Category Dropdown List <= 1.0 - Reflected Cross-Site Scripting via $_SERVER['PHP_SELF']

pandikamal03 Category Dropdown List

TWW Protein Calculator <= 1.0.24 - Authenticated (Administrator+) Stored Cross-Site Scripting via 'Header' Setting

thewellnessway TWW Protein Calculator

WP Flot <= 0.2.2 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode Attributes

ysh WP Flot

评论小秘书 <= 1.3.2 - Reflected Cross-Site Scripting via $_SERVER['PHP_SELF']

thobian 评论小秘书

Paypal Payment Shortcode <= 1.01 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'buttom_image' Shortcode Attribute

sonlamtn200 Paypal Payment Shortcode

Data Visualizer <= 1.1 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode Attributes

subhransu-sekhar Data Visualizer

Hide Email Address <= 0.1 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode Attributes

buntegiraffe Hide Email Address

DebateMaster <= 1.0.0 - Authenticated (Administrator+) Stored Cross-Site Scripting via Color Options via 'debate' Shortcode

jeremybmerrill DebateMaster

BUKAZU Search widget <= 3.3.2 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'shortcode' Shortcode Attribute

bobvanoorschot BUKAZU Search widget

GPXpress <= 1.3 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode Attributes

davidkeen GPXpress

WP User Manager <= 2.9.12 - Authenticated (Subscriber+) Arbitrary File Deletion via 'current_user_avatar' Parameter

wpusermanager WP User Manager – User Profile Builder & Membership

Premmerce Wishlist for WooCommerce <= 1.1.10 - Missing Authorization to Authenticated (Subscriber+) Arbitrary Wishlist Deletion

premmerce Premmerce Wishlist for WooCommerce

Simple Theme Changer <= 1.0. - Missing Authorization to Plugin Settings Update via AJAX Actions

darendev Simple Theme Changer

Bold Timeline Lite <= 1.2.7 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'title' Parameter in 'bold_timeline_group' Shortcode

boldthemes Bold Timeline Lite

Reviews Sorted <= 2.4.2 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'space' Shortcode Attribute

eurisko Reviews Sorted

Truefy Embed <= 1.1.0 - Cross-Site Request Forgery to 'truefy_embed_options_update' Settings Update

truefy Truefy Embed

Resource Library for Logged In Users <= 1.4 - Cross-Site Request Forgery to Multiple Administrative Actions

doubledome Resource Library for Logged In Users

Kirim.Email WooCommerce Integration <= 1.2.9 - Cross-Site Request Forgery to Settings Update

developerke Kirim.Email WooCommerce Integration

Easy Map Creator <= 3.0.2 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode Attributes

qrevo Easy Map Creator

IMAQ Core <= 1.2.1 - Cross-Site Request Forgery to URL Structure Update

imaqpress IMAQ CORE