The nelio-ab-testing plugin before 4.6.4 for WordPress has CSRF in experiment forms.

The jayj-quicktag plugin before 1.3.2 for WordPress has CSRF.

The invite-anyone plugin before 1.3.16 for WordPress has incorrect escaping of untrusted Dashboard and front-end input.

The invite-anyone plugin before 1.3.16 for WordPress has admin-panel CSRF.

The invite-anyone plugin before 1.3.16 for WordPress has incorrect access control for email-based invitations.

The zendesk-help-center plugin before 1.0.5 for WordPress has multiple XSS issues.

The xo-security plugin before 1.5.3 for WordPress has XSS.

The weblibrarian plugin before 3.4.8.7 for WordPress has XSS via front-end short codes.

The weblibrarian plugin before 3.4.8.6 for WordPress has XSS via front-end short codes.

The weblibrarian plugin before 3.4.8.5 for WordPress has XSS via front-end short codes.

The visitors-online plugin before 1.0.0 for WordPress has multiple XSS issues.

The smokesignal plugin before 1.2.7 for WordPress has XSS.

The share-on-diaspora plugin before 0.7.2 for WordPress has reflected XSS in share URL parameters.

The rimons-twitter-widget plugin before 1.3 for WordPress has XSS.

The realty plugin before 1.1.0 for WordPress has multiple XSS issues.

The raygun4wp plugin before 1.8.3 for WordPress has XSS in the settings, a different issue than CVE-2017-9288.

The rating-bws plugin before 0.2 for WordPress has multiple XSS issues.

The promobar plugin before 1.1.1 for WordPress has multiple XSS issues.

The pdf-print plugin before 1.9.4 for WordPress has multiple XSS issues.

The pagination plugin before 1.0.7 for WordPress has multiple XSS issues.