Pligg versions 9.9 and below suffer from cross site scripting, arbitrary file access, and SQL injection vulnerabilities.