Vulnerability archive: section 3, page 12
Open a report to review affected versions, available fixes and original sources. Each report covers a specific issue; its presence does not establish whether your website is affected.
- WP Photo Album Plus < 5.0.3 - Cross-Site Scripting
- AdRotate – Ad manager & AdSense Ads <= 5.2 - Authenticated SQL Injection
- WP Social AutoConnect <= 4.6.2 - Cross-Site Request Forgery to Reflected Cross-Site Scripting
- WP Directory Kit < 1.5.7 - Unauthenticated Information Exposure
- Ultimate Member <= 1.3.75 - Missing Authorization to Password Reset
- Stream <= 3.9.1 - Missing Authorization to Sensitive Information Disclosure
- MaxGalleria <= 6.2.5 - Stored Cross-Site Scripting
- The Conference <= 1.2.0 - Cross-Site Request Forgery to Notice Dismissal
- Everest Forms Pro <= 1.9.12 - Unauthenticated Stored Cross-Site Scripting
- Recently <= 1.1 - Unauthenticated PHP Object Injection
- LearnDash 3.0.0-3.1.1 - Reflected Cross Site Scripting issue on the [ld_profile] search field
- Script Compressor <= 1.7.1 - Cross-Site Request Forgery to Stored Cross-Site Scripting
- Watermark RELOADED <= 1.3.5 - Cross-Site Request Forgery via optionsPage
- Theme Blvd Responsive Google Maps <= 1.0.2 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcodes
- WP-CommentNavi <= 1.12.1 - Authenticated (Admin+) Stored Cross-Site Scripting
- affiliate-toolkit – Multi-Network Affiliate & Amazon Product Display <= 3.9.1 - Authenticated (Administrator+) SQL Injection
- IMS Countdown <= 1.3.5 - Authenticated (Contributor+) Stored Cross-Site Scripting
- Yext <= 1.1.3 - Missing Authorization
- Pay With Stripe <= 1.2.1 - Authenticated (Contributor+) Stored Cross-Site Scripting
- Pinterest RSS Widget <= 2.3.1 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode
- WP Photo Album Plus <= 8.8.02.002 - Authenticated (Subscriber+) Stored Cross-Site Scripting
- YARPP – Yet Another Related Posts Plugin < 4.2.5 - Cross-Site Request Forgery
- Drag and Drop File Upload for Elementor Forms <= 1.6.0 - Unauthenticated Arbitrary File Upload via 'type' Parameter
- Build App Online <= 1.0.23 - Missing Authorization to Arbitrary Post Author Modification via 'build-app-online-update-vendor-product' AJAX Action
- AI Content Generator Marketing <= 1.0.0 - Unauthenticated Privilege Escalation
- Flixita <= 1.0.82 - Reflected Cross-Site Scripting via id Parameter
- Aspose Importer & Exporter (Discontinued) < 3.0 - Arbitrary File Download
- Beaver Builder – WordPress Page Builder <= 2.8.0.5 - Authenticated (Contributor+) Stored Cross-Site Scripting via Button
- Schema & Structured Data for WP & AMP <= 1.67 - Unauthenticated Stored Cross-Site Scripting via 'saswp_review_text' Parameter
- MemberSonic Lite Membership Site Plugin <= 1.2 - Authentication Bypass
- Trusona for WordPress <= 2.0.0 - Missing Authorization
- Styler for Ninja Forms <= 3.3.4 - Authenticated (Subscriber+) Arbitrary Option Deletion via deactivate_license
- Bello - Directory & Listing <= 1.5.9 - Unauthenticated SQL Injection
- Adminer <= 1.4.5 - Security Bypass to Database Login
- Ad Inserter <= 2.8.18 - Authenticated (Subscriber+) Sensitive Information Disclosure in 'ai-debug-processing-fe' & 'ai-debug-meta' URL Parameters
- Homey <= 2.4.3 - Limited Authentication Bypass due to Missing Empty Value Check
- Total Upkeep – WordPress Backup Plugin plus Restore & Migrate by BoldGrid <= 1.16.8 - Authenticated (Administrator+) Server-Side Request Forgery
- MapSVG < 8.7.4 - Authenticated (Contributor+) Arbitrary File Upload
- Booking Calendar <= 6.2 - Authenticated (Editor+) SQL Injection
- Grid Accordion Lite <= 1.5.1 - Authenticated (Contributor+) Stored Cross-Site Scripting
- Tickera <= 3.5.6.2 - Missing Authorization
- Flex Guten <= 1.2.5 - Authenticated (Contributor+) Stored Cross-Site Scripting via thumbnailHoverEffect Parameter
- Restrict User Registration <= 1.0.1 - Cross-Site Request Forgery to Settings Update
- Miion <= 1.2.7 - Authenticated (Subscriber+) Arbitrary File Upload
- Cost Calculator Builder <= 3.5.32 - Missing Authorization
- Eupago Gateway For Woocommerce <= 3.1.9 - Cross-Site Request Forgery via eupago_page_content
- Multi Step Form <= 1.7.23 - Missing Authorization to Unauthenticated Limited File Upload
- WP Dialog <= 1.2.5.5 - Authenticated (Admin+) Stored Cross-Site Scripting
- WP Activity Log <= 5.6.3 - Authenticated (Subscriber+) Stored Cross-Site Scripting
- Splashing Images <= 2.1 - PHP Object Injection
- Elementor <= 3.29.0 - Authenticated (Contributor+) Stored Cross-Site Scripting
- PPOM <= 34.0.10 - Unauthenticated Arbitrary File Deletion via 'ppom[fields][][n][org]' Parameter
- Gianism <= 5.2.0 - Authenticated (Admin+) Stored Cross-Site Scripting
- Lodgix.com Vacation Rental Website Builder <= 3.9.73 - Authenticated (Contributor+) SQL Injection
- Simple File List <= 6.3.7 - Unauthenticated Arbitrary File Deletion via Path Traversal in 'eeSubFolder' Parameter
- File Manager Pro – Filester <= 1.8.6- Authenticated (Subscriber+) Arbitrary File Upload
- Homey <= 2.4.3 - Cross-Site Request Forgery to User Verification
- Spectra Gutenberg Blocks <= 2.19.28 - Authenticated (Contributor+) Stored Cross-Site Scripting via uagb/image Block
- Lead Generation Contact Widget & AI Chatbot: Chat Button, Phone Call, Telegram, Email – SiteLeads <= 1.2.0 - Unauthenticated Information Exposure
- Fancy Product Designer <= 4.7.5 - Cross-Site Request Forgery to Arbitrary File Upload
- ActiveDEMAND <= 0.2.27 - Missing Authorization Checks
- Media Cloud for Amazon S3, Imgix, Google Cloud Storage, DigitalOcean Spaces and more <= 4.5.24 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode
- Colibri Page Builder <= 1.0.260 - Missing Authorization
- PayPal Currency Converter BASIC for WooCommerce <= 1.3 - Path Traversal to Arbitrary File Read
- Essential Addons for Elementor <= 6.7.1 - Unauthenticated Privilege Escalation
- White Rabbit <= 1.5.2 - Unauthenticated PHP Object Injection
- JetBlocks for Elementor <= 1.5.2.1 - Authenticated (Contributor+) Stored Cross-Site Scripting
- Online Lesson Booking <= 0.8.6 - Cross-Site Scripting
- Interactive Geo Maps <= 1.6.24 - Reflected Cross-Site Scripting
- wpForo Forum <= 2.2.3 - Authenticated (Subscriber+) Stored Cross-Site Scripting
- WP SEO TDK <= 2.1.2 - Missing Authorization to Stored Cross-Site Scripting
- Float menu <= 6.1.2 - Cross-Site Request Forgery to Settings Update
- GoodMeet <= 1.1.8 - Cross-Site Request Forgery to Google Meet Credential Reset via 'goodmeet_reset_google_meet_credential'
- Mobile Themes <= 1.1.1 - Cross-Site Request Forgery
- WooCommerce Product Categories Selection Widget <= 2.0 - Reflected Cross-Site Scripting
- Appointment Hour Booking <= 1.3.55 - Authenticated Stored Cross-Site Scripting
- Admin and Site Enhancements <= 7.9.7 - Authenticated (Author+) Stored Cross-Site Scripting via SVG
- Productive Commerce <= 1.1.22 - Unauthenticated SQL Injection
- Fancy Image Show <= 9.1 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode Attributes
- reCaptcha by BestWebSoft <= 1.12 - CAPTCHA Bypass
- Ninja Forms Contact Form <= 3.8.15 - Reflected Self-Based Cross-Site Scripting via Referer
- Video Player <= 1.5.22 - Reflected Cross-Site Scripting
- Photography <= 7.7.5 - Authenticated (Editor+) Arbitrary File Upload
- Leedo <= 3.0.0 - Authenticated (Contributor+) Local File Inclusion
- Auto Last Youtube Video <= 1.0.7 - Cross-Site Request Forgery
- Simple Finance Calculator <= 1.0 - Reflected Cross-Site Scripting
- Popup, Optin Form & Email Newsletters for Mailchimp, HubSpot, AWeber – MailOptin <= 1.2.35.1 - Authorization Bypass
- Elementor Addons, Widgets and Enhancements – Stax <= 1.4.4.1 - Authenticated (Contributor+) Stored Cross-Site Scripting
- NewStatPress <= 1.0.6 - Reflected Cross-Site Scripting
- Kadence WooCommerce Email Designer <= 1.5.19 - Unauthenticated Privilege Escalation
- House Manager – Easy Renter Management System for WordPress <= 1.0.8.4 - Reflected Cross-Site Scripting
- Snow Storm <= 1.4.6 - Reflected Cross-Site Scripting
- Anthology < 1.4.5 - Arbitrary File Upload
- News Announcement Scroll <= 8.8.8 - Authenticated (Admininstrator+) Stored Cross-Site Scripting
- EventPrime – Events Calendar, Bookings and Tickets <= 3.4.2 - Unauthenticated Booking Payment Bypass
- Easy Accordion Gutenberg Block <= 1.2.3 - Missing Authorization
- BA Book Everything <= 1.6.4 - Authenticated (Contributor+) SQL Injection
- VikBooking Hotel Booking Engine & PMS <= 1.8.13 - Unauthenticated Stored Cross-Site Scripting via Custom Field 'vbfX' Parameter
- Responsive Lightbox & Gallery <= 1.7.1 - Cross-Site Scripting
- Accept Stripe Payments <= 2.0.98 - Unauthenticated Payment Bypass