The twitter-plugin plugin before 2.55 for WordPress has XSS.

The twitter-cards-meta plugin before 2.5.0 for WordPress has CSRF.

The twitter-cards-meta plugin before 2.5.0 for WordPress has XSS.

The subscriber plugin before 1.3.5 for WordPress has multiple XSS issues.

The social-login-bws plugin before 0.2 for WordPress has multiple XSS issues.

The social-buttons-pack plugin before 1.1.1 for WordPress has multiple XSS issues.

The simple-membership plugin before 3.5.7 for WordPress has XSS.

The simple-job-board plugin before 2.4.4 for WordPress has reflected XSS via keyword search.

The liveforms plugin before 3.4.0 for WordPress has XSS.

The htaccess plugin before 1.7.6 for WordPress has multiple XSS issues.

The gravity-forms-sms-notifications plugin before 2.4.0 for WordPress has XSS.

The custom-search-plugin plugin before 1.36 for WordPress has multiple XSS issues.

The custom-admin-page plugin before 0.1.2 for WordPress has multiple XSS issues.

The contact-form-to-db plugin before 1.5.7 for WordPress has multiple XSS issues.

The contact-form-plugin plugin before 4.0.6 for WordPress has multiple XSS issues.

The contact-form-multi plugin before 1.2.1 for WordPress has multiple XSS issues.

The contact-form-7-sms-addon plugin before 2.4.0 for WordPress has XSS.

The Backup Guard plugin before 1.1.47 for WordPress has multiple XSS issues.

The adsense-plugin (aka Google AdSense) plugin before 1.44 for WordPress has multiple XSS issues.

Jitbit Helpdesk before 9.0.3 allows remote attackers to escalate privileges because of mishandling of the User/AutoLogin userHash parameter. By inspecting the token value provided in a password reset link, a user can leverage a weak PRNG to recover the shared secret used by the server for remote authentication. The shared secret can be used to escalate privileges by forging new tokens for any user. These tokens can be used to automatically log in as the affected user.