The kento-post-view-counter plugin through 2.8 for WordPress has wp-admin/admin.php?page=kentopvc_settings CSRF.

The kento-post-view-counter plugin through 2.8 for WordPress has stored XSS via kento_pvc_numbers_lang, kento_pvc_today_text, or kento_pvc_total_text.

The kento-post-view-counter plugin through 2.8 for WordPress has XSS via kento_pvc_geo.

The fossura-tag-miner plugin before 1.1.5 for WordPress has XSS.

The fossura-tag-miner plugin before 1.1.5 for WordPress has CSRF.

The nelio-ab-testing plugin before 4.5.0 for WordPress has filename=..%2f directory traversal.

The safe-editor plugin before 1.2 for WordPress has no se_save authentication, with resultant XSS.

The fluid-responsive-slideshow plugin before 2.2.7 for WordPress has reflected XSS via the skin parameter.

The fluid-responsive-slideshow plugin before 2.2.7 for WordPress has frs_save CSRF with resultant stored XSS.

The Brafton plugin before 3.4.8 for WordPress has XSS via the wp-admin/admin.php?page=BraftonArticleLoader tab parameter to BraftonAdminPage.php.

The newspaper theme before 6.7.2 for WordPress has a lack of options access control via td_ajax_update_panel.

The MemberSonic Lite plugin before 1.302 for WordPress has incorrect login access control because only knowlewdge of an e-mail address is required.

The supportflow plugin before 0.7 for WordPress has XSS via a ticket excerpt.

The supportflow plugin before 0.7 for WordPress has XSS via a discussion ticket title.

The peepso-core plugin before 1.6.1 for WordPress has PeepSoProfilePreferencesAjax->save() privilege escalation.

The real3d-flipbook-lite plugin 1.0 for WordPress has XSS via the wp-content/plugins/real3d-flipbook/includes/flipbooks.php bookId parameter.

The real3d-flipbook-lite plugin 1.0 for WordPress has bookName=../ directory traversal for file upload.

The real3d-flipbook-lite plugin 1.0 for WordPress has deleteBook=../ directory traversal for file deletion.

The dwnldr plugin before 1.01 for WordPress has XSS via the User-Agent HTTP header.

The icegram plugin before 1.9.19 for WordPress has XSS.