Vulnerability archive: section 1, page 15
Open a report to review affected versions, available fixes and original sources. Each report covers a specific issue; its presence does not establish whether your website is affected.
- GTG Product Feed for Shopping <= 1.2.4 - Missing Authorization to Unauthenticated Plugin Settings Update
- Sprout Clients <= 3.2 - Authenticated (Contributor+) Stored Cross-Site Scripting
- Broken Link Checker <= 1.11.8 - Reflected Cross-Site Scripting
- xSmart <= 1.2.9.4 - Reflected Cross-Site Scripting
- Broadcast Live Video – Live Streaming : HTML5, WebRTC, HLS, RTSP, RTMP <= 6.1.9 - Authenticated (Contributor+) Stored Cross-Site Scripting
- Exquisite - Ultimate Newspaper Theme <= 1.3.3 - Cross-Site Scripting
- Debug-Bar-Extender <= 0.5 - Reflected Cross-Site Scripting
- Most And Least Read Posts Widget <= 2.5.20 - Authenticated (Contributor+) Stored Cross-Site Scripting
- VK All in One Expansion Unit <= 9.88.1.0 - Stored (Contributor+) Cross-Site Scripting in Profile Setting
- KeyCAPTCHA <= 2.5.1 - Cross-Site Request Forgery to Stored Cross-Site Scripting
- Exertio Framework <= 1.3.1 - Unauthenticated Arbitrary User Password Update
- Ad Inserter <= 2.4.19 - Authenticated Path Traversal
- Twitter LiveBlog <= 1.1.2 - Cross-Site Request Forgery
- WPML Multilingual CMS <= 4.9.5 - Authenticated (Translator+) SQL Injection via 'sorting' Parameter
- WP Easy Gallery <= 4.1.4 - Stored Cross-Site Scripting
- The Events Calendar <= 6.8.2 - Missing Authorization to Unauthenticated Password Protected Event Disclosure
- Product Options and Price Calculation Formulas for WooCommerce – Uni CPO (Premium) <= 4.9.60 - Missing Authorization to Unauthenticated Arbitrary Attachment and Dropbox File Deletion
- Alley Elementor Widget <= 1.0.7 - Authenticated (Contributor+) Stored Cross-Site Scripting
- SupportCandy <= 3.2.3 - Authenticated (Subscriber+) Stored Cross-Site Scripting
- TI WooCommerce Wishlist <= 2.9.0 - Unauthenticated SQL Injection via 'lang'
- ZoomifyWP Free <= 1.1 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'filename' Shortcode Attribute
- Orders Chat for WooCommerce <= 2.0.0 - Missing Authorization
- 1g-music-share <= 1.5.1 - Cross-Site Scripting
- Gutenberg Template Library & Redux Framework <= 4.2.11 - Missing Authorization to Sensitive Information Disclosure
- Orbit Fox by ThemeIsle <= 2.6.3 - Improper REST Capabilities Checks
- Woody Ad Snippets <= 2.2.4 - Missing Authorization to Settings Import
- Directory Kit <= 1.5.4 - Authenticated (Subscriber+) Plugin Settings and API Key Disclosure
- GiveWP <= 2.33.3 - Cross-Site Request Forgery to plugin installation
- Author Discussion <= 0.2.2 - Authenticated (Subscriber+) SQL Injection
- WPFront Notification Bar <= 3.5.1 - Reflected Cross-Site Scripting via REQUEST_URI
- CRM Memberships <= 2.6 - Missing Authorization to Privilege Escalation via Unauthenticated Password Reset in 'ntzcrm_changepassword' AJAX Endpoint
- InventoryPress <= 1.7 - Authenticated(Author+) Stored Cross-Site Scripting
- TweetThis Shortcode <= 1.8.0 - Authenticated (Contributor+) Stored Cross-Site Scripting
- Checkout Mestres WP <= 7.1.9.6 - Missing Authorization to Unauthenticated Arbitrary Options Update
- WP Duplicate Page <= 1.8 - Missing Authorization to Authenticated (Contributor+) Arbitrary Post Duplication
- Muzicon - Music Festival & Concert WordPress Theme <= 1.15 - Unauthenticated PHP Object Injection
- VEDA <= 4.2 - Authenticated (Subscriber+) PHP Object Injection
- Twitter Post <= 0.1 - Cross-Site Request Forgery to Stored Cross-Site Scripting
- Slider by Supsystic <= 1.8.6 - Cross-Site Request Forgery
- Metorik – Reports & Email Automation for WooCommerce <= 1.7.1 - Cross-Site Request Forgery
- Testimonial Carousel For Elementor <= 11.6.2 - Authenticated (Contributor+) Stored Cross-Site Scripting via Multiple Widgets
- WP Email Capture <= 3.9.3 - Authenticated (Administrator+) Stored Cross-Site Scripting
- myCred <= 2.9.7.3 - Missing Authorization
- WooCommerce Order Proposal <= 2.0.5 - Authenticated (Shop Manager+) Privilege Escalation via Order Proposal
- PopupKit <= 2.2.0 - Missing Authorization to Sensitive Information Disclosure and Data Deletion
- WordPress Core < 3.9.2 - Authenticated Cross-Site Scripting via Avatar URL
- The Events Calendar <= 6.15.9 - Missing Authorization to Authenticated (Subscriber+) Draft Event Title/QR Code Exposure
- Googmonify <= 0.5.1 - Cross-Site Request Forgery to Cross-Site Scripting
- Theme My Login <= 7.1.7 - Cross-Site Request Forgery to Settings Update
- Best-wp-google-map <= 2.1 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'latitude' Shortcode Attribute
- All In One WP Security & Firewall <= 4.4.5 - Cross-Site Scripting
- Vocal <= 1.12 - Unauthenticated Local File Inclusion
- Disable Comments – Remove Comments & Stop Spam [Multi-Site Support] < 1.0.4 - Cross-Site Request Forgery
- The Events Calendar <= 6.1.2.2 - Missing Authorization
- WordPress Automatic Plugin < 3.135.1 - Unauthenticated Stored Cross-Site Scripting
- Email Encoder – Protect Email Addresses and Phone Numbers <= 2.4.4 - Authenticated (Contributor+) Stored Cross-Site Scripting via eeb_mailto Shortcode
- Mang Board <= 2.4.3 - Unauthenticated Stored Cross-Site Scripting via 'content' Parameter via content_reply AJAX
- Subscribe2 – Form, Email Subscribers & Newsletters <= 10.43 - Unauthenticated Stored Cross-Site Scripting via IP Parameter
- Authorizer <= 3.15.3 - Unauthenticated Privilege Escalation
- Preloader Quotes <= 1.0.0 - Reflected Cross-Site Scripting
- File Media Renamer <= 1.3 - Missing Authorization
- WP Membership <= 1.2.3 - Privilege Escalation
- Debug Info <= 1.3.10 - Authenticated (Admin+) Stored Cross-Site Scripting
- CozyStay < 1.7.1 - Unauthenticated PHP Object Injection
- teachPress <= 8.1.8 - Unauthenticated Stored Cross-Site Scripting
- Page Parts <= 1.4.3 - Reflected Cross-Site Scripting
- Food Store < 1.3.7 - Cross-Site Request Forgery
- Duplicator < 1.3.28 - Directory Traversal
- Easy restaurant menu manager <= 1.1.2 - Cross-Site Scripting
- Archicon < 1.7 - Unauthenticated PHP Object Injection
- Captcha.eu <= 1.0.60 - Reflected Cross-Site Scripting
- Registrations for the Events Calendar – Event Registration Plugin <= 2.12.3 - Unauthenticated Stored Cross-Site Scripting
- Draft List <= 2.6.4 - Authenticated (Contributor+) Stored Cross-Site Scripting
- Asset Manager <= 0.3 - Arbitrary File Upload
- Sticky Side Buttons < 2.0.0 - Authenticated (Administrator+) Stored Cross-Site Scripting
- Autolinks Manager <= 1.10.04 - Cross-Site Request Forgery
- Product Puller <= 1.5.1 - Reflected Cross-Site Scripting
- Novelist <= 1.2.2 - Cross-Site Request Forgery
- Aiomatic <= 1.9.3 - Missing Authorization
- Forminator Forms <= 1.57.0.1 - Unauthenticated Stored Cross-Site Scripting via Rich-Text Textarea Field
- WP Store Locator <= 2.2.261 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'wpsl_address' Post Meta
- AIHub <= 1.3.7 - Unauthenticated Arbitrary File Upload in generate_image
- Flynax Bridge <= 2.2.0 - Unauthenticated Privilege Escalation via Password Update
- Tutor LMS <= 2.7.6 - User Registration Setting Bypass to Unauthorized User Registration
- Double Opt-In for Download <= 2.0.8 - SQL Injection
- Cryptocurrency Donation Box <= 2.2.13 - Unauthenticated Stored Cross-Site Scripting via data_object Parameter
- Library Viewer <= 2.0.6 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode
- Extra Privacy for Elementor <= 0.1.3 - Reflected Cross-Site Scripting
- G Web Pro Store Locator <= 2.0.1 - Reflected Cross-Site Scripting
- Various Newfold Plugins Various Versions - Unauthenticated Authentication Bypass via Bearer Token Validation with Empty Secret
- WP Inventory Manager <= 2.5.1 - Authenticated (Contributor+) SQL Injection via 'where' Shortcode Attribute
- Bulk Page Stub Creator <= 1.1 - Reflected Cross-Site Scripting
- LatePoint <= 5.5.0 - Unauthenticated Account Takeover via Weak Password Recovery Mechanism
- Drag and Drop Multiple File Upload – Contact Form 7 <= 1.3.6.5 - Cross-Site Request Forgery in dnd_upload_cf7_upload and dnd_codedropz_upload_delete
- Freemius SDK <= 2.2.3 - Missing Authorization to Arbitrary Options Update
- Restaurant Menu – Food Ordering System – Table Reservation <= 2.4.1 - Authenticated (Contributor+) Stored Cross-Site Scripting
- CMP – Coming Soon & Maintenance Plugin by NiteoThemes <= 4.1.16 - Missing Authorization to Authenticated (Administrator+) Arbitrary File Upload and Remote Code Execution
- Simple Flash Video <= 1.7 - Cross-Site Scripting
- IE CSS3 Support <= 2.0.1 - Reflected Cross-Site Scripting
- SureCart – Ecommerce Made Easy For Selling Physical Products, Digital Downloads, Subscriptions, Donations, & Payments <= 4.7.2 - Authenticated (Shop Worker+) Privilege Escalation