Vulnerability archive: section 2, page 3
Open a report to review affected versions, available fixes and original sources. Each report covers a specific issue; its presence does not establish whether your website is affected.
- Simple Baseball Scoreboard <= 1.3 - Authenticated (Contributor+) Stored Cross-Site Scripting
- W3 Total Cache <= 2.8.1 Information Exposure via Log Files
- WP Lightbox 2 <= 3.0.6.7 - Unauthenticated Stored Cross-Site Scripting
- 百度站长SEO合集(支持百度/神马/Bing/头条推送) <= 2.1.4 - Missing Authorization
- PrivateContent - Mail Actions <= 2.3.2 - Unauthenticated Local File Inclusion
- XootiX Framework <= Various Plugin Versions - Missing Authorization to Arbitrary Options Update
- Metaphor Widgets <= 2.4 - Authenticated (Contributor+) Stored Cross-Site Scripting
- Simple Ajax Chat <= 20220115 - Unauthenticated Stored Cross-Site Scripting
- 123ContactForm for WordPress <= 1.5.6 - Arbitrary File Upload
- Gallery : FooGallery <= 3.3.2 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'custom_settings' Shortcode Attribute
- WordPress Core < 2.0.3 - Remote Code Execution
- Online Booking & Scheduling Calendar for WordPress by vcita <= 4.2.10 - Missing Authorization to Account Logout
- Don't Break The Code <= .3.1 - Reflected Cross-Site Scripting
- GiveWP <= 2.33.1 - Missing Authorization via handleBeforeGateway
- Serious Slider <= 1.2.4 - Cross-Site Request Forgery
- WooCommerce Warranty Requests <= 2.1.9 - Missing Authorization
- ImageRecycle pdf & image compression <= 3.1.14 - Cross-Site Request in Several AJAX Actions
- Vasaio QR Code <= 1.2.5 - Cross-Site Request Forgery to Stored Cross-Site Scripting
- Church Admin <= 3.7.56 - Server-Side Request Forgery via church_admin_import_csv
- Otter Blocks – Gutenberg Blocks, Page Builder for Gutenberg Editor & FSE <= 2.6.8 - Authenticated (Contributor+) Stored Cross-Site Scripting via Block Attributes
- Blocksy <= 2.0.22 - Cross-Site Request Forgery
- Profile Builder – User Profile & User Registration Forms <= 3.6.4 - Cross-Site Request Forgery
- Popup Maker <= 1.17.1 - Missing Authorization via save_popup_enabled_state
- WordPress Social Login and Register (Discord, Google, Twitter, LinkedIn) <= 7.6.4 - Authentication Bypass
- Credova_Financial <= 1.4.8 - Sensitive Information Disclosure
- SocialDriver < 2024 - Prototype Pollution
- WPLMS < 1.9.9.5.3 - Authenticated (Subscriber+) Arbitrary File Upload
- WP Cookie Consent ( for GDPR, CCPA & ePrivacy ) <= 3.2.0 - Unauthenticated Stored Cross-Site Scripting via Client-IP header
- Member Approval <= 131109 - Cross-Site Scripting
- Booking Calendar Contact Form <= 1.2.63 - Authenticated (Subscriber+) Insecure Direct Object Reference to Calendar Takeover
- MailerLite – Signup forms (official) <= 1.5.7 - Cross-Site Request Forgery
- Simple Alert Boxes <= 1.4.0 - Authenticated (Contributor+) Stored Cross-Site Scripting via Alert Shortcode
- Work & Travel Company <= 1.2 - Unauthenticated PHP Object Injection
- MapPress Maps for WordPress <= 2.97.3 - Unauthenticated Stored Cross-Site Scripting
- WooCommerce <= 6.5.1 - Authenticated (Admin+) HTML Injection
- WP Dynamic Keywords Injector <= 2.3.15 - Cross-Site Request Forgery
- RegistrationMagic – Custom Registration Forms, User Registration, Payment, and User Login <= 6.0.6.2 - Authenticated (Administrator+) SQL Injection
- Guest posting / Frontend Posting / Front Editor – WP Front User Submit <= 5.0.0 - Missing Authorization to Unauthenticated Media Deletion
- Divi Form Builder <= 5.1.8 - Unauthenticated Arbitrary File Upload Leading to Remote Code Execution via 'acceptFileTypes' Parameter
- WP Event Manager <= 3.1.41 - Authenticated (Editor+) Stored Cross-Site Scripting
- WP Reactions Lite <= 1.3.8 - Cross-Site Request Forgery via AJAX action
- WpEvently <= 5.0.4 - Missing Authorization
- All Bootstrap Blocks <= 1.3.19 - Authenticated (Contributor+) Local File Inclusion
- WordPress Core < 5.2.4 - Authenticated Stored Cross-Site Scripting via Customizer
- Paid Membership Plugin, Ecommerce, User Registration Form, Login Form, User Profile & Restrict Content – ProfilePress < 4.17.1 - Unauthenticated Arbitrary Shortcode Execution
- Themeflection Numbers <= 1.8.1 - Authenticated(Subscriber+) Privilege Escalation via tf_numb_save_licenses
- Funnelforms Free <= 3.4 - Missing Authorization to Category Deletion
- Smart Slider 3 <= 3.5.1.38 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'data-href' Attribute in Custom HTML Block
- The Post Grid <= 7.7.4 - Missing Authorization via REST API
- 워드프레스 결제 심플페이 – 우커머스 결제 플러그인 <= 5.1.4 - Authenticated (Contributor+) Stored Cross-Site Scripting pafw_instant_payment Shortcode
- LearnDash LMS <= 4.10.1 - Sensitive Information Exposure via API
- Admin Pack by SITE CASEIRO <= 1.1 - Authenticated (Admin+) Stored Cross-Site Scripting
- CartFlows – Funnel Builder & Checkout Plugin for WooCommerce <= 3.2.0 - Authenticated (Contributor+) Remote Code Execution
- Watcher for Elementor <= 1.0.9 - Missing Authorization
- Ultimate Member – User Profile, Registration, Login, Member Directory, Content Restriction & Membership Plugin <= 2.10.1 - Unauthenticated Blind SQL Injection
- Digiseller <= 1.3 - Authenticated (Contributor+) Stored Cross-Site Scripting
- EventPrime – Modern Events Calendar, Bookings and Tickets <= 3.3.2 - Authenticated(Contributor+) Stored Cross-Site Scripting via Shortcode
- Geopost <= 1.2 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode
- WP Ultimate Exporter <= 2.4.1 - Unauthenticated Information Disclosure
- WooCommerce <= 4.0.4 - Unauthorized Post Meta Creation/Modification
- Responsivity <= 0.0.6 - Reflected Cross-Site Scripting
- Shield Security <= 21.0.8 - Unauthenticated Reflected Cross-Site Scripting via 'message' Parameter
- WP Elegant Testimonial <= 1.1.6 - Cross-Site Scripting
- Aalto <= 1.8 - Authenticated (Contributor+) Local File Inclusion
- Ebook Store <= 5.8012 - Unauthenticated Arbitrary File Upload
- Campaign Monitor Forms <= 2.5.5 - Missing Authorization to Authenticated(Subscriber+) Options Update via ajax_dismiss_notice
- JetTabs <= 2.2.12 - Missing Authorization
- Litho <= 3.0 - Unauthenticated Arbitrary File Deletion
- Easy Digital Downloads - Quota < 1.2.5 - Cross-Site Scripting
- ConvertPlug <= 3.4.2 - Unauthenticated Administrator Creation
- FormBuilder <= 0.90 - Unauthenticated Stored Cross-Site Scripting
- User Roles and Capabilities <= 1.2.6 - Missing Authorization
- LazyLoad Plugin <= 2.4.0 - Unauthenticated Stored Cross-Site Scripting via Comment Content
- Ofiz - WordPress Business Consulting Theme <= 2.0 - Reflected Cross-Site Scripting
- SurveyJS: Drag & Drop WordPress Form Builder to create, style and embed multiple forms of any complexity <= 2.5.2 - Cross-Site Request Forgery to Survey Cloning
- GEO my WordPress <= 4.5.0.3 - Reflected Cross-Site Scripting
- Twitter Feeds <= 1.0.0 - Authenticated (Contributor+) Cross-Site Scripting via 'tweet_title' Shortcode Attribute
- Word Replacer Pro <= 1.0 - Missing Authorization to Unauthenticated Arbitrary Content Update
- JetFormBuilder <= 3.5.6.2 - Unauthenticated Arbitrary File Read via Media Field
- SurfLink < 2.6.0 - Missing Authorization to Authenticated (Subscriber+) 410 Gone URL Import via 'surfl_import_410' AJAX Action
- Explicit (All Versions) - Cross-Site Scripting
- Visual Art | Gallery WordPress Theme <= 2.4 - Authenticated (Subscriber+) PHP Object Injection
- WP Reset <= 2.05 - Unauthenticated Sensitive Information Exposure via wf-licensing.log
- Floating Chat Widget <= 3.1.8 - Authenticated (Editor+) Stored Cross-Site Scripting
- WordPress Core < 4.7.3 - Bypass URL Validation
- Woocommerce Vietnam Checkout <= 2.0.5 - Unauthenticated Stored Cross-Site Scripting
- Dating <= 11.2.0 - Cross-Site Request Forgery
- Event Manager <= 7.0.3 - Reflected Cross-Site Scripting via `calendar_header` Parameter
- Restaurant Menu and Food Ordering <= 2.4.0 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode
- Multiplayer Games <= 3.7 - Reflected Cross-Site Scripting
- Theme and plugin translation for Polylang <= 3.2.16 - Missing Authorization
- PayPal Pay Now, Buy Now, Donation and Cart Buttons Shortcode <= 1.7 - Authenticated (Contributor+) Stored Cross-Site Scripting
- Unseen Blog <= 1.0.0 - Authenticated (Contributor+) PHP Object Injection
- Eazy Under Construction <= 1.0 - Reflected Cross-Site Scripting
- Paid Membership Plugin, Ecommerce, User Registration Form, Login Form, User Profile & Restrict Content <= 4.17.4 - Reflected Cross-Site Scripting via ppress_billing_address Filename Parameter
- ShareThis <= 7.0.5 - Cross-Site Request Forgery
- Click to Chat – WP Support All-in-One Floating Widget <= 2.3.4 - Authenticated (Contributor+) Stored Cross-Site Scripting
- WooCommerce Google Feed Manager <= 2.8.0 - Missing Authorization to Authenticated (Contributor+) Arbitrary File Deletion
- Listing, Classified Ads & Business Directory – uListing <= 2.0.5 - Cross-Site Request Forgery
- EventPrime <= 3.3.2 - Improper Server-Side Checks to Booking Payment Bypass