The feed-them-social plugin before 1.7.0 for WordPress has reflected XSS in the Facebook Feeds load more button.

The ckeditor-for-wordpress plugin before 4.5.3.1 for WordPress has reflected XSS in the "built-in (old)" file browser.

The sell-downloads plugin before 1.0.8 for WordPress has insufficient restrictions on brute-force guessing of purchase IDs.

The wp-plotly plugin before 1.0.3 for WordPress has XSS by authors.

The cp-polls plugin before 1.0.5 for WordPress has XSS.

The link-log plugin before 2.0 for WordPress has HTTP Response Splitting.

The link-log plugin before 2.1 for WordPress has SQL injection.

The wp-rollback plugin before 1.2.3 for WordPress has CSRF.

The wp-rollback plugin before 1.2.3 for WordPress has XSS.

The wp-file-upload plugin before 3.4.1 for WordPress has insufficient restrictions on upload of .php.js files.

The wp-file-upload plugin before 3.0.0 for WordPress has insufficient restrictions on upload of php, js, pht, php3, php4, php5, phtml, htm, html, and htaccess files.

The wp-file-upload plugin before 2.7.1 for WordPress has insufficient restrictions on upload of .js files.

The wp-file-upload plugin before 2.5.0 for WordPress has insufficient restrictions on upload of .php files.

The profile-builder plugin before 2.1.4 for WordPress has no access control for activating or deactivating addons via AJAX.

The clean-login plugin before 1.5.1 for WordPress has reflected XSS.

The limit-attempts plugin before 1.1.1 for WordPress has SQL injection during IP address handling.

The email-newsletter plugin through 20.15 for WordPress has SQL injection.

The cforms2 plugin before 14.6.10 for WordPress has SQL injection.

The uninstall plugin before 1.2 for WordPress has CSRF to delete all tables via the wp-admin/admin-ajax.php?action=uninstall URI.

The wp-all-import plugin before 3.2.4 for WordPress has no prevention of unauthenticated requests to adminInit.