Vulnerability archive: section 2, page 25
Open a report to review affected versions, available fixes and original sources. Each report covers a specific issue; its presence does not establish whether your website is affected.
- Chinchilla <= 1.16 - Unauthenticated Local File Inclusion
- FireStorm Professional Real Estate Plugin <= 2.06.03 - SQL Injections
- BulletProof Security <= 5.7 - Admin+ Stored Cross-Site Scripting
- Amelia <= 1.0.98 - Missing Authorization
- WordPress Poll Maker Plugin <= 5.4.6 - Authenticated (Administrator+) Time-Based SQL Injection
- Strong Testimonials <= 3.1.12 - Authenticated(Contributor+) Improper Authorization to Views Modification
- PayU India <= 3.8.8 - Reflected Cross-Site Scripting via type
- Truemag (Unknown Versions) - Reflected Cross-Site Scripting
- Vireo <= 1.0.24 - Missing Authorization
- Wordfence <= 5.2.2 - Stored Cross-Site Scripting
- MStore API <= 4.10.7 - Unauthorized Account Access and Privilege Escalation
- Elementor Addons, Widgets and Enhancements – Stax <= 1.4.3 - Cross-Site Request Forgery via toggle_widget
- LearnDash LMS <= 5.0.3 - Authenticated (Contributor+) SQL Injection via 'filters[orderby_order]' Parameter
- RegistrationMagic Plugin <= 5.2.4.5 - Authenticated(Administrator+) SQL Injection
- Event Manager, Events Calendar, Tickets, Registrations – Eventin <= 4.0.24 - Missing Authorization to Unauthenticated Payment Status Update
- TH Side Cart and Menu Cart for Woocommerce <= 1.1.1 - Cross-Site Request Forgery
- Quick Restaurant Menu <= 2.0.2 - Missing Authorization
- Social Media Share Buttons | MashShare < 2.3.1 - Information Disclosure
- GW AI Website Builder <= 1.0.1 - Missing Authorization to Authenticated (Subscriber+) Arbitrary Plugin Settings Deletion
- Ecwid by Lightspeed Ecommerce Shopping Cart < 7.0.9 - Missing Authorization
- XStore <= 9.6.4 - Authenticated (Contributor+) Stored Cross-Site Scripting
- wordpress publish post email notification <= 1.0.2.2 - Authenticated (Administrator+) Stored Cross-Site Scripting
- Barcode Scanner with Inventory & Order Manager <= 1.5.1 - Unauthenticated SQL Injection via userToken
- Decon WP SMS <= 1.1 - Authenticated (Administrator+) Stored Cross-Site Scripting via plugin settings
- cSlider <= 2.4.2 - Cross-Site Request Forgery
- Responsive Menu <= 4.0.3 - Cross-Site Request Forgery to Setting Modification
- Greenshift – animation and page builder blocks <= 12.8.3 - Unauthenticated Sensitive Information Exposure via Settings Backup
- WP SpaceContent <= 0.4.5 - Cross-Site Request Forgery to Stored Cross-Site Scripting
- Content Protector (Passster) <= 4.3.6 - Authenticated (Contributor+) Sensitive Information Exposure
- WPCargo Track & Trace <= 8.0.1 - Missing authorization to Authenticated (Subscriber+) Settings Update
- Uix Shortcodes <= 2.0.3 - Unauthenticated Arbitrary Shortcode Execution
- Appointment Buddy Widget <= 1.2 - Reflected Cross-Site Scripting
- Xenon - Bootstrap Admin Theme with AngularJS <= 1.3 - Reflected Cross-Site Scripting
- Portfolio Plugin <= 2.04 - Cross-Site Request Forgery
- Paid Membership Subscriptions – Effortless Memberships, Recurring Payments & Content Restriction <= 2.11.1 - Missing Authorization via creating_pricing_table_page
- WP Data Access – App Builder for Tables, Forms, Dashboards, Charts & Maps <= 5.5.82 - Unauthenticated SQL Injection
- RSS Feed Widget <= 3.0.0 - Reflected Cross-Site Scripting via $_SERVER['REQUEST_URI']
- vooPlayer v4 <= 4.0.4 - Reflected Cross-Site Scripting
- Quiz And Survey Master <= 7.1.18 - Cross-Site Scripting
- Vulnerability: SMTP for Amazon SES <= 1.8 - Unauthenticated Stored Cross-Site Scripting via Email Logs
- Download Attachments <= 1.2.24 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode
- zStore Manager Basic <= 3.311 - Missing Authorization to Authenticated (Subscriber+) Cache Clearing
- Mang Board WP <= 1.8.4 - Reflected Cross-Site Scripting
- Backup Migration <= 2.0.0 - Missing Authorization to Unauthenticated Backup Upload to Offline Storage
- Gutenberg Forms <= 2.2.8.3 - Authenticated(Subscriber+) Sensitive Information Disclosure
- Jannah - Newspaper Magazine News BuddyPress AMP < 5.4.4 - Reflected Cross-Site Scripting
- Survey Maker < 1.5.6 - Authenticated SQL Injection
- Martfury - Marketplace Mobile App Figma Template <= 3.3.9 - Reflected Cross-Site Scripting
- Hash Form – Drag & Drop Form Builder <= 1.1.0 - Unauthenticated PHP Object Injection
- Product Designer <= 1.0.33 - Missing Authorization to Unauthenticated Arbitrary Attachment Deletion
- Advanced XML Reader Plugin <= 0.3.4 - XML External Entity Injection
- Perfect Pullquotes <= 1.7.5 - Authenticated (Contributor+) Stored Cross-Site Scripting
- Zoho Forms <= 4.0 - Authenticated (Contributor+) Stored Cross-Site Scripting
- Hide My WP Ghost – Security & Firewall <= 5.2.01 - Login Page Disclosure
- Request a Quote Form Plugin <= 2.5.5 - Unauthenticated Code Injection via 'path' Parameter
- eCommerce Product Catalog <= 3.6.0 - Authenticated (Custom Role+) PHP Object Injection
- Adifier (Premium Theme) < 3.1.4 - Reflected Cross-Site Scripting
- Social Auto Poster <= 5.3.14 - Authenticated (Subscriber+) Stored Cross-Site Scripting
- 无觅相关文章插件 <= 1.0.5.7 - Cross-Site Request Forgery to Stored Cross-Site Scripting
- WPSite Shortcode <= 1.2 - Authenticated (Contributor+) Stored Cross-Site Scripting
- Beaver Builder – WordPress Page Builder <= 2.5.5.2 - Authenticated Stored Cross-Site Scripting via Caption - On Hover
- Survey Maker < 3.1.2 - Authenticated (Subscriber+) SQL Injection
- Import CSV or XML Datafeed With Ease <= 3.7.2 - Cross-Site Request Forgery
- Spider Elements – Addons for Elementor <= 1.6.5 - Authenticated (Contributor+) Stored Cross-Site Scripting
- Edifice <= 1.8 - Unauthenticated Local File Inclusion
- WP LESS to CSS <= 1.0 - Authenticated (Admin+) Stored Cross-Site Scripting
- Kirki <= 6.2.0 - Unauthenticated Stored Cross-Site Scripting via 'comment' Parameter
- DentiCare < 1.4.3 - Unauthenticated PHP Object Injection
- Appointment Booking and Online Scheduling <= 4.4.2 - Missing Authorization to Unauthenticated Stored Cross-Site Scripting
- FastDup – Fastest WordPress Migration & Duplicator <= 2.7.1 - Missing Authorization to Authenticated (Contributor+) Backup Creation and Download
- Continuous Image Carousel With Lightbox <= 1.0.15 - Reflected Cross-Site Scripting via search_term, order_by and order_pos
- WP Fastest Cache – WordPress Cache Plugin 0.8.7.7 - 1.5.0 - Unauthenticated Cache Poisoning
- Easy Gallery <= 1.4 - Reflected Cross-Site Scripting
- Email Subscription Popup <= 1.2.22 - Authenticated (Contributor+) Stored Cross-Site Scripting via print_email_subscribe_form Shortcode
- MF Plus WPML <= 1.1 - Missing Authorization to Unauthenticated Settings Update
- Spectra – WordPress Gutenberg Blocks <= 1.14.7 - Missing Authorization
- Search Atlas SEO – Premier SEO Plugin for One-Click WP Publishing & Integrated AI Optimization <= 2.6.6 - Reflected Cross-Site Scripting
- ND Shortcodes <= 6.5 - Authenticated (Contributor+) Stored Cross-Site Scripting
- Customer Reviews for WooCommerce <= 5.15.0 - Authenticated (Subscriber+) Local File Inclusion
- Shareaholic <= 9.7.8 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode
- JetWidgets For Elementor <= 1.0.21 - Authenticated (Author+) Stored Cross-Site Scripting via Animated Box 'animation_effect' Setting
- EZ SQL Reports Shortcode Widget and DB Backup 4.11.13 - 5.25.08 - Cross-Site Request Forgery to Remote Code Execution
- Call Now Button <= 1.5.4 - Authenticated (Subscriber+) Missing Authorization to Multiple Functions
- WooCommerce Multilingual & Multicurrency <= 5.3.6 - Missing Authorization
- Zagg - Electronics & Accessories WooCommerce WordPress Theme <= 1.4.1 - Unauthenticated Local File Inclusion
- Wishlist <= 2.1.0 - Authenticated (Subscriber+) Information Exposure
- DX Delete Attached Media <= 2.0.5.1 - Cross-Site Request Forgery via add_to_base
- Giveaways and Contests by RafflePress <= 1.11.2 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode
- Contact Form by Supsystic <= 1.7.28 - Authenticated (Admin+) Remote Code Execution
- Berger <= 1.1.1 - Unauthenticated Local File Inclusion
- WCFM – Frontend Manager for WooCommerce <= 6.7.27 - Missing Authorization to Unauthenticated Arbitrary Inquiry Reply Injection via wcfm-my-account-enquiry-manage Controller
- Payment Gateway for PayPal on WooCommerce < 9.2.1 - Unauthenticated Payment Bypass
- Favicon by RealFaviconGenerator <= 1.3.22 - Reflected Cross-Site Scripting
- CO2ok: carbon offsetting for e-commerce <= 1.0.9.21 - Cross-Site Scripting
- We’re Open! <= 1.45 - Cross-Site Request Forgery
- rtMedia for WordPress, BuddyPress and bbPress <= 4.6.14 - Missing Authorization to Settings Update
- Kirki – Freeform Page Builder, Website Builder & Customizer <= 6.0.11 - Authenticated (Subscriber+) Server-Side Request Forgery
- Google XML Sitemaps <= 4.1.22 - Missing Authorization
- Bold Page Builder <= 5.9.6 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode
- Image Widget <= 4.4.11 - Authenticated (Author+) Stored Cross-Site Scripting