The akismet plugin before 3.1.5 for WordPress has XSS.

The wp-vipergb plugin before 1.3.16 for WordPress has XSS via add_query_arg() and remove_query_arg(), a different issue than CVE-2014-9460.

The two-factor-authentication plugin before 1.1.10 for WordPress has XSS in the admin area.

The feed-them-social plugin before 1.7.0 for WordPress has reflected XSS in the Facebook Feeds load more button.

The ckeditor-for-wordpress plugin before 4.5.3.1 for WordPress has reflected XSS in the "built-in (old)" file browser.

The wp-plotly plugin before 1.0.3 for WordPress has XSS by authors.

The cp-polls plugin before 1.0.5 for WordPress has XSS.

The wp-rollback plugin before 1.2.3 for WordPress has XSS.

The clean-login plugin before 1.5.1 for WordPress has reflected XSS.

The wp-all-import plugin before 3.2.5 for WordPress has reflected XSS.

The profile-builder plugin before 2.2.5 for WordPress has XSS.

The flickr-justified-gallery plugin before 3.4.0 for WordPress has XSS.

The shortcode-factory plugin before 1.1.1 for WordPress has XSS via add_query_arg.

The option-tree plugin before 2.5.4 for WordPress has XSS related to add_query_arg.

The gregs-high-performance-seo plugin before 1.6.2 for WordPress has XSS in the context of an old browser.

The awesome-support plugin before 3.1.7 for WordPress has XSS via custom information messages.

The newstatpress plugin before 1.0.4 for WordPress has XSS related to the Referer header.

The newstatpress plugin before 1.0.5 for WordPress has XSS related to an IMG element.

The newstatpress plugin before 1.0.6 for WordPress has reflected XSS.

The wp-ultimate-csv-importer plugin before 3.8.1 for WordPress has XSS.