The Post Indexer plugin before 3.0.6.2 for WordPress has incorrect handling of data passed to the unserialize function.

The Post Indexer plugin before 3.0.6.2 for WordPress has SQL injection via the period parameter by a super admin.

The wp-d3 plugin before 2.4.1 for WordPress has CSRF.

The PageLines theme 1.1.4 for WordPress has wp-admin/admin-post.php?page=pagelines CSRF.

The multisite-post-duplicator plugin before 1.1.3 for WordPress has wp-admin/tools.php?page=mpd CSRF.

The zx-csv-upload plugin 1 for WordPress has SQL injection via the id parameter.

The podlove-podcasting-plugin-for-wordpress plugin before 2.3.16 for WordPress has SQL injection via the insert_id parameter exploitable via CSRF.

The podlove-podcasting-plugin-for-wordpress plugin before 2.3.16 for WordPress has XSS exploitable via CSRF.

The zm-gallery plugin 1.0 for WordPress has SQL injection via the order parameter.

The xtremelocator plugin 1.5 for WordPress has SQL injection via the id parameter.

The copy-me plugin 1.0.0 for WordPress has CSRF for copying non-public posts to a public location.

IMAPFilter through 2.6.12 does not validate the hostname in an SSL certificate.

The wp-polls plugin before 2.73.1 for WordPress has XSS via the Poll bar option.

The woocommerce-exporter plugin before 1.8.4 for WordPress has privilege escalation.

The check-email plugin before 0.5.2 for WordPress has XSS.

An issue was discovered in the portaudio crate through 0.7.0 for Rust. There is a man-in-the-middle issue because the source code is downloaded over cleartext HTTP.

An issue was discovered in the hyper crate before 0.9.4 for Rust on Windows. There is an HTTPS man-in-the-middle vulnerability because hostname verification was omitted.

An issue was discovered in the openssl crate before 0.9.0 for Rust. There is an SSL/TLS man-in-the-middle vulnerability because certificate verification is off by default and there is no API for hostname verification.

The wp-support-plus-responsive-ticket-system plugin before 7.1.0 for WordPress has insecure direct object reference via a ticket number.

The advanced-ajax-page-loader plugin before 2.7.7 for WordPress has no protection against the reading of uploaded files when not logged in.