Vulnerability archive: section 2, page 6
Open a report to review affected versions, available fixes and original sources. Each report covers a specific issue; its presence does not establish whether your website is affected.
- Chartjs <= 2023.2 - Authenticated(Editor+) Stored Cross-Site Scripting via chart
- Open RDW kenteken voertuiginformatie <= 2.0.14 - Reflected Cross-Site Scripting via open_data_rdw_kenteken
- Paid Memberships Pro - Courses for Membership Add On <= 1.2.3 - Missing Authorization to Authenticated (Subscriber+) Course Modifications
- AppExperts <= 1.4.5 - Authenticated (Subscriber+) SQL Injection
- How to Create an App for Android iPhone Easytouch <= 3.0 - Missing Authorization
- Custom CSS, JS & PHP <= 2.3.0 - Reflected Cross-Site Scripting
- Limit Login Attempts Plus <= 1.1.0 - IP Address Spoofing to Protection Mechanism Bypass
- Multimedia Playlist Slider Addon for WPBakery Page Builder <= 2.1 - Reflected Cross-Site Scripting
- IP Based Login <= 2.4.0 - Authenticated (Admin+) Stored Cross-Site Scripting
- Highlighting Code Block <= 2.2.0 - Authenticated (Administrator+) Stored Cross-Site Scripting via 'font_family' Setting
- WP Mailster <= 1.8.16.0 - Missing Authorization
- WooCommerce Affiliate Plugin – Coupon Affiliates < 4.11.3.4 - Cross-Site Request Forgery
- bib2html <= 0.9.3 - Cross-Site Scripting
- Mediamatic – Media Library Folders <= 2.8.1 - Cross-Site Request Forgery
- BuddyPress WooCommerce My Account Integration. Create WooCommerce Member Pages <= 3.4.24 - Missing Authorization to Authenticated (Subscriber+) Limited Settings Update
- Nioland <= 1.2.6 - Reflected Cross-Site Scripting via s
- Popup Maker <= 1.20.4 - Authenticated (Contributor+) Stored Cross-Site Scripting via popupID Parameter
- video carousel slider with lightbox <= 1.0.6 - Authenticated (Admin+) SQL Injection
- Search & Replace <= 3.2.2 - Unauthenticated PHP Object Injection
- Bold Timeline Lite <= 1.2.8 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode Attributes
- Powie's Uptime Robot <= 0.9.7 - Authenticated (Administrator+) Stored Cross-Site Scripting
- Mindmeister Shortcode <= 1.0 - Authenticated (Contributor+) Stored Cross-Site Scripting
- Acunetix WP Security <= 4.0.4 - Cross-Site Request Forgery
- MoveMe <= 1.2.15 - Unauthenticated Local File Inclusion
- WP Site Protect <= 1.0 - Cross-Site Scripting
- Image Gallery <= 1.0.0 - Reflected Cross-Site Scripting
- WP YouTube Lyte <= 1.7.29 - Authenticated (Contributor+) Stored Cross-Site Scripting via lyte Shortcode
- WordPress Core < 4.2.1 - Cross-Site Scripting via Comments
- Flexi – Guest Submit <= 4.28 - Unauthenticated Local File Inclusion
- Primary Addon for Elementor <= 1.5.5 - Authenticated (Contributor+) Stored Cross-Site Scripting via Pricing Table Widget
- WooCommerce Easy Duplicate Product <= 0.3.0.7 - Missing Authorization via wedp_duplicate_product_action
- Love Travel 2.0 - 3.7 - Reflected Cross-Site Scripting
- BookingPress < 1.0.11 - SQL Injection
- Custom Fields for WooCommerce <= 1.5.0 - Unauthenticated Arbitrary File Deletion
- Pearl <= 1.3.9 - Cross-Site Request Forgery
- New User Approve <= 3.2.0 - Missing Authorization
- WP ERP <= 1.12.9 - Authenticated (Accounting Manager+) SQL Injection via id
- Laposta Signup Embed <= 1.1.0 - Cross-Site Request Forgery
- GDPR Cookie Compliance <= 4.12.4 - Cross-Site Request Forgery to License Modification
- Hunk Companion <= 1.8.5 - Missing Authorization to Unauthenticated Arbitrary Plugin Installation/Activation
- W3 Total Cache <= 0.9.4.1 - Arbitrary Code Execution via settings import
- Maspik – Spam blacklist <= 0.10.3 - Bypass
- Essential Blocks – Page Builder Gutenberg Blocks, Patterns & Templates <= 4.5.1 - Authenticated (Contributor+) Stored Cross-Site Scripting
- Survey Maker – Best WordPress Survey Plugin <= 3.1.1 - Authenticated (Admin+) Stored Cross-Site Scripting
- Power Zoomer <= 1.2 - Arbitrary File Upload
- Simple Fixed Notice <= 1.6 - Cross-Site Request Forgery
- Age Verification & Identity Verification by Token of Trust <= 3.32.3 - Unauthenticated Stored Cross-Site Scripting via 'description' Parameter
- WoodMart <= 7.2.4 - Reflected Cross-Site Scripting
- iGMS Direct Booking <= 1.3 - Missing Authorization
- Simplify Contact Management: WP Easy Contact <= 4.0.0 - Authenticated (Contributor+) Stored Cross-Site Scripting
- Simple Download Monitor <= 3.8.8 - SQL Injection
- FW Food Menu <= 6.0.0 - Unauthenticated Arbitrary File Upload
- Forminator Forms – Contact Form, Payment Form & Custom Form Builder <= 1.34.0 - Reflected Cross-Site Scripting
- WP Job Portal <= 2.3.2 - Unauthenticated SQL Injection
- 10Web Booster – Website speed optimization, Cache & Page Speed optimizer <= 2.33.4 - Unauthenticated Stored Cross-Site Scripting
- NOTICE BOARD <= 1.1 - Authenticated (Contributor+) Stored Cross-Site Scripting
- WP Lightbox 2 < 3.0.7 - Authenticated (Administrator+) Stored Cross-Site Scripting
- IDB Ecommerce (wpStoreCart 5) < 2.5.30 - Arbitrary File Upload
- MW WP Form <= 5.1.3 - Authenticated (Editor+) Stored Cross-Site Scripting via 'memo' Parameter
- Charitable – Donation & Fundraising Platform (Donation Forms, Recurring Donations & Fundraising Campaigns) <= 1.8.11.3 - Missing Authorization
- Vigilant <= 2.10.2 - Unauthenticated Stored Cross-Site Scripting
- RestroPress <= 3.2.8.6 - Authenticated (Contributor+) Stored Cross-Site Scripting
- Font <= 7.5 - Path Traversal
- Bold Page Builder <= 5.3.5 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'data-text' Parameter
- Ninja Forms – The Contact Form Builder That Grows With You <= 3.12.0 - Cross-Site Request Forgery to Limited File Deletion
- RealHomes <= 4.3.7 - Missing Authorization
- SAML SP Single Sign On <= 5.0.4 - Missing Authorization to notice dismissal
- Welcart e-Commerce <= 2.11.31 - Unauthenticated Stored Cross-Site Scripting
- Abandoned Cart Lite for WooCommerce <= 5.16.0 - Improper Authorization via wcal_delete_expired_used_coupon_code
- LabtechCO <= 8.3 - Authenticated (Contributor+) Local File Inclusion
- Code Snippets CPT <= 2.1.0 - Authenticated (Subscriber+) Arbitrary Shortcode Execution
- List Site Contributors <= 1.1.8 - Reflected Cross-Site Scripting via alpha
- HT Mega – Absolute Addons For Elementor <= 2.4.9 - Authenticated (Contributor+) Stored Cross-Site Scripting via Countdown Widget
- Core Control <= 1.2.1 - Cross-Site Request Forgery
- Live News <= 1.06 - Cross-Site Request Forgery
- GetContentFromURL <= 1.0 - Authenticated (Contributor+) Server-Side Request Forgery via 'url' Shortcode Attribute
- GS Insever Portfolio <= 1.4.4 - Cross-Site Request Forgery
- Ketchup Shortcodes <= 0.1.2 - Authenticated (Contributor+) Stored Cross-Site Scripting
- New User Approve <= 3.2.8 - Missing Authorization
- Clockstone <= 1.2 - Arbitrary File Upload
- Astro Booking Engine <= 1.4.0 - Cross-Site Request Forgery to Settings Reset
- Mooberry Book Manager <= 4.15.12 - Unauthenticated Information Exposure via Export Files
- Ninja Forms – The Contact Form Builder That Grows With You <= 3.8.0 - Authenticated (Admin+) Stored Cross-Site Scripting
- MasterStudy LMS 3.5.29 - 3.7.49 - Authenticated (Contributor+) Local File Inclusion
- WPLMS <= 1.9.9 - Missing Authorization to Authenticated (Subscriber+) Arbitrary Options Update
- Basel <= 5.9.1 - Missing Authorization
- Asgaros Forum <= 3.1.0 - Unauthenticated SQL Injection
- Custom Contact Forms <= 7.16 - Missing Authorization to Authenticated (Contributor+) Arbitrary Post Deletion and Post Meta Modification via Nested 'fields[].ID' / 'choices[].ID' Parameters
- FOMO Pay Chinese Payment Solution <= 2.0.4 - Reflected Cross-Site Scripting
- Ni WooCommerce Cost Of Goods <= 3.2.8 - Missing Authorization
- Omnipress <= 1.4.3 - Authenticated (Contributor+) Stored Cross-Site Scripting
- KiviCare <= 4.5.1 - Authenticated (Doctor+) SQL Injection via 'searchTerm' Parameter
- BetterDocs <= 4.8.1 - Authenticated (Contributor+) Stored Cross-Site Scripting via Heading 'id' Attribute in Post Content
- Slider by Supsystic <= 1.8.10 - Authenticated (Administrator+) Stored Cross-Site Scripting
- Easy Forms for Mailchimp <= 6.8.5 - Reflected Cross-Site Scripting
- WooCommerce Manager – Customize and Control Cart page, Add to Cart button, Checkout fields easily <= 1.2.4.5 - Missing Authorization
- WP Child Theme Generator <= 1.1.2 - Authenticated (Administrator+) Arbitrary File Upload
- OSM - OpenStreetMap <= 6.0 - Cross-Site Request Forgery
- CF7 Submissions <= 0.26 - Missing Authorization
- ID Arrays <= 2.1.2 - Reflected Cross-Site Scripting