settings Update