The files for retrieving social network counts, ajax-cube3x-gplus-count.php for example, all have vulnerabilities in them. You are accepting a callback via $_GET['callback'] but there is no sanitation going on, meaning that someone could easily inject a script via the callback and take control of the site.

You need to ensure you have validated the request before anything is processed.

Once you've fixed the issues, respond to this email and attach the updated version for re-review.

Pippin