CVE-2018-20983

The wp-retina-2x plugin before 5.2.3 for WordPress has XSS.

Source: CVE-2018-20983

CVE-2018-20984

The patreon-connect plugin before 1.2.2 for WordPress has Object Injection.

Source: CVE-2018-20984

CVE-2018-20985

The wp-payeezy-pay plugin before 2.98 for WordPress has local file inclusion in pay.php, donate.php, donate-rec, and pay-rec.

Source: CVE-2018-20985

CVE-2017-18581

The time-sheets plugin before 1.5.0 for WordPress has XSS via the old timesheet list.

Source: CVE-2017-18581

CVE-2017-18582

The time-sheets plugin before 1.5.2 for WordPress has multiple XSS issues.

Source: CVE-2017-18582

CVE-2017-18577

The mailchimp-for-wp plugin before 4.1.8 for WordPress has XSS via the return value of add_query_arg.

Source: CVE-2017-18577

CVE-2008-7321

The tubepress plugin before 1.6.5 for WordPress has XSS.

Source: CVE-2008-7321

CVE-2016-10926

The nelio-ab-testing plugin before 4.5.9 for WordPress has SSRF in ajax/iesupport.php.

Source: CVE-2016-10926

CVE-2015-9337

The profile-builder plugin before 2.1.4 for WordPress has no access control for activating or deactivating addons via AJAX.

Source: CVE-2015-9337

CVE-2016-10922

The woocommerce-store-toolkit plugin before 1.5.7 for WordPress has privilege escalation.

Source: CVE-2016-10922