The wp-polls plugin before 2.72 for WordPress has SQL injection.

The feed-them-social plugin before 1.7.0 for WordPress has possible shortcode execution in the Facebook Feeds load more button.

The feed-them-social plugin before 1.7.0 for WordPress has reflected XSS in the Facebook Feeds load more button.

The ckeditor-for-wordpress plugin before 4.5.3.1 for WordPress has reflected XSS in the "built-in (old)" file browser.

The sell-downloads plugin before 1.0.8 for WordPress has insufficient restrictions on brute-force guessing of purchase IDs.

The wp-plotly plugin before 1.0.3 for WordPress has XSS by authors.

The cp-polls plugin before 1.0.5 for WordPress has XSS.

The link-log plugin before 2.0 for WordPress has HTTP Response Splitting.

The link-log plugin before 2.1 for WordPress has SQL injection.

The wp-rollback plugin before 1.2.3 for WordPress has CSRF.

The wp-rollback plugin before 1.2.3 for WordPress has XSS.

The wp-file-upload plugin before 3.4.1 for WordPress has insufficient restrictions on upload of .php.js files.

The wp-file-upload plugin before 3.0.0 for WordPress has insufficient restrictions on upload of php, js, pht, php3, php4, php5, phtml, htm, html, and htaccess files.

The wp-file-upload plugin before 2.7.1 for WordPress has insufficient restrictions on upload of .js files.

The wp-file-upload plugin before 2.5.0 for WordPress has insufficient restrictions on upload of .php files.

The profile-builder plugin before 2.1.4 for WordPress has no access control for activating or deactivating addons via AJAX.

The clean-login plugin before 1.5.1 for WordPress has reflected XSS.

The limit-attempts plugin before 1.1.1 for WordPress has SQL injection during IP address handling.

The email-newsletter plugin through 20.15 for WordPress has SQL injection.

The cforms2 plugin before 14.6.10 for WordPress has SQL injection.