Vulnerability archive: section 2, page 26
Open a report to review affected versions, available fixes and original sources. Each report covers a specific issue; its presence does not establish whether your website is affected.
- Poll, Survey, Questionnaire and Voting system <= 1.7.4 - Authenticated (Administrator+) Cross-Site Scripting
- WP Statistics – Simple, privacy-friendly Google Analytics alternative <= 14.16.11 - Unauthenticated Stored Cross-Site Scripting
- W3 Total Cache <= 2.8.1 Missing Authorization to Unauthenticated Plugin Deactivation and Extensions Activation/Deactivation
- My Calendar <= 3.8.7 - Unauthenticated Privilege Escalation to 'mcs' Parameter via Reflected Shortcode Injection into 'above' Attribute
- MDR Webmaster Tools <= 1.1 - Cross-Site Request Forgery to Stored Cross-Site Scripting
- myCred – Loyalty Points and Rewards plugin for WordPress and WooCommerce – Give Points, Ranks, Badges, Cashback, WooCommerce rewards, and WooCommerce credits for Gamification <= 2.7.3 - Missing Authorization to Unauthenticated Database Upgrade
- DuoGeek Blocks 0.1.1 - Authenticated (Contributor+) Stored Cross-Site Scripting
- Crypto <= 2.19 - Authentication Bypass via register
- WPBot – AI ChatBot for Live Support, Lead Generation, AI Services <= 8.3.7 - Unauthenticated Stored Cross-Site Scripting
- LearnPress – WordPress LMS Plugin <= 4.2.9.3 - Missing Authorization to Unauthenticated Database Table Manipulation
- Job Board Manager <= 2.1.59 - Cross-Site Request Forgery
- OnePress <= 2.3.8 - Authenticated (Author+) Stored Cross-Site Scripting
- Debug Assistant <= 1.4 - Cross-Site Request Forgery via imlt_create_admin
- Cowidgets – Elementor Addons <= 1.1.2 - Authenticated (Contributor+) Stored Cross-Site Scripting via heading_tag Parameter
- Social Share Buttons by Supsystic <= 2.2.3 - Authenticated (Subscriber+) SQL Injection
- WP Meta SEO <= 4.4.8 - Cross-Site Request Forgery to Settings Update
- Barcode Generator for WooCommerce – Show barcodes on products, orders, invoices and other pages <= 2.0.2 - Authenticated (Subscriber+) Sensitive Information Disclosure
- URLYar <= 1.1.0 - Authenticated (Contributor+) Stored Cross-Site Scripting
- Fota WP <= 1.4.1 - Missing Authorization via fotawp_install_and_activate_plugins()
- Calculated Fields Form – AI Form Builder for WordPress – Contact, Payment, Quote, Quiz & More <= 5.5.1.1 - Unauthenticated Stored Cross-Site Scripting
- Countdown Timer for Elementor <= 1.3.6 - Authenticated (Contributor+) Stored Cross-Site Scripting
- WPCafe <= 2.2.31 - Authenticated (Contributor+) Local File Inclusion
- GD Rating System <= 2.3 - Directory Traversal
- LifterLMS <= 9.2.1 - Authenticated (Custom+) SQL Injection via 'order' Parameter
- GN Publisher <= 1.5.5 - Reflected Cross-Site Scripting
- Formcraft3 <= 3.8.27 - Server Side Request Forgery
- IP Blocker Lite <= 11.1.1 - Cross-Site Request Forgery
- BookingPress <= 1.1.25 - Authenticated (Contributor+) Stored Cross-Site Scripting
- Architecturer < 3.9.5 - Reflected Cross-Site Scripting
- Featured Image from URL (FIFU) <= 4.5.3 - Authenticated (Contributor+) Stored Cross-Site Scripting via featured image alt text
- Digital Publications by Supsystic <= 1.7.7 - Missing Authorization
- Popup and Slider Builder by Depicter – Add Email collecting Popup, Popup Modal, Coupon Popup, Image Slider, Carousel Slider, Post Slider Carousel <= 4.0.4 - Missing Authorization to Authenticated (Contributor+) Safe File Type Upload
- Welcart e-Commerce <= 2.11.28 - Missing Authorization
- Master Addons – Free Widgets, Hover Effects, Toggle, Conditions, Animations for Elementor <= 2.0.6.1 - Missing Authorization to Unauthenticated Stored Cross-Site Scripting via Navigation Menu Widget
- Simple Yearly Archive <= 2.2.4 - Authenticated (Contributor+) Stored Cross-Site Scripting
- m2 | Construction and Tools Store <= 1.1.2 - Unauthenticated PHP Object Injection
- WOLF <= 1.0.8 - Unauthenticated Stored Cross-Site Scripting via profile_title
- Multilang Contact Form <= 1.5 - Reflected Cross-Site Scripting
- Image Hover Effects Ultimate <= 9.7.1 - Reflected Cross-Site Scripting
- Groundhogg <= 2.7.11 - Cross-Site Request Forgery
- Easy Appointments <= 3.12.27 - Unauthenticated Insecure Direct Object Reference
- ONLYOFFICE Docs <= 2.0.0 - Authenticated (Contributor+) Stored Cross-Site Scripting
- ThemeREX Addons <= 2.36.1.1 - Unauthenticated PHP Object Injection
- Simple Folio <= 1.1.1 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'Client name' and 'Link' Meta Fields
- Download Monitor <= 2.0.6 - Unauthenticated SQL Injection
- Tatsu <= 3.3.12 - Unauthenticated Remote Code Execution
- 3D FlipBook <= 1.15.4 - Authenticated (Author+) Stored Cross-Site Scritping via Bookmark URL
- WP-Planet <= 0.1 - Reflected Cross-Site Scripting
- Promo <= 1.3.0 - Unauthenticated Local File Inclusion
- Download Manager <= 3.2.48 - Cross-Site Request Forgery
- Hara <= 1.2.17 - Unauthenticated Local File Inclusion
- Booster for WooCommerce <= 7.1.2 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode
- Kento Post View Counter <= 2.8 - Reflected Cross-Site Scripting
- Element Pack Elementor Addons and Templates <= 8.1.5 - Authenticated (Contributor+) Stored Cross-Site Scripting via Open Street Map Widget Marker Content
- GamiPress <= 7.9.9.1 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'gamipress_rank' Shortcode
- Envira Gallery <= 1.16.0 - Authenticated (Author+) Stored Cross-Site Scripting
- TS Webfonts for さくらのレンタルサーバ <= 3.1.1 - Cross-Site Request Forgery
- Custom CSS <= 1.4.0 - Missing Authorization
- Mailchimp for WooCommerce < 6.2 - Authenticated (Administrator+) SQL Injection
- Canto <= 3.1.1 - Missing Authorization to Unauthenticated File Upload
- PhoneTrack Meu Site Manager <= 0.1 - Cross-Site Scripting
- Enable SVG, WebP, and ICO Upload <= 1.1.3 - Authenticated (Author+) Arbitrary File Upload via ICO Upload Bypass
- ProfilePress <= 4.15.14 - Authenticated (Admin+) Stored Cross-Site Scripting via "Labels"
- MemberSpace <= 2.1.13 - Reflected Cross-Site Scripting
- Drag and Drop Multiple File Upload for Contact Form 7 <= 1.3.9.5 - Unauthenticated Arbitrary File Upload
- Note Press <= 0.1.10 - Authenticated (Admin+) SQL Injection via Update
- Form Maker by 10Web – Mobile-Friendly Drag & Drop Contact Form Builder <= 1.15.38 - Unauthenticated SQL Injection
- Contact Form to DB <= 1.7.0 - Multiple Cross-Site Scripting
- Blix <= 0.9.1, Blixed <= 1.0, BlixKrieg <= 2.2 - Reflected Cross-Site Scripting
- Leaflet Maps Marker Pro < 1.5.8 - Path Traversal
- Rife Elementor Extensions & Templates <= 1.1.5 - Authenticated (Contributor+) Stored Cross-Site Scripting
- File Manager <= 2.9 - Reflected Cross-Site Scripting
- Custom Base Terms <= 1.0.2.3 - Authenticated (Administrator+) Stored Cross-Site Scripting via 'base'
- CTHthemes CityBook <= 2.3.3, TownHub <= 1.0.5, and EasyBook <= 1.2.1 - Stored Cross-Site Scripting
- CleanSkin <= 1.5.0 - Unauthenticated PHP Object Injection
- ProfileGrid <= 5.0.0.0 - Missing Authorization
- Full Screen (Page) Background Image Slideshow <= 1.1 Authenticated (Administrator+) Stored Cross-Site Scripting
- AI ChatBot with ChatGPT and Content Generator by AYS <= 2.7.0 - Unauthenticated Server-Side Request Forgery via 'pinecone_url' Parameter
- Embed PDF for WPForms <= 1.1.5 - Authenticated (Subscriber+) Arbitrary File Upload
- Grand Restaurant <= 7.0.10 - Unauthenticated PHP Object Injection
- Ketchup Restaurant Reservations <= 1.0.0 - Unauthenticated Stored Cross-Site Scripting
- Custom Coming Soon <= 2.2 - Reflected Cross-Site Scripting
- Winger <= 1.0.16 - Unauthenticated Local File Inclusion
- Coming Soon – Under Construction <= 1.2.0 - Authenticated (Administrator+) Stored Cross-Site Scripting
- BlogVault WordPress Backup Plugin 1.40 - 1.44 - Unauthenticated PHP Object Injection
- Picture Gallery <= 1.5.11 - Authenticated (Author+) Stored Cross-Site Scripting
- Developer Loggers for Simple History <= 0.5 - Authenticated (Admin+) Local File Inclusion
- Fluent Booking – The Ultimate Appointments Scheduling, Events Booking, Events Calendar Solution <= 1.9.11 - Authenticated (Subscriber+) Missing Authorization to Calendar Import and Management
- Maya Business <= 1.2.0 - Unauthenticated Insecure Direct Object Reference
- GiveWP <= 2.25.2 - Cross-Site Request Forgery via give_ajax_delete_payment_note
- Auto Hide Admin Bar <= 1.6.1 - Authenticated (Admin+) Stored Cross-Site Scripting
- Chartify – WordPress Chart Plugin <= 3.5.9 - Missing Authentication for Administrative Function
- Shop as a Customer for WooCommerce <= 1.2.3 - Authenticated (Shop Manager+) Privilege Escalation
- Payment Gateway bKash for WC <= 3.1.0 - Missing Authorization
- Universal Video Player - Addon for WPBakery Page Builder <= 3.2.1 - Reflected Cross-Site Scripting
- String Locator <= 2.5.0 - Cross-Site Request Forgery to PHAR Deserialization
- BookingPress – Appointments Booking Calendar Plugin and Online Scheduling Plugin <= 1.0.13 - SQL Injection
- JobSearch <= 2.5.9 - Unauthenticated PHP Object Injection
- AI Engine <= 3.8.0 - Unauthenticated Stored Cross-Site Scripting via 'model_' Parameter → PHP Error-Log Injection → Advisor Indirect Prompt Injection
- Tidekey <= 1.1 - Reflected Cross-Site Scripting