The uninstall plugin before 1.2 for WordPress has CSRF to delete all tables via the wp-admin/admin-ajax.php?action=uninstall URI.

The wp-all-import plugin before 3.2.4 for WordPress has no prevention of unauthenticated requests to adminInit.

The wp-all-import plugin before 3.2.5 for WordPress has blind SQL injection.

The wp-all-import plugin before 3.2.5 for WordPress has reflected XSS.

The profile-builder plugin before 2.2.5 for WordPress has XSS.

The flickr-justified-gallery plugin before 3.4.0 for WordPress has XSS.

The wp-business-intelligence-lite plugin before 1.6.3 for WordPress has SQL injection.

The visitors-online plugin before 0.4 for WordPress has SQL injection.

The 404-to-301 plugin before 2.0.3 for WordPress has SQL injection.

The erident-custom-login-and-dashboard plugin before 3.5 for WordPress has CSRF.

The shortcode-factory plugin before 1.1.1 for WordPress has XSS via add_query_arg.

The option-tree plugin before 2.5.4 for WordPress has XSS related to add_query_arg.

The gregs-high-performance-seo plugin before 1.6.2 for WordPress has XSS in the context of an old browser.

The awesome-support plugin before 3.1.7 for WordPress has a security issue in which shortcodes are allowed in replies.

The awesome-support plugin before 3.1.7 for WordPress has XSS via custom information messages.

The wp-fastest-cache plugin before 0.8.4.9 for WordPress has SQL injection in wp-admin/admin-ajax.php?action=wpfc_wppolls_ajax_request via the poll_id parameter.

The newstatpress plugin before 1.0.1 for WordPress has SQL injection.

The newstatpress plugin before 1.0.4 for WordPress has XSS related to the Referer header.

The newstatpress plugin before 1.0.5 for WordPress has SQL injection related to an IMG element.

The newstatpress plugin before 1.0.5 for WordPress has XSS related to an IMG element.