Vulnerability archive: section 1, page 26
Open a report to review affected versions, available fixes and original sources. Each report covers a specific issue; its presence does not establish whether your website is affected.
- FAQ Builder AYS <= 1.3.5 - Blind SQL Injection
- Paid Membership Plugin, Ecommerce, User Registration Form, Login Form, User Profile & Restrict Content – ProfilePress <= 4.15.19 - Authenticated (Admin+) Stored Cross-Site Scripting
- Gutentype | 100% Gutenberg Blog Theme + Elementor <= 2.1.12 - Unauthenticated PHP Object Injection
- Ultimate FAQ Accordion Plugin <= 2.4.7 - Authenticated (Author+) Stored Cross-Site Scripting via FAQ Content
- Tracking Code Manager < 1.11.5 - Denial of Service
- Eduma <= 5.6.4 - Missing Authorization
- Pearl <= 1.3.4 - Cross-Site Request Forgery via stm_save_hb_settings
- Formidable Forms <= 6.28 - Missing Authorization to Unauthenticated Payment Integrity Bypass via PaymentIntent Reuse
- PeproDev Ultimate Profile Solutions 1.9.1 - 7.5.2 - Missing Authorization to Limited Unauthenticated Arbitrary User Meta Update via handel_ajax_req Function
- Post and Page Builder by BoldGrid – Visual Drag and Drop Editor <= 1.26.4 - Authenticated (Contributer+) Stored Cross-Site Scripting
- Lead Capturing Pages <= 2.5 - Authenticated (Subscriber+) SQL Injection
- Javo Core <= 3.0.0.080 - Unauthenticated Privilege Escalation in ajax_signup
- SE HTML5 Album Audio Player <= 1.1.0 - Directory Traversal
- Pocket News Generator <= 0.2.0 - Authenticated (Admin+) Stored Cross-Site Scripting
- WCFM – Frontend Manager for WooCommerce <= 6.7.8 - Authenticated (Shop manager+) Stored Cross-Site Scripting
- WordPress Mega Menu – QuadMenu <= 3.2.0 - Cross-Site Request Forgery to Limited User Meta Update
- Power BI Embedded for WordPress <= 1.1.7 - Authenticated (Contributor+) Stored Cross-Site Scripting
- Easy Contact Form Lite <= 1.1.23 - Authenticated (Contributor+) Stored Cross-Site Scripting
- Corner Ad <= 1.0.56 - Cross-Site Request Forgery
- ShareThis Dashboard for Google Analytics <= 3.1.4 - Missing Authorization
- Counter live visitors for WooCommerce <= 1.3.6 - Unauthenticated Arbitrary File Deletion in wcvisitor_get_block
- Graphina <= 3.0.4 - Missing Authorization
- wpForo Forum <= 3.1.5 - Authenticated (Subscriber+) PHP Object Injection
- Additional Custom Order Status for WooCommerce <= 1.6.0 - Reflected Cross-Site Scripting
- Document Library Lite <= 1.1.7 - Authenticated (Administrator+) Stored Cross-Site Scripting
- Fare Calculator <= 1.1 - Cross-Site Request Forgery to Stored Cross-Site Scripting
- Insert Pages < 3.2.4 - Authenticated Directory Traversal
- Pathfinder <= 1.16 - Unauthenticated Local File Inclusion
- Katerio - Magazine <= 1.5.1 - Unauthenticated Local File Inclusion
- WP Recipe Maker <= 9.1.0 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'group_tag'
- Elementor Addons by Livemesh <= 8.3.1 - Authenticated (Contributor+) Stored Cross-Site Scripting
- Affiliates Manager <= 2.9.53 - Unauthenticated SQL Injection
- Feedzy RSS Feeds Lite <= 5.1.0 - Authenticated (Subscriber+) Server-Side Request Forgery
- Ultimate Form Builder Lite <= 1.3.7 - Cross-Site Scripting
- Colissimo shipping methods for WooCommerce <= 2.9.0 - Unauthenticated Insecure Direct Object Reference
- Forminator <= 1.15.2 - Admin+ Stored Cross-Site Scripting
- GiveWP – Donation Plugin and Fundraising Platform <= 4.16.8.1 - Unauthenticated Payment Bypass
- Fintelligence Calculator <= 1.0.3 - Authenticated (Contributor+) Stored Cross-Site Scripting
- Popup | Custom Popup Builder <= 1.3 - Denial of Service
- Narnoo Operator <= 2.0.0 - Reflected Cross-Site Scripting
- Fontiran <= 2.1 - Missing Authorization via fi_add_rule and fi_delete_webfont_php
- Media Folder <= 1.0.0 - Reflected Cross-Site Scripting
- PDF Invoices & Packing Slips for WooCommerce <= 5.16.1 - Unauthenticated Stored Cross-Site Scripting via Billing First Name / Last Name / Company Fields
- Translate This - Google Translate Web Element Shortcode <= 1.0 - Authenticated (Contributor+) Stored Cross-Site Scripting via base_lang Parameter
- Blue Captcha <= 2.0.1 - Cross-Site Request Forgery via 'blcap_action' Parameter
- Mega Addons For Elementor <= 1.8 - Missing Authorization
- Gutenberg Forms <= 2.2.9 - Unauthenticated Arbitrary File Upload
- URL Image Importer <= 1.0.7 - Authenticated (Author+) Stored Cross-Site Scripting via SVG File Upload
- Youzify <= 1.0.6 - Stored Cross-Site Scripting
- WP-Orphanage Extended <= 1.2 - Cross-Site Request Forgery to Orphan Account Privilege Escalation
- Chatbox Manager <= 1.2.5 - Missing Authorization
- Google Analyticator <= 5.2 - Cross-Site Scripting
- Contact Form Builder by vcita <= 4.10.3 - Cross-Site Request Forgery to Stored Cross-Site Scripting
- Popup Builder <= 3.44 - SQL Injection
- Bulk Me Now! <= 2.0 - Cross-Site Request Forgery to Message Deletion
- Booktics – Appointment Booking Calendar for Service Businesses <= 1.0.28 - Missing Authorization
- Wastia < 1.1.3 - Unauthenticated Arbitrary File Upload
- yolink Search for WordPress < 2.6 - Reflected Cross-Site Scripting
- WPAdverts – Classifieds Plugin <= 2.3.3 - Unauthenticated Stored Cross-Site Scripting
- VdoCipher <= 1.29 - Authenticated (Contributor+) Stored Cross-Site Scripting
- Sailthru Triggermail <= 1.1 - Reflected Cross-Site Scripting
- ABC Crypto Checkout <= 1.8.2 - Unauthenticated Information Exposure
- Premmerce Wishlist for WooCommerce <= 1.1.10 - Missing Authorization to Authenticated (Subscriber+) Arbitrary Wishlist Deletion
- Podcast Channels <= 0.20 - Cross-Site Scripting
- Customer Reviews for WooCommerce <= 5.3.5 - Multiple Unprotected AJAX Actions
- Empty Tags Remover <= 1.0 - Reflected Cross-Site Scripting
- Activity Reactions For Buddypress <= 1.0.22 - Reflected Cross-Site Scripting
- DZS Video Gallery <= 8.60 - Reflected Cross-Site Scripting
- WP User <= 7.0 - Authenticated (Administrator+) Stored Cross-Site Scripting
- Sale with Razorpay <= 1.0 - Reflected Cross-Site Scripting
- Universal Video Player - Addon for WPBakery Page Builder <= 3.2.1 - Reflected Cross-Site Scripting
- ShortCodes UI <= 1.9.8 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode
- ALD Dropping and Fulfillment for AliExpress and WooCommerce <= 1.0.21 - Missing Authorization to Order Information Disclosure
- ModelTheme Addons for WPBakery and Elementor < 1.5.6 - Authenticated (Contributor+) Stored Cross-Site Scripting
- ARMember <= 4.0.5 - Cross-Site Request Forgery
- LiveChat WooCommerce <= 2.2.16 - Cross-Site Request Forgery
- WP Popups <= 2.2.0.5 - Missing Authorization
- Hide WP Toolbar <= 2.7 - Missing Authorization
- Pz-LinkCard <= 2.5.8.1 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode Attributes
- Google Forms < 0.92 - Unauthenticated Server Side Request Forgery
- Ultimate Store Kit Elementor Addons <= 2.9.4 - Missing Authorization
- Google Language Translator <= 6.0.19 - Missing Authorization via admin notifications
- WordPress Core < 5.8.3 - Authenticated (Author+) Stored Cross Site Scripting
- Anti-Malware Security and Brute-Force Firewall <= 4.21.96 - Unauthenticated Remote Code Execution
- Yoast SEO: Local <= 14.8 - Reflected Cross-Site Scripting
- Mocho Blog <= 1.0.4 - Cross-Site Scripting
- JobBoard Job listing <= 1.2.7 - Authenticated (Employer+) Insecure Direct Object Reference
- JetReviews <= 3.0.1 - Unauthenticated Information Exposure
- Print-O-Matic <= 2.0.2 - Admin+ Stored Cross-Site Scripting
- WooCommerce <= 3.6.4 - Cross-Site Request Forgery to Stored Cross-Site Scripting
- CAMOO SMS <= 3.0.1 - Reflected Cross-Site Scripting
- WordPress MU < 2.7 - Cross-Site Scripting
- My Calendar <= 3.7.14 - Insecure Direct Object Reference to Unauthenticated Sensitive Information Disclosure via 'vcal' Parameter
- Z Companion <= 1.1.1 - Authenticated (Author+) Stored Cross-Site Scripting via SVG File Upload
- Category Meta <= 1.2.8 - Cross-Site Request Forgery
- MainWP Child – Securely Connects to the MainWP Dashboard to Manage Multiple Sites <= 6.2.1 - Unauthenticated PHP Object Injection
- Timely All-in-One Events Calendar < 1.10 - Cross-Site Scripting
- Testimonials <= 3.0.1 - Authenticated (Contributor+) Stored Cross-Site Scripting
- Skyword API Plugin <= 2.5.2 - Authenticated (Contributor+) Stored Cross-Site Scripting
- WP AdCenter – Ad Manager & Adsense Ads <= 2.5.6 - Authenticated (Contributor+) Stored Cross-Site Scripting via ad_alignment Attribute