Vulnerability archive: section 1, page 13
Open a report to review affected versions, available fixes and original sources. Each report covers a specific issue; its presence does not establish whether your website is affected.
- Smart Forms <= 2.6.84 - Missing Authorization to Authenticated (Subscriber+) Arbitrary Options Update
- LA-Studio Element Kit for Elementor <= 1.3.7.5 - Authenticated (Contributor+) Stored Cross-Site Scripting via LaStudioKit Post Author Widget
- Visual Website Collaboration, Feedback & Project Management – Atarim <= 3.30 - Unauthenticated Stored Cross-Site Scripting
- Premium Addons for Elementor <= 4.10.69 - Authenticated (Contributor+) Stored Cross-Site Scripting
- Awesome WordPress Timeline Plugin <= 1.0.1 - Authenticated (Subscriber+) Stored Cross-Site Scripting
- Countdown Timer <= 1.0.5 - Authenticated (Contributor+) Stored Cross-Site Scripting
- YouTube Embed <= 5.4 - Authenticated (Contributor+) Stored Cross-Site Scripting
- Starter Templates <= 3.2.5 - Incorrect Authorization
- Spiffy Calendar < 3.3.0 - Reflected Cross-Site Scripting
- Js O3 Lite <= 1.5.8.2 - Reflected Cross-Site Scripting
- RapidLoad Power-Up for Autoptimize <= 1.7.1 - Missing Authorization in 'clear_uucss_logs'
- Square <= 2.0.0 - Missing Authorization via activate_plugin
- JSmol2WP <= 1.07 - Server-Side Request Forgery
- Blogistic <= 1.0.5 - Authenticated (Subscriber+) Arbitrary File Upload
- Admin and Customer Messages After Order for WooCommerce: OrderConvo <= 14 - Missing Authorization to Unauthenticated User Impersonation in Order Messages
- Codescar Radio Widget <= 0.4.2 - Cross-Site Request Forgery to Stored Cross-Site Scripting
- Slimstat Analytics <= 3.9.2 - Cross-Site Scripting
- App Builder <= 3.8.7 - Open Redirection
- dForms <= 1.0 - Reflected Cross-Site Scripting
- Google Tag Manager for WordPress (GTM4WP) <= 1.15.1 - Stored Cross-Site Scripting via Content Element ID
- WP Affiliate Platform <= 6.5.1 - Cross-Site Request Forgery to Afilliate Deletion
- JNews - WordPress Newspaper Magazine Blog AMP Theme < 8.0.6 - Reflected Cross-Site Scripting
- Social Sharing Toolkit < 2.1.2 - Cross-Site Scripting
- NextScripts <= 4.4.2 - Reflected Cross-Site Scripting via code
- Projectopia – WordPress Project Management <= 5.1.19 - Missing Authorization to Unauthenticated Arbitrary Attachment Deletion
- WordPress Charts <= 0.7.0 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode
- YARPP – Yet Another Related Posts Plugin <= 5.30.2 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode
- Better Search < 2.2.3 - SQL Injection
- EventON <= 2.4 - Unauthenticated Local File Inclusion
- ACF Flexible Layouts Manager <= 1.1.6 - Missing Authorization to Unauthenticated Custom Field Update
- Customer Switching < 2.1.3 - Authenticated (Customer+) Privilege Escalation
- Click & Pledge Connect <= 25.04010101-WP6.8 - Unauthenticated SQL Injection to Privilege Escalation
- myLinksDump <= 1.6 - Authenticated (Administrator+) SQL Injection via 'sort_by' and 'sort_order' Parameters
- LegalWeb Cloud <= 1.1.2 - Authenticated (Contributor+) Stored Cross-Site Scripting
- Text Advertisements <= 2.1 - Authenticated (Contributor+) Stored Cross-Site Scripting
- Software License Manager < 4.4.6 - Cross-Site Request Forgery
- Headline Analyzer <= 1.3.3 - Cross-Site Request Forgery
- Google Analyticator <= 6.5.5 - Authenticated (Administrator+) PHP Object Injection
- Post Pay Counter <= 2.789 - Reflected Cross-Site Scripting
- tarteaucitron.js for WordPress < 0.3.0 - Cross-Site Request Forgery to Stored Cross-Site Scripting
- Faith & Hope <= 2.13.0 - Unauthenticated Local File Inclusion
- Shared Files <= 1.7.5 - Unauthenticated Stored Cross-Site Scripting
- Rife Elementor Extensions & Templates <= 1.1.10 - Missing Authorization via import_templates
- Download Manager < 2.5.9 - Stored Cross-Site Scripting
- Ajax Load More <= 8.0.0 - Unauthenticated SQL Injection
- App for Cloudflare® <= 1.10.1 - Missing Authorization
- Products, Order & Customers Export for WooCommerce <= 2.0.10 - Reflected Cross-Site Scripting via date parameters
- Plugins Garbage Collector (Database Cleanup) <= 0.14 - Cross-Site Request Forgery
- EmailKit <= 1.6.0 - Missing Authorization to Authenticated (Author+) Arbitrary Content Deletion
- Hotel Booking <= 3.8 - Authenticated (Subscriber+) Insecure Direct Object Reference
- WPGYM <= 67.1.0 - Missing Authorization to Authenticated (Subscriber+) Privilege Escalation
- ZoxPress - The All-In-One WordPress News Theme <= 2.12.0 - Missing Authorization to Authenticated (Subscriber+) Arbitrary Options Deletion
- Chronosly Events Calendar <= 2.6.2 - Cross-Site Request Forgery via plugin_settings_page
- Masteriyo LMS – Online Course Builder for eLearning, LMS & Education <= 2.1.5 - Missing Authorization
- CF7 Google Sheets Connector <= 5.0.5 - Unauthenticated Sensitive Information Exposure via Debug Log
- Events Manager <= 5.5.7.1 - Cross-Site Scripting
- UsersWP <= 1.2.47 - Missing Authorization
- Elementor <= 3.30.2 - Authenticated (Contributor+) Stored Cross-Site Scripting via Text Path Widget
- Welcart e-Commerce <= 2.9.6 - Authenticated (Administrator+) Directory Traversal
- Advanced iFrame <= 2025.5 - Authenticated (Contributor+) Stored Cross-Site Scripting
- WP Job Manager – Company Profiles <= 1.7 - Reflected Cross-Site Scripting
- Rise Blocks – A Complete Gutenberg Page Builder <= 3.7 - Authenticated (Contributor+) Stored Cross-Site Scripting via Site Identity Block Attributes
- Link Library <= 7.7.1 - Reflected Cross-Site Scripting
- Xelion Webchat <= 9.1.0 - Authenticated (Subscriber+) Privilege Escalation
- Request a Quote <= 2.3.10 - Cross-Site Request Forgery
- Autoptimize <= 2.1.0 - Unauthenticated Local File Inclusion
- TheGem Theme Elements (for Elementor) <= 5.11.0 - Authenticated (Contributor+) Local File Inclusion
- EventON <= 2.1 - Missing Authorization to Event Access
- Embed Articles <= 7.0.3 - Reflected Cross-Site Scripting
- Gravity Forms <= 2.9.21.1 - Unauthenticated Arbitrary File Upload via Legacy Chunked Upload
- Passwords Manager <= 1.4.8 - Unauthenticated SQL Injection
- Automation By Autonami <= 3.6.0 - Open Redirect
- SEPA Girocode <= 0.5.1 - Authenticated (Contributor+) Stored Cross-Site Scripting
- Import and export users and customers <= 1.24.2 - Authenticated(Administrator+) Directory Traversal via Recurring Import Functionality
- Extra Product Options Builder for WooCommerce <= 1.2.133 - Unauthenticated Stored Cross-Site Scripting
- Smart SEO Tool-WordPress SEO优化插件 <= 4.0.1 - Cross-Site Request Forgery via 'wp_ajax_wb_smart_seo_tool'
- Slideshow Gallery <= 1.6.5 - Reflected Cross-Site Scripting
- Maps Plugin using Google Maps for WordPress – WP Google Map <= 1.9.3 - Maps Plugin using Google Maps for WordPress – WP Google Map <= 1.9.3 - Authenticated (Admin+) Stored Cross-Site Scripting via Markers
- Float to Top Button <= 2.3.6 - Authenticated (Admin+) Stored Cross-Site Scripting
- Surfer <= 1.3.2.357 - Missing Authorization
- LearnDash LMS <= 2.5.3 - Arbitrary File Upload
- Rebrand Fluent Forms <= 1.0 - Reflected Cross-Site Scripting
- Advanced Product Fields Extended for WooCommerce <= 3.1.6 - Unauthenticated Arbitrary File Deletion
- WCFM - WooCommerce Frontend Manager <= 6.7.25 - Insecure Direct Object References to Autenticated (Vendor+) Arbitrary Post/Product Manipulation
- Livemesh Addons for Beaver Builder <= 3.9.2 - Authenticated (Contributor+) Stored Cross-Site Scripting
- WP Event Manager <= 3.2.0 - Missing Authorization
- AfterShip Tracking <= 1.17.17 - Missing Authorization
- Copy Anything to Clipboard <= 2.6.4 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode
- XStore Core <= 5.3.8 - Unauthenticated SQL Injection
- Kalles <= 1.1.7.1 - Unauthenticated PHP Object Injection
- Knews Multilingual Newsletters <= 1.1.0 - Reflected Cross-Site Scripting
- Bookly <= 28.2 - Authenticated (Staff+) Insecure Direct Object Reference
- Kaven <= 1.2 - Unauthenticated Local File Inclusion
- Comments – wpDiscuz <= 7.6.39 - Unauthenticated Authentication Bypass Through Account Takeover
- Rankie < 1.8.2 - Missing Authorization
- Nokri – Job Board WordPress Theme <= 1.6.4 - Missing Authorization to Authenticated (Subscriber +) Privilege Escalation via Account Takeover
- Advanced Page Visit Counter <= 8.0.6 - Authenticated (Contributor+) Stored Cross-Site Scripting
- Gallery Blocks with Lightbox <= 3.3.0 - Missing Authorization to Authenticated (Contributor+) Plugin Settings Modification
- Popup addon for Ninja Forms <= 3.5.1 - Authenticated (Administrator+) Stored Cross-Site Scripting
- PayHere Payment Gateway Plugin for WooCommerce <= 2.3.9 - Missing Authorization to Unauthenticated Order Status Modification