The embed-comment-images plugin before 0.6 for WordPress has XSS.

The content-audit plugin before 1.9.2 for WordPress has XSS.

The cforms2 plugin before 14.13.3 for WordPress has multiple XSS issues.

The bws-testimonials plugin before 0.1.9 for WordPress has multiple XSS issues.

The bws-google-maps plugin before 1.3.6 for WordPress has multiple XSS issues.

The bws-google-analytics plugin before 1.7.1 for WordPress has multiple XSS issues.

The booking-sms plugin before 1.1.0 for WordPress has XSS.

The analytics-tracker plugin before 1.1.1 for WordPress has XSS via a search event.

The ad-buttons plugin before 2.3.2 for WordPress has XSS.

The zendesk-help-center plugin before 1.0.5 for WordPress has multiple XSS issues.

The xo-security plugin before 1.5.3 for WordPress has XSS.

The weblibrarian plugin before 3.4.8.7 for WordPress has XSS via front-end short codes.

The weblibrarian plugin before 3.4.8.6 for WordPress has XSS via front-end short codes.

The weblibrarian plugin before 3.4.8.5 for WordPress has XSS via front-end short codes.

The visitors-online plugin before 1.0.0 for WordPress has multiple XSS issues.

The smokesignal plugin before 1.2.7 for WordPress has XSS.

The share-on-diaspora plugin before 0.7.2 for WordPress has reflected XSS in share URL parameters.

The rimons-twitter-widget plugin before 1.3 for WordPress has XSS.

The realty plugin before 1.1.0 for WordPress has multiple XSS issues.

The raygun4wp plugin before 1.8.3 for WordPress has XSS in the settings, a different issue than CVE-2017-9288.