The error-log-viewer plugin before 1.0.6 for WordPress has multiple XSS issues.

The embed-comment-images plugin before 0.6 for WordPress has XSS.

The content-audit plugin before 1.9.2 for WordPress has XSS.

The cforms2 plugin before 14.13.3 for WordPress has multiple XSS issues.

The bws-testimonials plugin before 0.1.9 for WordPress has multiple XSS issues.

The bws-google-maps plugin before 1.3.6 for WordPress has multiple XSS issues.

The bws-google-analytics plugin before 1.7.1 for WordPress has multiple XSS issues.

The booking-sms plugin before 1.1.0 for WordPress has XSS.

The analytics-tracker plugin before 1.1.1 for WordPress has XSS via a search event.

The ad-buttons plugin before 2.3.2 for WordPress has XSS.

kernel: OOB read and write in net/rds/af_rds.c

An issue was discovered in net/rds/af_rds.c in the Linux kernel before 4.11. There is an out of bounds write and read in the function rds_recv_track_latency.

kernel: out of bounds write in function i2c_smbus_xfer_emulated in drivers/i2c/i2c-core-smbus.c

An issue was discovered in drivers/i2c/i2c-core-smbus.c in the Linux kernel before 4.14.15. There is an out of bounds write in the function i2c_smbus_xfer_emulated.

kernel: information exposure in drivers/scsi/aacraid/commctrl.c

An issue was discovered in drivers/scsi/aacraid/commctrl.c in the Linux kernel before 4.13. There is potential exposure of kernel stack memory because aac_get_hba_info does not initialize the hbainfo structure.

kernel: information exposure in drivers/scsi/aacraid/commctrl.c

An issue was discovered in drivers/scsi/aacraid/commctrl.c in the Linux kernel before 4.13. There is potential exposure of kernel stack memory because aac_send_raw_srb does not initialize the reply structure.

The note-press plugin before 0.1.2 for WordPress has SQL injection.

The nelio-ab-testing plugin before 4.6.4 for WordPress has CSRF in experiment forms.

The jayj-quicktag plugin before 1.3.2 for WordPress has CSRF.

The invite-anyone plugin before 1.3.16 for WordPress has incorrect escaping of untrusted Dashboard and front-end input.

The invite-anyone plugin before 1.3.16 for WordPress has admin-panel CSRF.

The invite-anyone plugin before 1.3.16 for WordPress has incorrect access control for email-based invitations.