The visitors-online plugin before 0.4 for WordPress has SQL injection.

The 404-to-301 plugin before 2.0.3 for WordPress has SQL injection.

The erident-custom-login-and-dashboard plugin before 3.5 for WordPress has CSRF.

The shortcode-factory plugin before 1.1.1 for WordPress has XSS via add_query_arg.

The option-tree plugin before 2.5.4 for WordPress has XSS related to add_query_arg.

The gregs-high-performance-seo plugin before 1.6.2 for WordPress has XSS in the context of an old browser.

The awesome-support plugin before 3.1.7 for WordPress has a security issue in which shortcodes are allowed in replies.

The awesome-support plugin before 3.1.7 for WordPress has XSS via custom information messages.

The wp-fastest-cache plugin before 0.8.4.9 for WordPress has SQL injection in wp-admin/admin-ajax.php?action=wpfc_wppolls_ajax_request via the poll_id parameter.

The newstatpress plugin before 1.0.1 for WordPress has SQL injection.

The newstatpress plugin before 1.0.4 for WordPress has XSS related to the Referer header.

The newstatpress plugin before 1.0.5 for WordPress has SQL injection related to an IMG element.

The newstatpress plugin before 1.0.5 for WordPress has XSS related to an IMG element.

The newstatpress plugin before 1.0.6 for WordPress has reflected XSS.

The all-in-one-wp-security-and-firewall plugin before 3.9.1 for WordPress has multiple SQL injection issues.

The wp-ultimate-csv-importer plugin before 3.8.1 for WordPress has XSS.

The ultimate-member plugin before 1.3.18 for WordPress has XSS via text input.

The simple-share-buttons-adder plugin before 6.0.0 for WordPress has XSS.

The simple-fields plugin before 1.4.11 for WordPress has XSS.

The liveforms plugin before 3.2.0 for WordPress has SQL injection.