An issue was discovered in the security-framework crate before 0.1.12 for Rust. Hostname verification for certificates does not occur if ClientBuilder uses custom root certificates.

An issue was discovered in the hyper crate before 0.9.18 for Rust. It mishandles newlines in headers.

The insert-pages plugin before 3.2.4 for WordPress has directory traversal via custom template paths.

The posts-in-page plugin before 1.3.0 for WordPress has ic_add_posts template='../ directory traversal.

The post-pay-counter plugin before 2.731 for WordPress has no permissions check for an update-settinga action.

The post-pay-counter plugin before 2.731 for WordPress has PHP Object Injection.

The time-sheets plugin before 1.5.2 for WordPress has multiple XSS issues.

The time-sheets plugin before 1.5.0 for WordPress has XSS via the old timesheet list.

The shortcodes-ultimate plugin before 5.0.1 for WordPress has remote code execution via a filter in a meta, post, or user shortcode.

The corner-ad plugin before 1.0.8 for WordPress has XSS.

The crafty-social-buttons plugin before 1.5.8 for WordPress has XSS.

The event-notifier plugin before 1.2.1 for WordPress has XSS via the loading animation.

The newstatpress plugin before 1.2.5 for WordPress has multiple stored XSS issues.

The ninja-forms plugin before 3.0.31 for WordPress has insufficient HTML escaping in the builder.

The simple-login-log plugin before 1.1.2 for WordPress has SQL injection.

The gnucommerce plugin before 1.4.2 for WordPress has XSS.

The search-everything plugin before 8.1.7 for WordPress has SQL injection related to WordPress 4.7.x, a different vulnerability than CVE-2014-2316.

The cforms2 plugin before 14.13 for WordPress has SQL injection in the tracking DB GUI via Delete Entries or Download Entries.

The my-wp-translate plugin before 1.0.4 for WordPress has CSRF.

The my-wp-translate plugin before 1.0.4 for WordPress has XSS.