The simple-add-pages-or-posts plugin before 1.7 for WordPress has CSRF for deleting users.

The google-document-embedder plugin before 2.6.2 for WordPress has CSRF.

The google-document-embedder plugin before 2.6.2 for WordPress has XSS.

The google-document-embedder plugin before 2.6.1 for WordPress has XSS.

The wp-live-chat-support plugin before 6.2.02 for WordPress has XSS.

The wp-editor plugin before 1.2.6.3 for WordPress has multiple XSS issues.

The wp-database-backup plugin before 4.3.1 for WordPress has CSRF.

The wp-database-backup plugin before 4.3.1 for WordPress has XSS.

The wp-database-backup plugin before 4.3.3 for WordPress has CSRF.

The wp-database-backup plugin before 4.3.3 for WordPress has XSS.

The ultimate-member plugin before 1.3.40 for WordPress has XSS on the login form.

The google-language-translator plugin before 5.0.06 for WordPress has XSS.

The contact-form-plugin plugin before 4.0.2 for WordPress has XSS.

The all-in-one-wp-security-and-firewall plugin before 4.0.5 for WordPress has XSS in the blacklist, file system, and file change detection settings pages.

The all-in-one-wp-security-and-firewall plugin before 4.0.6 for WordPress has XSS in settings pages.

The all-in-one-wp-security-and-firewall plugin before 4.2.0 for WordPress has multiple XSS issues.

The Lightbox Plus Colorbox plugin through 2.7.2 for WordPress has cross-site request forgery (CSRF) via wp-admin/admin.php?page=lightboxplus, as demonstrated by resultant width XSS.

NETGEAR EX7000 V1.0.0.42_1.0.94 devices allow XSS via the SSID.

Edimax Wi-Fi Extender devices allow goform/formwlencryptvxd CSRF with resultant PSK key disclosure.

Neet AirStream NAS1.1 devices have a password of ifconfig for the root account. This cannot be changed via the configuration page.