Vulnerability archive: section 1, page 21
Open a report to review affected versions, available fixes and original sources. Each report covers a specific issue; its presence does not establish whether your website is affected.
- WordPress Core < 5.2.4 - Type Confusion
- Wicked Folders <= 2.18.16 - Missing Authorization on ajax_save_folder_order
- File Manager Pro – Filester <= 1.8.6 - Missing Authorization to Authenticated (Subscriber+) Filebird Plugin Installation
- Iptanus File Upload <= 5.1.6 - Unauthenticated Race Condition to File Overwrite
- Branda <= 3.4.14 - IP Address Spoofing
- Stream <= 4.0.2 - Authenticated (Admin+) Server-Side Request Forgery
- WordPress支付宝Alipay|财付通Tenpay|贝宝PayPal集成插件 <= 3.7.2 - Authenticated (Admin+) SQL Injection
- SpeedyCache <= 1.1.8 - Cross-Site Request Forgery
- GiveWP 2.4.0 - 2.9.7 - Reflected Cross Site Scripting
- Elemenda <= 0.0.2 - Authenticated (Author+) Stored Cross-Site Scripting via SVG File Upload
- MStore API <= 3.9.7 - Unauthenticated SQL Injection
- Len Slider <= 2.0.11 - Cross-Site Request Forgery to Reflected Cross-Site Scripting
- WP Directory Kit <= 1.5.4 - Unauthenticated SQL Injection
- WPGlobus – Multilingual Everything! <= 1.9.6 - Cross-Site Request Forgery
- Forminator Plugin <= 1.5.3.1 - SQL Injection
- WP Customer Area <= 8.3.5 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'type' Shortcode Attribute
- Canto Testimonials <= 1.0 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'fx' Shortcode Attribute
- AI Engine – The Chatbot, AI Framework & MCP for WordPress 3.4.0 - 3.7.1 - Missing Authorization to Unauthenticated Arbitrary AI Query Execution
- Aparat Video Shortcode <= 0.2.4 - Authenticated (Contributor+) Stored Cross-Site Scripting
- Multivendor Marketplace Solution for WooCommerce <= 3.7.3 - Insecure Direct Object Reference
- Pojo Forms <= 1.4.7 - Authenticated (Subscriber+) Arbitrary Shortcode Execution via form_preview_shortcode
- Cart66 Lite - WordPress Ecommerce < 1.5.4 - Directory Traversal to Arbitrary File Disclosure
- Redirection for Contact Form 7 <= 3.2.4 - Unauthenticated PHP Object Injection
- APA Register Newsletter Form <= 1.0.0 - Cross-Site Request Forgery to SQL Injection
- Exhibit to WP Gallery <= 0.0.2 - Reflected Cross-Site Scripting
- WPBITS Addons For Elementor Page Builder <= 1.4 - Authenticated (Contributor+) Stored Cross-Site Scripting
- Relevanssi < 4.26.0 (Free) < 2.29.0 (Premium) - Authenticated (Contributor+) SQL Injection
- GA4WP: Google Analytics for WordPress <= 2.10.0 - Missing Authorization
- User Feedback <= 1.10.1 - Authenticated (Editor+) SQL Injection
- WooCommerce Digital Content Delivery (incl. DRM) – FlickRocket <= 4.75 - Reflected Cross-Site Scripting
- Google AdSense for Responsive Design – GARD <= 2.23 - Authenticated (Administrator+) Stored Cross-Site Scripting
- Loginizer <= 1.3.5 - Cross-Site Request Forgery
- Restrictions for BuddyPress <= 1.5.2 - Missing Authorization to Unauthenticated Tracking Status Update
- MasterStudy LMS WordPress Plugin – for Online Courses and Education < 3.7.43 - Unauthenticated Open Redirect
- Simple Mail Address Encoder < 1.7 - Reflected Cross-Site Scripting
- HDW WordPress Video Gallery <= 1.2 - Reflected Cross-Site Scripting via playlist parameter
- Martins Free Monetized Ad Exchange Network <= 1.0.5 - Cross-Site Request Forgery to Stored Cross-Site Scripting
- Freesoul Deactivate Plugins <= 1.9.4.0 - Information Disclosure
- Cargus <= 1.5.8 - Unauthenticated Information Exposure
- WordPress Leads < 1.6.3 - Authorization Bypass
- WP-Recall <= 16.26.11 - Authenticated (Admin+) Stored Cross-Site Scripting
- Syncee for Suppliers <= 1.0.5 - Missing Authorization to Sensitive Information Disclosure
- Recently <= 3.0.4 - Arbitrary File Upload to Remote Code Exectution
- BuddyHolis TableSearch <= 1.1.0 - Authenticated (Contributor+) Stored Cross-Site Scripting
- SureDash <= 1.12.0 - Authenticated (Subscriber+) Stored Cross-Site Scripting via 'display_name' Parameter
- The Events Calendar <= 6.17.4 - Unauthenticated PHP Object Injection to Remote Code Execution
- Social Share Buttons for WordPress <= 2.7 - Authenticated (Admin+) Stored Cross-Site Scripting
- Barcode Scanner (+Mobile App) – Inventory manager, Order fulfillment system, POS (Point of Sale) <= 1.13.1 - Missing Authorization
- LaunchPage.app Importer <= 1.1 - Unauthenticated SQL Injection
- DT Chocolate (All Versions) - Cross-Site Scripting
- Paid Membership Subscriptions – Effortless Memberships, Recurring Payments & Content Restriction <= 2.13.7 - Authentication Bypass via pms_payment_id
- Message ticker <= 9.3 - Authenticated (Administrator+) Stored Cross-Site Scripting
- Avada <= 7.11.10 - Cross-Site Request Forgery
- Ditty <= 3.1.35 - Authenticated (Author+) Stored Cross-Site Scripting
- Countdown and CountUp, WooCommerce Sales Timer <= 1.8.2 - Authenticated (Administrator+) Stored Cross-Site Scripting via plugin settings
- Bit Form <= 3.1.0 - Unauthenticated Stored Cross-Site Scripting
- Custom Word Cloud <= 0.3 - Authenticated (Contributor+) Stored Cross-Site Scripting via angle Parameter
- Tourfic <= 3.0.1 - Authenticated (Subscriber+) Stored Cross-Site Scripting via Comment Content via unfiltered_html Grant to Customer Role
- Link Invoice Payment for WooCommerce <= 2.8.0 - Missing Authorization to Unauthenticated Arbitrary Partial Payment Creation/Cancellation
- Zoho SalesIQ <= 1.0.8 - Cross-Site Request Forgery
- One to one user Chat by WPGuppy <= 1.1.4 - Unauthenticated Information Disclosure via Chat Message Interception
- VikBooking Hotel Booking Engine & PMS <= 1.8.15 - Unauthenticated Stored Cross-Site Scripting via 'attachments[name]' Parameter
- Social Slider Widget <= 1.8.4 - Reflected Cross-Site Scripting
- Lenxel WP <= 1.0.31 - Unauthenticated Privilege Escalation via Account Takeover
- CoverManager <= 0.0.1 - Authenticated (Contributor+) Stored Cross-Site Scripting
- Advanced CF7 DB <= 2.0.9 - Cross-Site Request Forgery to Form Entry Deletion
- Electric Studio Client Login <= 0.8.1 - Authenticated (Administrator+) Stored Cross-Site Scripting
- Ninja Tables <= 5.0.5 - Missing Authorization
- WP Event Manager <= 3.1.42 - Cross-Site Scripting
- OSS Aliyun <= 1.4.10 - Authenticated (Administrator+) SQL Injection
- Vimeo <= 1.2.2 - Authenticated (Subscriber+) Information Exposure
- Draft List <= 2.6.2 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'display_name' Parameter
- Fidalgo <= 1.2.2 - Unauthenticated PHP Object Injection
- EventPrime – Events Calendar, Bookings and Tickets <= 4.2.6.0 - Missing Authorization
- Events Addon for Elementor <= 2.2.3 - Authenticated (Contributor+) Post Disclosure
- Keep Backup Daily <= 2.1.0 - Authenticated (Admin+) Arbitrary File Download
- Ultimate Image Hover Effects <= 1.1.2 - Authenticated (Contributor+) Stored Cross-Site Scripting
- Sticky Button – Click to Chat <= 1.0 - Unauthenticated Stored Cross-Site Scripting
- Paid Memberships Pro – Content Restriction, User Registration, & Paid Subscriptions <= 3.8.1 - Authenticated (Subscriber+) Stored Cross-Site Scripting
- WPCS – WordPress Currency Switcher Professional <= 1.2.0.4 - Unauthenticated Arbitrary Shortcode Execution
- Golo Framework < 1.7.5 - Unauthenticated Local File Inclusion
- Blocksy Companion Pro <= 2.1.37 - Authenticated (Contributor+) Remote Code Execution
- MCKinney's Politics <= 1.2.8 - Unauthenticated Local File Inclusion
- Campress <= 1.35 - Unauthenticated Local File Inclusion
- FAQ Builder AYS <= 1.7.3 - Authenticated (Administrator+) Stored Cross-Site Scripting
- Turisbook Booking System <= 1.3.7 - Authenticated (Contributor+) Stored Cross-Site Scripting
- Welcart e-Commerce <= 1.3.12 - Cross-Site Scripting
- Album Reviewer <= 2.0.2 - Unauthenticated Stored Cross-Site Scripting
- Ninja Tables – Easy Data Table Builder <= 5.2.5 - Authenticated (Contributor+) Information Exposure
- Integration for ActiveCampaign and Contact Form 7, WPForms, Elementor, Ninja Forms <= 1.1.1 - Unauthenticated PHP Object Injection
- Pods – Custom Content Types and Fields 3.3 - 3.3.9.1 - Authenticated (Author+) Arbitrary File Read
- Schedula <= 1.0 - Missing Authorization
- PeproDev Ultimate Invoice <= 2.0.9 - Insecure Direct Object Reference to Unauthenticated Order Information Exposure
- Better Find and Replace <= 1.7.7 - Missing Authorization
- Kata Plus – Addons for Elementor – Widgets, Extensions and Templates <= 1.4.7 - Authenticated (Author+) Stored Cross-Site Scripting via SVG File Upload
- Ultimate Gift Cards for WooCommerce <= 3.0.6 - Missing Authorization to Infinite Money Glitch
- Estatebud – Properties & Listings <= 5.5.0 - Cross-Site Request Forgery to Settings Update
- json5 <= 1.0.1 and 2.0.0-2.2.1 - Prototype Pollution
- WP Employee Attendance System <= 3.5 - Authenticated (Administrator+) SQL Injection
- Robokassa payment gateway for Woocommerce <= 1.8.9 - Missing Authorization