The updraftplus plugin before 1.13.5 for WordPress has XSS in rare cases where an attacker controls a string logged to a log file.

The woocommerce-catalog-enquiry plugin before 3.1.0 for WordPress has an incorrect wp_upload directory for file uploads.

The timesheet plugin before 0.1.5 for WordPress has multiple XSS issues.

An issue was discovered in the cookie crate before 0.7.6 for Rust. Large integers in the Max-Age of a cookie cause a panic.

An issue was discovered in the security-framework crate before 0.1.12 for Rust. Hostname verification for certificates does not occur if ClientBuilder uses custom root certificates.

An issue was discovered in the hyper crate before 0.9.18 for Rust. It mishandles newlines in headers.

The insert-pages plugin before 3.2.4 for WordPress has directory traversal via custom template paths.

The posts-in-page plugin before 1.3.0 for WordPress has ic_add_posts template='../ directory traversal.

The post-pay-counter plugin before 2.731 for WordPress has no permissions check for an update-settinga action.

The post-pay-counter plugin before 2.731 for WordPress has PHP Object Injection.

The time-sheets plugin before 1.5.2 for WordPress has multiple XSS issues.

The time-sheets plugin before 1.5.0 for WordPress has XSS via the old timesheet list.

The shortcodes-ultimate plugin before 5.0.1 for WordPress has remote code execution via a filter in a meta, post, or user shortcode.

The corner-ad plugin before 1.0.8 for WordPress has XSS.

The crafty-social-buttons plugin before 1.5.8 for WordPress has XSS.

The event-notifier plugin before 1.2.1 for WordPress has XSS via the loading animation.

The newstatpress plugin before 1.2.5 for WordPress has multiple stored XSS issues.

The ninja-forms plugin before 3.0.31 for WordPress has insufficient HTML escaping in the builder.

The simple-login-log plugin before 1.1.2 for WordPress has SQL injection.

The gnucommerce plugin before 1.4.2 for WordPress has XSS.