Vulnerability archive: section 1, page 17
Open a report to review affected versions, available fixes and original sources. Each report covers a specific issue; its presence does not establish whether your website is affected.
- Live Sales Notification for Woocommerce – Woomotiv <= 3.4.3 - Cross-Site Request Forgery via ajax_cancel_review
- ReFlex Gallery < 1.4.3 - Cross-Site Scripting
- SearchWP Premium <= 4.2.5 - Authenticated (Subscriber+) Nonce Leakage and Authorization Bypass
- Extensions for Elementor <= 2.0.31 - Authenticated (Contributor+) Stored Cross-Site Scripting
- Ninja Forms Contact Form – The Drag and Drop Form Builder for WordPress <= 3.0.30 - HTML Injection
- Simple Slider < 1.1 - Reflected Cross-Site Scripting
- LiteSpeed Cache <= 5.6 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode
- URL Shortener <= 3.0.7 - Missing Authorization
- Fana <= 1.1.28 - Unauthenticated Local File Inclusion
- DSGVO Tools (GDPR) <= 3.1.39 - Missing Authorization to Unauthenticated Sensitive Information Disclosure
- WPsc MijnPress <= 0.0.1 - Cross-Site Scripting
- WPBakery Page Builder <= 8.7.2 - Missing Authorization
- Locatoraid Store Locator <= 3.9.11 - Cross Site Request Forgery in grab
- BERTHA AI Plugin <= 1.11.10.7 - Unauthenticated Arbitrary File Upload
- Logo Slider <= 5.5.3 - Authenticated (Author+) Stored Cross-Site Scripting
- Typing Effect <= 1.3.7 - Authenticated (Contributor+) Stored Cross-Site Scripting
- OAuth Single Sign On – SSO (OAuth Client) <= 6.24.1 - Cross-Site Request Forgery via 'delete' in mooauth_client_applist_page
- JW Player for WordPress <= 2.3.11 - Unauthenticated Stored Cross-Site Scripting
- JB Horizontal Scroller News Ticker <= 1.0 - Authenticated (Contributor+) Stored Cross-Site Scripting
- GiveWP <= 4.17.0 - Authenticated (Contributor+) Stored Cross-Site Scripting via givewp_campaign_grid Shortcode Attributes
- Qi Addons For Elementor <= 1.7.2 - Authenticated (Contributor+) Stored Cross-Site Scripting via Button Widget
- Float to Top Button <= 2.3.6 - Authenticated (Administrator+) Stored Cross-Site Scripting
- Before And After <= 3.9 - Cross-Site Request Forgery
- Code Snippets <= 2.14.3 - Reflected Cross-Site Scripting
- TextBuilder 1.0.0 - 1.1.1 - Cross-Site Request Forgery to Privilege Escalation via Account Takeover
- Visualizer: Tables and Charts Manager for WordPress <= 3.3.0 - Stored Cross-Site Scripting
- Contact Page With Google Map <= 1.6.1 - Unauthenticated Arbitrary File Deletion
- Easy Twitter Feed – Twitter feeds plugin for WP <= 1.2.6 - Authenticated (Contributor+) Post Exposure
- Marcell <= 1.2.14 - Unauthenticated Local File Inclusion
- Iconize <= 1.2.4 - Authenticated (Admin+) Remote Code Execution
- Qyrr – simply and modern QR-Code creation <= 0.7 - Cross-Site Scripting
- Dooodl <= 2.3.0 - Reflected Cross-Site Scripting
- TheGem <= 5.10.3 - Missing Authorization to Authenticated (Subscriber+) Arbitrary Theme Options Update
- Church Admin <= 4.0.27 - Authenticated (Contributor+) SQL Injection
- WP Repost <= 0.1 - Missing Authorization
- MSN Partner Hub <= 2.8.7 - Missing Authorization
- Royal Elementor Addons and Templates <= 1.3.975 - Authenticated (Contributor+) Stored Cross-Site Scripting via Back to Top Widget
- IP2Location Country Blocker <= 2.26.4 - Subscriber+ Arbitrary Country Ban
- Norvis Backup <= 1.1.0 - Unauthenticated Information Exposure
- Backup and Restore plugin – WordPress <= 1.0.3 - Authenticated (Admin+) Arbitrary File Deletion
- We’re Open! <= 1.44 - Missing Authorization
- Simple Popup Manager <= 1.3.5 - Authenticated (Administrator+) Stored Cross-Site Scripting
- iframe <= 5.0 - Authenticated(Contributor+) Stored Cross-Site Scripting via shortcode
- Image Carousel Shortcode <= 1.2 - Authenticated (Contributor+) Stored Cross-Site Scripting
- Spotlight Social Feeds <= 1.4.2 - Authenticated (Contributor+) Stored Cross-Site Scripting
- WE Blocks <= 1.3.5 - Authenticated (Contributor+) Stored Cross-Site Scripting
- LUNA RADIO PLAYER <= 6.24.11.07 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode
- Event Monster <= 1.3.9 - Authenticated(Contributor+) PHP Object Injection via Custom Meta
- ThinkTwit < 1.7.1 - Stored Cross-Site Scripting
- Forms <= 2.9.0 - Authenticated (Contributor+) Arbitrary File Upload
- Fast Flow <= 1.2.12 - Authenticated (Admin+) Stored Cross-Site Scripting
- All-in-One WP Migration <= 6.97 - Authenticated Stored Cross-Site Scripting
- Websand Subscription Form <= 1.0.3 - Authenticated (Contributor+) Stored Cross-Site Scripting
- Awesome Support – WordPress HelpDesk & Support Plugin <= 6.1.7 - Authenticated (Subscriber+) SQL Injection
- Elegant Pink <= 1.3.3 - Missing Authorization
- WP Meta SEO <= 4.5.3 - Missing Authorization in 'regenerateSitemaps'
- e2pdf <= 1.20.27 - Cross-Site Request Forgery
- Top Bar <= 3.0.3 - Authenticated (Administrator+) Stored Cross-Site Scripting
- Woody code snippets – Insert Header Footer Code, AdSense Ads <= 2.5.0 - Authenticated (Admin+) Stored Cross-Site Scripting
- LearnPress <= 4.2.5.3 - Reflected Cross-Site Scripting via add_internal_scripts_to_head
- Easy Testimonials <= 3.5.2 - Authenticated Stored Cross-Site Scripting
- BuddyBoss Theme <= 2.4.60 - Missing Authorization
- Five Star Restaurant Reservations <= 2.6.7 - Reflected Cross-Site Scripting
- Datalist it <= 0.0.3 - Unauthenticated SQL Injection
- FreeAgent <= 2.1.2 - Unauthenticated Local File Inclusion
- Appzend <= 1.2.6 - Authenticated (Contributor+) Stored Cross-Site Scripting via progressbarLayout Parameter
- Pricing Tables for WP <= 1.1.0 - Reflected Cross-Site Scripting via 'page' Parameter
- Photo Gallery, Images, Slider in Rbs Image Gallery <= 3.2.19 - Cross-Site Request Forgery to Post Creation and Limited Data Loss
- Premmerce Wholesale Pricing for WooCommerce <= 1.1.10 - Missing Authorization
- Page Builder: Pagelayer – Drag and Drop website builder <= 2.0.5 - Authenticated (Author+) Insecure Direct Object Reference
- Real Estate 7 WordPress < 3.0.6 - Reflected Cross-Site Scripting
- Pay with Vipps for WooCommerce <= 1.14.13 - Authenticated (Contributor+) Stored Cross-Site Scripting
- Freshmail <= 1.5.8 - Multiple SQL Injections
- Happy Addons for Elementor <= 3.10.1 - Missing Authorization via add_row_actions
- Frontend File Manager & Sharing – User Private Files <= 1.1.2 - Subscriber+ Arbitrary File Upload
- EventPrime – Events Calendar, Bookings and Tickets <= 4.2.0.0 - Missing Authorization to Authenticated (Subscriber+) Booking Note Creation
- Sky Addons for Elementor <= 3.1.4 - Authenticated (Contributor+) Stored Cross-Site Scripting via Multiple Widgets
- itemprop WP for SERP/SEO Rich snippets <= 3.5.201706131 - Authenticated (Administrator+) Stored Cross-Site Scripting
- Tickera <= 3.6.0.0 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'price_wrapper' Shortcode Attribute
- Mailster < 4.1.14 - Reflected Cross-Site Scripting
- All-in-One WP Migration and Backup < 7.108 - Authenticated (Administrator+) Remote Code Execution
- Disable Admin Notices individually <= 1.4.0 - Cross-Site Request Forgery
- XPlainer – WooCommerce Product FAQ [WooCommerce Accordion FAQ Plugin] <= 1.7.0 - Missing Authorization to Authenticated (Subscriber+) Stored Cross-Site Scripting
- Super Forms <= 6.3.316 - Authenticated (Subscriber+) Arbitrary File Upload via 'extensions' Form Element Attribute
- ePayco plugin for WooCommerce < 8.4.7 - Unauthenticated Unauthorized Order Status Manipulation
- PayPlug for WooCommerce (Official) <= 3.1.0 - Missing Authorization to Unauthenticated Settings Change
- Custom Order Statuses for WooCommerce <= 1.5.2 - Missing Authorization
- LinkWorth plugin <= 3.3.3 - Cross-Site Request Forgery to Plugin Setting Update
- Woo Ukrposhta <= 1.17.11 - Reflected Cross-Site Scripting via order, post, and idd Parameters
- Donation Block For PayPal <= 2.1.0 - Unauthenticated Stored Cross-Site Scripting
- Under Construction <= 3.85 - Authenticated Stored Cross-Site Scripting
- GetGenie <= 4.3.0 - Missing Authorization
- Advanced Page Visit Counter <= 8.0.6 - Authenticated (Administrator+) Stored Cross-Site Scripting
- PDF Smart Viewer for Elementor <= 1.0.4 - Unauthenticated Server-Side Request Forgery
- URL Shortener Plugin For WordPress <= 3.0.7 - Unauthenticated SQL Injection
- Ziina <= 1.2.21 - Missing Authorization
- Gallery PhotoBlocks <= 1.3.1 - Authenticated (Contributor+) Stored Cross-Site Scripting
- Ivory Search <= 5.5.12 - Missing Authorization
- WordPress form builder plugin for contact forms, surveys and quizzes – Tripetto <= 5.1.4 - Unauthenticated Stored Cross-Site Scripting
- wp-championship < 5.9 - SQL Injection