Authenticated (admin+) Reflected Cross-Site Scripting (XSS) vulnerability in Galerio & Urda’s Better Delete Revision plugin <= 1.6.1 at WordPress.

Cross-Site Request Forgery (CSRF) vulnerability in Vinoj Cardoza’s Captcha Code plugin <= 2.7 at WordPress.

Impact varies for each individual vulnerability in the application. For generation of accounts, it may be possible, depending on the amount of system resources available, to create a DoS event in the server. These accounts still need to be activated; however, it is possible to identify the output Status Code to separate accounts that are generated and waiting for email verification. nnFor the sign in directories, it is possible to brute force login attempts to either login portal, which could lead to account compromise.

Multiple Authenticated Stored Cross-Site Scripting (XSS) vulnerabilities in WPChill Gallery PhotoBlocks plugin <= 1.2.6 at WordPress.

Cross-site scripting vulnerability in Aficio SP 4210N firmware versions prior to Web Support 1.05 allows a remote authenticated attacker with an administrative privilege to inject an arbitrary script.

Cross-Site Request Forgery (CSRF) vulnerability in Mickey Kay’s Better Font Awesome plugin <= 2.0.1 at WordPress.