REQUEST['src'] is passed directly into file_get_contents function.

$_GET['gpid'] is not escaped.

_form_makercfm() is accessible for every registered user.

$_GET['searchll'] is not escaped.

$_GET['walbum'] is not escaped.

_rednao_smart_forms_save_formvalues function is accessible for everyone through admin-ajax.php

$_REQUEST['update_message'] is not escaped.

Datas from checkboxes are not escaped and validated when added to database.