The post-pay-counter plugin before 2.731 for WordPress has PHP Object Injection.

The time-sheets plugin before 1.5.2 for WordPress has multiple XSS issues.

The time-sheets plugin before 1.5.0 for WordPress has XSS via the old timesheet list.

The shortcodes-ultimate plugin before 5.0.1 for WordPress has remote code execution via a filter in a meta, post, or user shortcode.

The corner-ad plugin before 1.0.8 for WordPress has XSS.

The crafty-social-buttons plugin before 1.5.8 for WordPress has XSS.

The event-notifier plugin before 1.2.1 for WordPress has XSS via the loading animation.

The newstatpress plugin before 1.2.5 for WordPress has multiple stored XSS issues.

The ninja-forms plugin before 3.0.31 for WordPress has insufficient HTML escaping in the builder.

The simple-login-log plugin before 1.1.2 for WordPress has SQL injection.

The gnucommerce plugin before 1.4.2 for WordPress has XSS.

The search-everything plugin before 8.1.7 for WordPress has SQL injection related to WordPress 4.7.x, a different vulnerability than CVE-2014-2316.

The cforms2 plugin before 14.13 for WordPress has SQL injection in the tracking DB GUI via Delete Entries or Download Entries.

The my-wp-translate plugin before 1.0.4 for WordPress has CSRF.

The my-wp-translate plugin before 1.0.4 for WordPress has XSS.

The wp-all-import plugin before 3.4.6 for WordPress has XSS.

The user-role plugin before 1.5.6 for WordPress has multiple XSS issues.

The updater plugin before 1.35 for WordPress has multiple XSS issues.

The sender plugin before 1.2.1 for WordPress has multiple XSS issues.

The rsvp plugin before 2.3.8 for WordPress has persistent XSS via the note field on the attendee-list screen.