Vulnerability archive: section 2, page 14
Open a report to review affected versions, available fixes and original sources. Each report covers a specific issue; its presence does not establish whether your website is affected.
- Tag Groups <= 2.1.0 - Reflected Cross-Site Scripting
- AskApache Firefox Adsense <= 3.0 - Cross-Site Request Forgery
- Name Directory <= 1.29.0 - Reflected Cross-Site Scripting
- WP Statistics <= 14.15.4 - Unauthenticated Stored Cross-Site Scripting via User-Agent Header
- Simple Vertical Timeline <= 0.1 - Authenticated (Contributor+) Stored Cross-Site Scripting
- WP Quick FrontEnd Editor <= 5.5 - Reflected Cross-Site Scripting
- wp-publications < 1.1 - Local File Inclusion
- Nictitate <= 1.1.4 - Cross-Site Request Forgery
- ACF Photo Gallery Field <= 1.9 - Authenticated (Subscriber+) Arbitrary Usermeta Update
- SMS Alert Order Notifications <= 3.9.0 - Missing Authorization
- Duplicate Page and Post <= 2.7 - Authenticated (Admin+) Stored Cross-Site Scripting
- The Ultimate WordPress Toolkit – WP Extended <= 3.0.14 - Reflected Cross-Site Scripting
- Easy restaurant menu manager <= 2.0.2 - Cross-Site Request Forgery to Menu Upload
- WooCommerce Recover Abandoned Cart <= 24.6.0 - Missing Authorization to Unauthenticated Arbitrary Content Deletion
- Booknetic 4.0 - 4.1.4 - Cross-Site Request Forgery
- Booster for WooCommerce <= 5.4.8 - Reflected Cross-Site Scripting in PDF Invoicing Module
- WPGlobus – Multilingual Everything! <= 1.9.6 - Cross-Site Scripting via wpglobus_option[browser_redirect][redirect_by_language]
- WordPress Core <= 7.1 - Authenticated (Contributor+) Path Traversal via REST Templates Controller
- Copy Or Move Comments <= 5.0.4 - Authenticated (Subscriber+) SQL Injection
- 多说社会化评论框 <= 1.2 - Reflected Cross-Site Scripting
- Court Reservation – Manage Your Court Bookings Online < 1.10.9 - Cross-Site Request Forgery
- Post Status Notifier Lite <= 1.10.0 - Reflected Cross-Site Scripting
- Protected Posts Logout Button <= 1.4.5 - Missing Authorization on pplb_options_save
- WP Links Page <= 4.9.6 - Authenticated (Subscriber+) SQL Injection
- Booking Calendar <= 11.8.4 - Unauthenticated Duplicate Slot Booking
- WP User Profile Avatar <= 1.0.6 - Missing Authorization
- Timeline Widget For Elementor (Elementor Timeline, Vertical & Horizontal Timeline) <= 1.5.3 - Authenticated (Contributor+) Stored Cross-Site Scripting
- Analytify – Google Analytics Dashboard For WordPress (GA4 analytics made easy) <= 5.2.3 - Missing Authorization
- Image&Video FullScreen Background <= 1.6.7 - Authenticated (Contributor+) SQL Injection
- GTranslate Pro and GTranslate Enterprise <= 2.8.64 - Reflected Cross-Site Scripting
- MapSVG < 8.7.4 - Unauthenticated SQL Injection
- MStore API <= 3.9.6 - Cross-Site Request Forgery to Order Title Update
- Optimate Ads – Advance Ad Inserter AdSense & Ad Manager <= 1.0.3 - Authenticated (Subscriber+) Stored Cross-Site Scripting
- Attendance Manager <= 0.5.6 - Stored Cross-Site Scripting
- Easy Appointments <= 3.12.27 - Missing Authorization to Authenticated (Contributor+) Sensitive Customer Information Exposure via ea_get_customers_ajax AJAX Action
- STEdb Forms <= 1.0.4 - Authenticated (Administrator+) SQL Injection
- Authors List <= 2.0.2 - Reflected Cross-Site Scripting via al_id
- TNIT Filter Gallery Plugin <= 0.0.6 - Cross-Site Request Forgery to Cross-Site Scripting
- Wishlist for WooCommerce <= 3.2.2 - Authenticated (Contributor+) Stored Cross-Site Scripting
- Contus Video Comments <= 1.0 - Authorization Bypass
- Redirect Redirection <= 1.1.3 - Missing Authorization in 'LoadTab' function
- Ninja Forms Contact Form <= 3.4.33 - Authenticated SendWP Plugin Installation and Client Secret Key Disclosure
- Bricksforge <= 3.1.8.9 - Unauthenticated Arbitrary File Upload via 'temporaryFileUploads' Parameter
- Post Grid and Gutenberg Blocks <= 2.3.17 - Missing Authorization
- WP Mail Log Plugin <= 1.1.2 - Authenticated(Contributor+) Arbitrary File Upload
- WordPress Core < 4.2.4 - Timing Side-Channel Attack
- WordPress Core < 4.9.1 - Cross-domain Flash injection
- Simple LDAP Login <= 1.6.0 - Reflected Cross-Site Scripting
- Simple Job Board <= 2.10.8 - Missing Authorization to Unauthenticated Information Disclosure
- Media Sync <= 1.4.9 - Authenticated (Author+) Path Traversal via 'sub_dir' and 'media_items' Parameters
- Better Search Replace <= 1.4.4 - Unauthenticated PHP Object Injection
- Taskbuilder – Project Management & Task Management Tool With Kanban Board <= 5.0.7 - Authenticated (Subscriber+) SQL Injection
- WPC Smart Quick View for WooCommerce <= 4.2.5 - Insecure Direct Object Reference to Unauthenticated Private Product Exposure
- Prime Slider <= 4.1.10 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'follow_us_text' Parameter
- BookPress – For Book Authors <= 1.2.7 - Missing Authorization
- Academy LMS – WordPress LMS Plugin for Complete eLearning Solution <= 3.5.0 - Unauthenticated Privilege Escalation via Account Takeover
- FlexTable Google Sheets Connector <= 3.19.1 - Authenticated (Administrator+) Stored Cross-Site Scripting
- Virtue Premium <= 4.10.22 - Authenticated (Contributor+) Stored Cross-Site Scripting
- HUSKY – Products Filter Professional for WooCommerce <= 1.3.7.3 - Authenticated (Subscriber+) Insecure Direct Object Reference via 'woof_add_subscr'
- Penci Bookmark & Follow < 2.4 - Unauthenticated Stored Cross-Site Scripting
- AntiSpam for Contact Form 7 <= 0.6.3 - Cross-Site Request Forgery
- Fast Flow <= 1.2.16 - Reflected Cross-Site Scripting
- Event Registration <= 6.02.02 - PHP Object Injection
- Blogprise <= 1.0.9 - Unauthenticated Local File Inclusion
- Photocrati <= 4.8.0 - Cross-Site Scripting
- Fancy Product Designer | WooCommerce WordPress <= 6.4.8 - Unauthenticated Server-Side Request Forgery via Race Condition
- Anona <= 8.0 - Unauthenticated Arbitrary File Download
- Admin and Site Enhancements (ASE) <= 7.5.1 - Authenticated Stored Cross-Site Scripting via SVG
- FileBird Pro <= 6.5.1 - Missing Authorization
- Mail Baby SMTP <= 2.8 - Cross-Site Request Forgery
- Sermon Manager <= 2.30.0 - Authenticated (Contributor+) Stored Cross-Site Scripting
- TS Poll – Survey, Versus Poll, Image Poll, Video Poll <= 2.5.5 - Authenticated (Editor+) Server-Side Request Forgery
- IndieBlocks <= 0.13.2 - Authenticated (Contributor+) Stored Cross-Site Scripting via kind Parameter
- SmartSMTP <= 1.2.0 - Unauthenticated Stored Cross-Site Scripting
- affiliate-toolkit – WordPress Affiliate Plugin <= 3.4.3 - Reflected Cross-Site Scripting via keyword
- Change Add to Cart Button Text for WooCommerce <= 2.2.2 - Authenticated (Contributor+) Stored Cross-Site Scripting
- Fluent Forms <= 6.0.2 - Authenticated (Contributor+) Stored Cross-Site Scripting
- All in One SEO <= 2.2.5.1 - Information Disclosure
- Tutor LMS – eLearning and online course solution <=1.7.6 - SQL Injection
- ThemeMakers Stripe Checkout <= 1.0.1 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode
- UpdraftPlus <= 1.23.3 - Cross-Site Request Forgery to Cross-Site Scripting via action_authenticate_storage
- Double the Donation <= 2.0.0 - Authenticated (Administrator+) Stored Cross-Site Scripting
- Mailster - Email Newsletter Plugin for WordPress <= 4.1.17 - Authenticated (Editor+) Arbitrary File Upload
- Auto Featured Image <= 1.2 - Authenticated (Contributor+) Arbitrary File Upload
- News Ticker for Elementor <= 2.1.3 - Missing Authorization
- WordPress & WooCommerce Affiliate Program <= 8.4.1 - Authentication Bypass to Account Takeover and Privilege Escalation
- Purchase and Expense Manager <= 1.1.2 - Cross-Site Request Forgery to Arbitrary Purchase Record Deletion
- LTL Freight Quotes – Unishippers Edition <= 2.5.8 - Reflected Cross-Site Scripting
- Elementor Addon Elements <= 1.13.6 - Missing Authorization
- Active Products Tables for WooCommerce <= 1.0.6.2 - Missing Authorization
- Direct Checkout Button for WooCommerce <= 1.0 - Authenticated (Contributor+) Stored Cross-Site Scripting
- WP Spell Check <= 9.12 - Cross-Site Request Forgery
- WP ADA Compliance Check Basic – Most Comprehensive Web Accessibility Solution for WordPress <= 3.1.3 - Cross-Site Request Forgery
- WP Ultimate Tours Builder <= 1.055 - Cross-Site Request Forgery
- WP Directory Kit <= 1.1.9 - Cross-Site Request Forgery to Stored Cross-Site Scripting via wdk_resultitem
- Anima <= <=1.4.1 - Authenticated (Contributor+) Stored Cross-Site Scripting
- Bold Timeline Lite <= 1.1.4 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode
- White Label Branding for Elementor Page Builder <= 1.0.2 - Authenticated (Administrator+) Stored Cross-Site Scripting via plugin settings
- nuajik CDN <= 0.1.0 - Authenticated (Administrator+) Stored Cross-Site Scripting
- Check & Log email <= 1.0.5 - Reflected Cross-Site Scripting