The insert-pages plugin before 3.2.4 for WordPress has directory traversal via custom template paths.

The posts-in-page plugin before 1.3.0 for WordPress has ic_add_posts template='../ directory traversal.

The post-pay-counter plugin before 2.731 for WordPress has no permissions check for an update-settinga action.

The post-pay-counter plugin before 2.731 for WordPress has PHP Object Injection.

The time-sheets plugin before 1.5.2 for WordPress has multiple XSS issues.

The time-sheets plugin before 1.5.0 for WordPress has XSS via the old timesheet list.

The shortcodes-ultimate plugin before 5.0.1 for WordPress has remote code execution via a filter in a meta, post, or user shortcode.

The corner-ad plugin before 1.0.8 for WordPress has XSS.

The crafty-social-buttons plugin before 1.5.8 for WordPress has XSS.

The event-notifier plugin before 1.2.1 for WordPress has XSS via the loading animation.

The newstatpress plugin before 1.2.5 for WordPress has multiple stored XSS issues.

The ninja-forms plugin before 3.0.31 for WordPress has insufficient HTML escaping in the builder.

The simple-login-log plugin before 1.1.2 for WordPress has SQL injection.

The gnucommerce plugin before 1.4.2 for WordPress has XSS.

The search-everything plugin before 8.1.7 for WordPress has SQL injection related to WordPress 4.7.x, a different vulnerability than CVE-2014-2316.

The cforms2 plugin before 14.13 for WordPress has SQL injection in the tracking DB GUI via Delete Entries or Download Entries.

The my-wp-translate plugin before 1.0.4 for WordPress has CSRF.

The my-wp-translate plugin before 1.0.4 for WordPress has XSS.

The wp-all-import plugin before 3.4.6 for WordPress has XSS.

The user-role plugin before 1.5.6 for WordPress has multiple XSS issues.