The copy-me plugin 1.0.0 for WordPress has CSRF for copying non-public posts to a public location.

IMAPFilter through 2.6.12 does not validate the hostname in an SSL certificate.

The wp-polls plugin before 2.73.1 for WordPress has XSS via the Poll bar option.

The woocommerce-exporter plugin before 1.8.4 for WordPress has privilege escalation.

The check-email plugin before 0.5.2 for WordPress has XSS.

An issue was discovered in the portaudio crate through 0.7.0 for Rust. There is a man-in-the-middle issue because the source code is downloaded over cleartext HTTP.

An issue was discovered in the hyper crate before 0.9.4 for Rust on Windows. There is an HTTPS man-in-the-middle vulnerability because hostname verification was omitted.

An issue was discovered in the openssl crate before 0.9.0 for Rust. There is an SSL/TLS man-in-the-middle vulnerability because certificate verification is off by default and there is no API for hostname verification.

The wp-support-plus-responsive-ticket-system plugin before 7.1.0 for WordPress has insecure direct object reference via a ticket number.

The advanced-ajax-page-loader plugin before 2.7.7 for WordPress has no protection against the reading of uploaded files when not logged in.

The onelogin-saml-sso plugin before 2.2.0 for WordPress has a hardcoded @@@nopass@@@ password for just-in-time provisioned users.

The nelio-ab-testing plugin before 4.5.11 for WordPress has SSRF in ajax/iesupport.php.

The nelio-ab-testing plugin before 4.5.9 for WordPress has SSRF in ajax/iesupport.php.

The peters-login-redirect plugin before 2.9.1 for WordPress has XSS during the editing of redirect URLs.

The ebook-download plugin before 1.2 for WordPress has directory traversal.

The woocommerce-store-toolkit plugin before 1.5.8 for WordPress has privilege escalation.

The woocommerce-store-toolkit plugin before 1.5.7 for WordPress has privilege escalation.

The gallery-photo-gallery plugin before 1.0.1 for WordPress has SQL injection.

The gnucommerce plugin before 0.5.7-BETA for WordPress has XSS.

The wassup plugin before 1.9.1 for WordPress has XSS via the Top stats widget or the wassupURI::add_siteurl method, a different vulnerability than CVE-2012-2633.