Vulnerability archive: section 1, page 3
Open a report to review affected versions, available fixes and original sources. Each report covers a specific issue; its presence does not establish whether your website is affected.
- CMP <= 3.8.1 - Missing Authorization
- Post Snippets <= 4.0.2 - Authenticated (Administrator+) Stored Cross-Site Scripting via 'snippet_content'
- LadiApp: Landing Page, PopupX, Marketing Automation, Affiliate Marketing… <= 4.4 - Missing Authorization on publish_lp()
- 10WebMapBuilder <= 1.0.71 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode
- YITH WooCommerce Product Add-Ons <= 4.3.0 - Authenticated(Shop Manager+) PHP Object Injection
- WordPress OpenID Connect Client <= 2.1.7 - Authentication Bypass
- Redirects <= 1.2.1 - Missing Authorization
- Bitcoin Payments <= 1.4.2 - Authenticated (Contributor+) Stored Cross-Site Scripting
- Bricksable for Bricks Builder <= 1.6.83 - Authenticated (Author+) Stored Cross-Site Scripting
- GLB <= 1.2.2 - Missing Authorization
- Draft List <= 2.6.3 - Authenticated (Author+) Stored Cross-Site Scripting via Draft Post Title
- 3xSocializer <= 0.98.22 - Authenticated SQL Injection
- Medicare <= 2.1.0 - Unauthenticated PHP Object Injection
- uDesign | Multipurpose WordPress Theme <= 4.15.0 - Authenticated (Subscriber+) SQL Injection
- Exchange Addon Membership < 1.3.0 - Reflected Cross-Site Scripting
- Button Widget Smartsoft <= 1.0.1 - Cross-Site Request Forgery to Cross-Site Scripting
- User Meta – User Profile Builder and User management plugin <= 3.1.1 - Insecure Direct Object Reference to Sensitive Information Exposure
- BackWPup – WordPress Backup & Restore Plugin 5.2.2 - 5.7.4 - Missing Authorization
- Free Gifts for WooCommerce <= 13.1.0 - Unauthenticated Stored Cross-Site Scripting
- Membership Plugin – Restrict Content <= 3.2.15 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcodes
- Post to CSV by BestWebSoft < 1.3.1 - Reflected Cross-Site Scripting
- Ultimate Faqs <= 1.8.21 - Cross-Site Scripting
- CubeWP Forms – All-in-One Form Builder <= 1.1.1 - Unauthenticated Stored Cross-Site Scripting
- Multivendor Marketplace Solution for WooCommerce – WC Marketplace <= 3.8.11.8 - Reflected Cross-Site Scripting
- Htaccess File Editor <= 1.0.19 - Unauthenticated Information Exposure
- Action Network <= 1.4.4 - Reflected Cross-Site Scripting
- rtMedia for WordPress, BuddyPress and bbPress WordPress <= 4.6.15 - Authenticated (Admin+) Arbitrary File Upload
- Farm Agrico <= 1.3.11 - Unauthenticated Local File Inclusion
- Compress <= 7.10.3 - Reflected Cross-Site Scripting
- Ultimate Product Catalog <= 4.2.21 - Authorization Bypass and Cross-Site Request Forgery
- Pods 2.4.4.1 - 2.7.26 - Authenticated Stored Cross-Site Scripting
- Popup Box <= 4.7.7 - Authenticated (Administrator+) Stored Cross-Site Scripting
- Easy Guide <= 1.0.0 - Unauthenticated SQL Injection
- Final User <= 1.2.5 - Missing Authorization
- WatchTowerHQ <= 3.6.15 - Unauthenticated Arbitrary File Deletion
- ComboBlocks <= 2.2.86 - Authenticated (Contributor+) Stored Cross-Site Scripting
- Social Media Share Buttons <= 2.1.0 - Authenticated (Subscriber+) PHP Object Injection
- JoomSport – for Sports: Team & League, Football, Hockey & more <= 5.1.7 - Object Injection
- WP Travel <= 9.3.1 - Authenticated (Administrator+) Stored Cross-Site Scripting
- User Frontend: AI Powered Frontend Posting, User Directory, Profile, Membership & User Registration <= 4.2.8 - Missing Authorization to Unauthenticated Arbitrary Post Modification via 'post_id' Parameter
- Arkhe Blocks <= 2.27.0 - Authenticated (Contributor+) Stored Cross-Site Scripting via block attributes
- HTML2WP <= 1.0.0 - Arbitrary File Upload
- Eventin – Event Calendar, Tickets, Registration, Booking & WooCommerce < 4.1.20 - Unauthenticated User Account Creation
- Elementor Website Builder Pro <= 3.20.1 - Authententicated (Contributor+) Stored Cross-Site Scripting
- Barcode Scanner with Inventory & Order Manager <= 1.9.0 - Authenticated (Admin+) Arbitrary File Download
- Booking Package <= 1.5.28 - Unauthenticated Sensitive Data Disclosure
- Advanced Database Cleaner – Premium <= 4.1.0 - Authenticated (Subscriber+) Local File Inclusion via 'template'
- UnGallery < 2.1.6 - Command Injection
- Bg Book Publisher <= 1.25 - Authenticated (Contributor+) Stored Cross-Site Scripting
- LearnPress <= 4.1.4.1 - Arbitrary Image Renaming
- CTT Expresso para WooCommerce <= 3.2.12 - Information Exposure via Unprotected Directory
- WooODT Lite <= 2.4.6 - Missing Authorization to Arbitrary Options Update
- Disqus Conditional Load <= 11.1.0 - Authenticated (Administrator+) Stored Cross-Site Scripting via plugin settings.
- JCH Optimize <= 4.0.0 - Missing Authorization to Authenticated (Subscriber+) Settings Modification
- Frontend Admin by DynamiApps <= 3.29.10 - Missing Authorization
- Database Backup and check Tables Automated With Scheduler 2024 <= 2.35 - Authenticated (Administrator+) Sensitive Information Exposure
- FoxyPress <= 0.4.2.1 - Arbitrary File Upload
- Genemy - Creative Minimal Landing Page Builder for Digital Startup Design Studio Agency in Marketing <= 1.6.6 - Missing Authorization
- GravityForms <= 2.9.1.3 - Unauthenticated Stored Cross-Site Scripting via 'alt' parameter
- Lightbox & Modal Popup WordPress Plugin – FooBox <= 2.7.34 - Authenticated (Author+) Stored Cross-Site Scripting
- Cab fare calculator <= 1.1.6 - Authenticated (Admin+) Stored Cross-Site Scripting
- Peter's Date Countdown <= 2.0.0 - Reflected Cross-Site Scripting via $_SERVER['PHP_SELF']
- Printcart Web to Print Product Designer for WooCommerce <= 2.8.5 - Unauthenticated Arbitrary File Read via 'folder' and 'mockups' Parameters
- Show Me The Cookies <= 1.0 - Unauthenticated Arbitrary Shortcode Execution
- Simple Locator <= 2.0.4 - Reflected Cross-Site Scripting
- HTML5 Maps <= 1.7.1.4 - Cross-Site Request Forgery
- MonsterInsights – Google Analytics Dashboard for WordPress <= 7.1 - Stored Cross-Site Scripting
- WP-Stats < 2.52 - Cross-Site Request Forgery
- WP Mail SMTP by WPForms <= 1.3.3 - Unspecified Cross-Site Scripting
- WP Colorful Tag Cloud <= 2.0.1 - Reflected Cross-Site Scripting
- Notibar <= 2.1.4 - Missing Authorization via ajax_install_plugin
- Wbcom Designs - Custom Font Uploader <= 2.3.4 - Missing Authorization to Font Deletion
- WP Job Portal <= 2.1.3 - Authenticated (Admin+) Stored Cross-Site Scripting
- Social Slider Feed <= 2.2.2 - Missing Authorization
- Booster for WooCommerce – PDF Invoices, Abandoned Cart, Variation Swatches & 100+ Tools <= 8.0.1 - Authenticated (Customer+) Arbitrary File Upload
- Analytics Stats Counter Statistics <= 1.2.2.5 - Unauthenticated PHP Object Injection
- Houzez Property Feed <= 2.5.4 - Unauthenticated Arbitrary File Download
- ShopLentor <= 3.3.2 - Unauthenticated Email Relay Abuse via 'woolentor_suggest_price_action' AJAX Action
- Embed Bokun <= 0.23 - Authenticated (Contributor+) Stored Cross-Site Scripting via align Parameter
- Shariff Wrapper <= 4.6.9 - Authenticated(Contributor+) Stored Cross-Site Scripting via Shortcode
- Swatchly – Product Variation Swatches for WooCommerce <= 1.4.13 - Unauthenticated Stored Cross-Site Scripting
- WP Simple Sitemap <= 0.2 - Cross-Site Request Forgery to Stored Cross-Site Scripting
- Horsemanager <= 1.3 - Authenticated (Contributor+) SQL Injection
- Distance Rate Shipping For WooCommerce <= 1.3.4 - Authenticated (Subscriber+) SQL Injection
- Masteriyo LMS <= 2.3.0 - Missing Authorization to Unauthenticated User Session Termination
- WooCommerce Product Add-ons <= 6.1.3 - Authenticated (Shop Manager+) PHP Object Injection
- Code Explorer <= 1.4.5 - Authenticated (Admin+) External File Reading
- Shopo <= 1.1.4 - Authenticated (Contributor+) Arbitrary File Upload
- WP Affiliate Platform < 6.5.1 - Reflected Cross-Site Scripting via Banner Editing
- WordPress Core < 2.5.1 - Authentication Bypass
- Easy Digital Downloads – Simple Shipping <= 2.1.3 - Cross-Site Scripting
- WordPress Core < 5.2.4 - Server Side Request Forgery
- OnionBuzz Plugin < 1.2.7 - SQL Injection
- Plugin Name: Device Theme Switcher <= 3.0.2 - Cross-Site Request Forgery
- GiveWP – Donation Plugin and Fundraising Platform <= 3.16.1 - Unauthenticated PHP Object Injection
- My Sticky Bar <= 2.8.6 - Unauthenticated SQL Injection via 'stickymenu_contact_lead_form' Action
- Kadence Starter Templates — Predesigned Website Templates <= 2.3.3 - Unauthenticated Denial of Service
- MyCryptoCheckout – Bitcoin, Ethereum, and 100+ altcoins for WooCommerce <= 2.161 - Missing Authorization
- WordPress Download Manager <= 2.7.2 - Authenticated Arbitrary Options Update
- SendGrid for WordPress <= 1.4 - Missing Authorization