Vulnerability archive: section 2, page 4
Open a report to review affected versions, available fixes and original sources. Each report covers a specific issue; its presence does not establish whether your website is affected.
- Flickr set slideshows <= 0.9 - Authenticated (Contributor+) SQL Injection
- Meta Tag Manager <= 3.1 - Missing Authorization
- FAQ Builder AYS 1.6.3 - 1.8.4 - Unauthenticated Stored Cross-Site Scripting
- Post SMTP <= 2.1.6 - Authenticated (Administrator+) Blind Server-Side Request Forgery
- Event Tickets and Registration < 5.29.0.1 - Missing Authorization
- Author Showcase <= 1.4.3 - Reflected Cross-Site Scripting
- Event Calendar <= 1.1.50 - Subscriber+ Event Creation
- Tickera <= 3.5.5.6 - Cross-Site Request Forgery
- URL Shortify <= 1.12.3 - Authenticated (Author+) Server-Side Request Forgery
- Schema Pro <= 2.7.7 - Cross-Site Request Forgery
- Product Enquiry for WooCommerce <= 3.1.7 - Authenticated (Admin+) Stored Cross-Site Scripting
- Woocommerce Social Media Share Buttons <= 1.3.0 - Cross-Site Request Forgery to Cross-Site Scripting
- Hello Plus <= 1.7.7 - Authenticated (Contributor+) Missing Authorization to Template Activation via hello_plus_set_as_entire_site
- User Meta Manager Plugin < 3.4.7 - Privilege Escalation
- Genemy - Creative Minimal Landing Page Builder for Digital Startup Design Studio Agency in Marketing <= 1.6.6 - Authenticated (Subscriber+) Privilege Escalation
- BlockArt Blocks – Gutenberg Blocks, Page Builder Blocks ,WordPress Block Plugin, Sections & Template Library <= 2.2.13 - Authenticated (Contributor+) Stored Cross-Site Scripting via `timestamp` Attribute
- Alone <= 7.8.2 - Unauthenticated Remote Code Execution
- WP Abstracts <= 2.6.5 - Authenticated (Administrator+) Stored Cross-Site Scripting
- Premium Addons for Elementor <= 4.10.28 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'arrow_style'
- VM Backups <= 1.0 - Cross-Site Request Forgery to Cross-Site Scripting
- 3D FlipBook – PDF Flipbook Viewer, Flipbook Image Gallery <= 1.16.16 - Unauthenticated Sensitive Information Exposure
- ActiveHelper LiveHelp Live Chat < 3.1.5 - Reflected Cross-Site Scripting
- WP Rentals <= 3.16.1 - Authenticated (Contributor+) Stored Cross-Site Scripting
- CM Download Manager < 2.9.1 - Cross-Site Request Forgery via editHeader
- AJAX Random Post <= 2.0.0 - Reflected Cross-Site Scripting
- Contact Form 7 Redirect & Thank You Page <= 1.0.7 - Reflected Cross-Site Scripting
- NS Simple Intro Loader <= 2.2.3 - Reflected Cross-Site Scripting
- WordPress PayPal Donation <= 1.01 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'amount' Shortcode Attribute
- Simple Giveaways <= 2.46.0 - Missing Authorization via AJAX actions
- Booking Ultra Pro <= 1.1.8 - Unauthenticated Stored Cross-Site Scripting
- Return Refund and Exchange For WooCommerce <= 4.5.5 - Insecure Direct Object Reference to Authenticated (Subscriber+) Refund Request Cancellation
- Smart Online Order for Clover <= 1.5.7 - Reflected Cross-Site Scripting
- Download Manager <= 3.2.84 - Missing Authorization
- Customizr <= 4.4.21 - Cross-Site Request Forgery to Notice Dismissal
- Members Import <= 1.4.2 - Self Cross-Site Scripting
- Maintenance Switch <= 1.5.2 - Cross-Site Request Forgery via 'admin_action_request'
- mTouch Quiz < 3.0.7 - Cross-Site Scripting
- Market < 5.1.27 - Reflected Cross-Site Scripting
- Autoptimize <= 2.8.3 - Stored Cross-Site Scripting
- Smoothscroller <= 1.0.0 - Authenticated (Administrator+) Stored Cross-Site Scripting
- Gmedia Photo Gallery <= 1.24.1 - Cross-Site Request Forgery
- Photo Gallery by 10Web <= 1.8.42 - Reflected Cross-Site Scripting via 'title' Parameter
- LearnPress <= 4.2.5.7 - Unauthenticated SQL Injection via order_by
- Royal Elementor Addons and Templates <= 1.3.971 - Authenticated (Contributor+) Stored Cross-Site Scripting via Advanced Accordion Title Tags
- Photo Gallery by 10Web <= 1.8.30 - Authenticated (Administrator+) Stored Cross-Site Scripting
- If-So Dynamic Content Personalization <= 1.9.3.1 - Authenticated (Contributor+) Stored Cross-Site Scripting
- Neo | Barber Shop WordPress <= 3.5 - Authenticated (Subscriber+) PHP Object Injection
- Video List Manager <= 1.7 - Missing Authorization
- FlowForms <= 1.1.1 - Authenticated (Contributor+) Insecure Direct Object Reference to Arbitrary Form Modification via REST API '/flowforms/v1/forms/{id}' Endpoints
- GDPR CCPA Compliance Support <= 2.3 - PHP Object Injection
- Charitable <= 1.8.12.1 - Authenticated (Contributor+) SQL Injection via 'order' Shortcode Attribute
- Já-Já Pagamentos for WooCommerce <= 1.3.0 - Reflected Cross-Site Scripting
- Notices <= 6.1 - Reflected Cross-Site Scripting
- Appointment Booking Calendar <= 1.3.95 - Missing Authorization
- Guten Post Layout – An Advanced Post Grid Collection for WordPress Gutenberg <= 1.2.4 - Authenticated (Contributor+) Stored Cross-Site Scripting via align Attribute
- Carousel Ultimate <= 1.8 - Authenticated (Contributor+) Stored Cross-Site Scripting
- Maxi Blocks <= 2.1.8 - Missing Authorization to Authenticated (Author+) Media File Deletion via 'old_media_src' Parameter
- BerqWP <= 2.2.42 - Unauthenticated Arbitrary File Upload
- Download Counter <= 1.3 - Authenticated (Contributor+) Stored Cross-Site Scripting via name Parameter
- Advance Post Prefix <= 1.1.1 - Reflected Cross-Site Scripting
- WooCommerce Predictive Search <= 6.0.1 - Reflected Cross-Site Scripting
- Easy Code Placement <= 18.11 - Reflected Cross-Site Scripting
- WP Voting Contest <= 5.8 - Authenticated (Editor+) Stored Cross-Site Scripting
- Image Gallery - Responsive Photo Gallery < 2.0.6 - Authenticated Stored Cross-Site Scripting
- Ninja Forms <= 3.14.9 - Unauthenticated Arbitrary Shortcode Execution
- My Sticky Elements <= 2.3.3 - Missing Authorization to Authenticated (Subscriber+) Arbitrary Bulk Lead Deletion
- Video Downloader for TikTok < 1.4 - Directory Traversal
- Web Directory Free <= 1.7.13 - Unauthenticated SQL Injection
- AI Hub - Startup & Technology WordPress Theme <= 1.3.10 - Authenticated (Subscriber+) Arbitrary File Dowload
- Tutor LMS <= 3.9.5 - Authenticated (Subscriber+) Information Disclosure in Coupon Details via 'tutor_coupon_details' AJAX Action
- WooCommerce PDF Invoices, Packing Slips, Delivery Notes and Shipping Labels <= 4.3.0 - Missing Authorization to Order Export
- Icegram Engage <= 3.1.31 - Authenticated (Administrator+) Stored Cross-Site Scripting
- Universal Video Player <= 1.4.0 - Reflected Cross-Site Scripting
- Import WP – Export and Import CSV and XML files to WordPress <= 2.13.0 - Authenticated (Admin+) Server-Side Request Forgery
- Bloom Email Opt-In < 1.1.1 - Sensitive Information Disclosure
- ProductDyno <= 1.0.24 - Reflected Cross-Site Scripting
- Dynamic Pricing With Discount Rules for WooCommerce <= 4.5.8 - Authenticated (Shop manager+) SQL Injection
- Beaver Builder – WordPress Page Builder <= 2.9.4 - Authenticated (Contributor+) Sensitive Information Exposure
- Wp Social Login and Register Social Counter <= 3.0.0 - Missing Authorization to Unauthenticated Social Login/Share Status Update
- Search Exclude <= 2.4.9 - Missing Authorization to Unauthenticated Plugin Settings Modification
- WPC Shop as a Customer for WooCommerce <= 1.2.8 - Authentication Bypass Due to Insufficiently Unique Key
- WP Job Portal <= 2.2.6 - Missing Authorization to Unauthenticated Arbitrary Email Sending
- MPCX Lightbox 1.2.2 - 1.2.5 - Unauthenticated Information Exposure
- JM Twitter Cards < 6.2 - Full Path Disclosure
- CiyaShop - Multipurpose WooCommerce Theme <= 4.19.0 - Unauthenticated PHP Object Injection
- User Activity Log Pro <= 2.3.4 - Missing Authorization
- Institutions Directory <= 1.3..4 - Missing Authorization
- Fluent Forms <= 6.2.14 - Reflected Cross-Site Scripting via '{get.*}' Editor SmartCode Parameter
- Passster <= 4.2.25 - Missing Authorization
- Logo Showcase Ultimate – Logo Carousel, Logo Slider & Logo Grid <= 1.4.1 - Authenticated (Author+) Stored Cross-Site Scripting via SVG File Upload
- Same Category Posts <= 1.1.19 - Authenticated (Author+) Stored Cross-Site Scripting via Widget Title Placeholder
- Anti-Malware Security and Brute-Force Firewall <= 4.15.22 - Cross-Site Scripting
- Brisk (Unknown Versions) - Cross-Site Scripting
- TrueBooker <= 1.2.2 - Unauthenticated SQL Injection
- Powie's pLinks PagePeeker <= 1.0.2 - Authenticated (Contributor+) Stored Cross-Site Scripting
- Shop Products Filter <= 1.2 - Authenticated (Subscriber+) Local File Inclusion
- Share-one-Drive <= 1.15.2 - Reflected Cross-Site Scripting
- WP Smart Import : Import any XML File to WordPress <= 1.1.2 - Reflected Cross-Site Scripting
- PublishPress Revisions: Duplicate Posts, Submit, Approve and Schedule Content Changes <= 3.5.14 - Reflected Cross-Site Scripting
- Recipe Card Blocks for Gutenberg & Elementor <= 3.3.1 - Missing Authorization