The booking-calendar-contact-form plugin before 1.0.24 for WordPress has XSS.

The wp-customer-reviews plugin before 3.0.9 for WordPress has XSS in the admin tools.

The uji-countdown plugin before 2.0.7 for WordPress has XSS.

The total-security plugin before 3.4.1 for WordPress has XSS.

The sermon-browser plugin before 0.45.16 for WordPress has multiple XSS issues.

The seo-redirection plugin before 4.3 for WordPress has stored XSS.

The option-tree plugin before 2.6.0 for WordPress has XSS via an add_list_item or add_social_links AJAX request.

The crayon-syntax-highlighter plugin before 2.8.4 for WordPress has multiple XSS issues via AJAX requests.

The chained-quiz plugin before 1.0 for WordPress has multiple XSS issues.

The aryo-activity-log plugin before 2.3.3 for WordPress has XSS.

The aryo-activity-log plugin before 2.3.2 for WordPress has XSS.

The google-document-embedder plugin before 2.6.2 for WordPress has XSS.

The google-document-embedder plugin before 2.6.1 for WordPress has XSS.

The wp-live-chat-support plugin before 6.2.02 for WordPress has XSS.

The wp-editor plugin before 1.2.6.3 for WordPress has multiple XSS issues.

The wp-database-backup plugin before 4.3.1 for WordPress has XSS.

The wp-database-backup plugin before 4.3.3 for WordPress has XSS.

The ultimate-member plugin before 1.3.40 for WordPress has XSS on the login form.

The google-language-translator plugin before 5.0.06 for WordPress has XSS.

The contact-form-plugin plugin before 4.0.2 for WordPress has XSS.