Vulnerability archive: section 3, page 18
Open a report to review affected versions, available fixes and original sources. Each report covers a specific issue; its presence does not establish whether your website is affected.
- WP Admin Custom Page <= 1.5.0 - Cross-Site Request Forgery to Stored Cross-Site Scripting
- Meow Gallery <= 5.5.1 - Authenticated (Author+) Stored Cross-Site Scripting
- My auctions allegro <= 3.6.33 - Cross-Site Request Forgery
- WP All Export Pro <= 1.9.1 - Authenticated (ShopManager+) Arbtirary Options Update
- GPT3 AI Content Writer <= 1.8.66 - Authenticated (Contributor+) Stored Cross-Site Scripting
- LearnPress <= 4.3.2.8 - Missing Authorization to Authenticated (Subscriber+) Arbitrary Email Notification Triggering
- Groundhogg <= 4.8.3 - Unauthenticated Privilege Escalation to Support User Identity Confusion
- Countdown & Clock <= 2.2.8 - Reflected Cross-Site Scripting
- JetProductGallery <= 2.1.22 - Authenticated (Contributor+) Stored Cross-Site Scripting
- CSS3 Buttons <= 0.1 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode Attributes
- Bridge Core <= 3.0.9 - Reflected Cross-Site Scripting
- Comments – wpDiscuz <= 7.6.21 - Unauthenticated HTML Injection
- SiteOrigin CSS <= 1.6.7 - Unauthenticated Stored DOM-Based Cross-Site Scripting via Comment Author URL via Inspector href Sink
- Loco Translate <= 2.6.0 - Authenticated Stored Cross-Site Scripting
- WooCommerce Clover Payment Gateway <= 1.3.1 - Missing Authorization via callback_handler
- WP Compress – Instant Performance & Speed Optimization < 7.20.01 - Unauthenticated Remote Code Execution
- Seraphinite Accelerator <= 2.27.21 - Cross-Site Request Forgery to Multiple Administrative Actions
- Beaver Builder – WordPress Page Builder <= 2.7.4.2 - Authenticated (Contributor+) Stored Cross-Site Scripting
- CoSchool LMS <= 1.4- Missing Authorization to Privilege Escalation
- Simple Social Share Block <= 1.0.0 - Authenticated (Contributor+) Stored Cross-Site Scripting
- Visitors <= 0.3 - Unauthenticated Stored Cross-Site Scripting
- Document Gallery <= 5.1.1 - Unauthenticated Stored Cross-Site Scripting
- Schema App Structured Data <= 2.2.4 - Reflected Cross-Site Scripting
- Bit.ly linker <= 1.1 - Reflected Cross-Site Scripting
- Robo Gallery <= 5.1.2 - Authenticated (Contributor+) Stored Cross-Site Scripting
- TaxoPress <= 3.6.4 - Authenticated (Editor+) Stored Cross-Site Scripting
- Easy Digital Downloads – Pushover notifications <= 1.2.8 - Reflected Cross-Site Scripting
- Static Block <= 2.2 - Insecure Direct Object Reference to Authenticated (Contributor+) Sensitive Information Disclosure via Shortcode 'id' Attribute
- Salon Booking System <= 10.22 - Missing Authorization to Unauthenticated AJAX Actions Execution
- Gravity Forms Constant Contact <= 1.1.2 - Unauthenticated PHP Object Injection
- WHOIS <= 1.4.2.2 - Reflected Cross Site Scripting
- Tutor LMS – Migration Tool <= 2.2.0 - Missing Authorization in tutor_lp_export_xml
- Create <= 2.5.3 - Authenticated (Author+) SQL Injection via 'order_by' Parameter
- School Management System – WPSchoolPress <= 2.2.10 - Insecure Direct Object Reference to Authenticated (Teacher+) Account Takeover/Privilege Escalation
- Handmade Framework <= 3.9 - Authenticated (Contributor+) Local File Inclusion
- Nexos - Real Estate <= 1.7 - Reflected Cross-Site Scripting
- Supreme Addons for Beaver Builder <= 1.0.9 - Authenticated (Contributor+) Stored Cross-Site Scripting via auto_qrcodesabb Shortcode
- Events Calendar for GeoDirectory <= 2.3.14 - Authenticated (Contributor+) PHP Object Injection
- Bold Page Builder <= 5.3.0 - Authenticated (Administrator+) Stored Cross-Site Scripting
- Easy Language Switcher <= 1.0 - Reflected Cross-Site Scripting
- Arconix Shortcodes <= 2.1.15 - Reflected Cross-Site Scripting
- WP Maps – Google Maps,OpenStreetMap,Mapbox,Store Locator,Listing,Directory & Filters < 4.9.3 - Authenticated (Subscriber+) Local File Inclusion
- Scroll Baner <= 1.0 - Cross-Site Request Forgery to Remote Code Execution and/or Cross-Site Scripting
- Cookie Banner for GDPR / CCPA – WPLP Cookie Consent <= 4.3.7 - Cross-Site Request Forgery via Bulk Action to Delete/Resolve Entries
- Smart Forms – when you need more than just a contact form <= 2.9.95 - Authenticated (Admin+) Stored Cross-Site Scripting
- HT Mega – Absolute Addons For Elementor <= 2.6.5 - Authenticated (Contributor+) Sensitive Information Exposure via template_id
- WP Header Notification <= 1.2.7 - Authenticated (Administrator+) Stored Cross-Site Scripting
- Poll Maker – Versus Polls, Anonymous Polls, Image Polls <= 6.0.7 - Authenticated (Administrator+) SQL Injection via `filterbyauthor` Parameter
- Brizy – Page Builder <= 2.4.41 - Authenticated(Contributor+) Stored Cross-Site Scripting
- Glossary by WPPedia <= 1.3.0 - Authenticated (Administrator+) PHP Object Injection
- WP Text Expander <= 1.0.1 - Authenticated (Administrator+) SQL Injection
- SP Blog Designer <= 1.0.0 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'design' Attribute
- Motor Racing League <= 1.9.9 - Authenticated (Administrator+) Stored Cross-Site Scripting
- WP Plugin Info Card <= 6.2.0 - Cross-Site Request Forgery to Arbitrary Custom Plugin Entry Creation
- NextScripts: Social Networks Auto-Poster <= 4.4.7 - Authenticated (Contributor+) PHP Object Injection
- Age Verification & Identity Verification by Token of Trust <= 4.0.2 - Missing Authorization to Unauthenticated Information Exposure via 'tot_export_table' Parameter
- ReDi Restaurant Reservation <= 21.0307 - Stored Cross-Site Scripting
- Prodigy Commerce <= 3.1.2 - Missing Authorization
- WP 404 Auto Redirect to Similar Post <= 1.0.3 - Reflected Cross-Site Scripting via request
- Debug Log Manager <= 2.3.4 - Unauthenticated Stored Cross-Site Scripting
- Groundhogg <= 2.7.9.8 - Missing Authorization to Non-Arbitrary File Upload
- miniOrange 2FA <= 6.2.6 - Two-Factor Authentication Bypass
- WP Ultimate Recipe < 3.12.7 - Stored Cross-Site Scripting
- HUSKY – Products Filter for WooCommerce (formerly WOOF) <= 1.3.4.3 - Cross-Site Request Forgery
- WP Go Maps <= 10.1.01 - Unauthenticated Arbitrary Record Creation
- WordPress Download Manager <= 2.9.49 - Reflected Cross-Site Scripting
- PayForm <= 2.0 - Cross-Site Request Forgery to Stored Cross-Site Scripting
- Contact Form Generator <= 2.5.5 - Reflected Cross-Site Scripting
- Multiple Themes (Various Versions) - Reflected Cross-Site Scripting via Search Field
- Shortlinks by Pretty Links <= 3.6.15 - Missing Authorization
- WeDesignTech Portfolio <= 1.0.2 - Missing Authorization
- Infility Global < 2.15.19 - Authenticated (Subscriber+) SQL Injection
- Tutor LMS <= 2.2.0 - Missing Authorization via REST API
- Contact Form by Bit Form: Multi Step Form, Calculation Contact Form, Payment Contact Form & Custom Contact Form builder 2.0 - 2.13.9 - Authenticated (Administrator+) SQL Injection via getLogHistory Function
- Yoast SEO Premium 25.7-25.9 - Authenticated (Contributor+) Stored Cross-Site Scripting
- Media File Renamer <= 5.7.7 - Authenticated(Administrator+) Remote Code Execution
- OxyExtras <= 1.4.4 - Unauthenticated Cross-Site Scripting
- Digirisk 6.0.0.0 - Reflected Cross-Site Scripting
- WP CSV Exporter <= 1.3.6 - Authenticated (Admin+) SQL Injection
- Portfolio for Elementor & Image Gallery | PowerFolio <= 3.2.0 - Authenticated (Contributor+) Stored Cross-Site Scripting via Custom JS
- MyTube PlayList <= 2.0.3 - Reflected Cross-Site Scripting via addplaylistid
- Analytics Tracker <= 1.1.0 - Cross-Site Scripting
- Oliver POS – A WooCommerce Point of Sale (POS) <= 2.4.2.1 - Missing Authorization
- MD Custom content after or before of post <= 1.0 - Cross-Site Request Forgery to Stored Cross-Site Scripting
- Ajax Load More <= 7.3.1.2 - Authenticated (Contributor+) Stored Cross-Site Scripting
- BackupBuddy <= 8.8.2 - Reflected Cross-Site Scripting
- User Profile Builder – Beautiful User Registration Forms, User Profiles & User Role Editor <= 3.13.5 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode
- Advanced Ads – Ad Manager & AdSense <= 2.0.14 - Missing Authorization to Authenticated (Subscriber+) Ad Placements Update
- Login as User or Customer <= 3.8 - Unauthenticated Limited Admin Account Compromise
- Site Search 360 <= 2.1.6 - Authenticated (Contributor+) Stored Cross-Site Scripting
- Ultimate Profile Builder < 3.0 - Cross-Site Request Forgery to Cross-Site Scripting
- TrustedSite <= 1.2.5 - Unauthenticated Stored Cross-Site Scripting
- Quiz And Survey Master <= 7.3.6 - Reflected Cross-Site Scripting
- miniOrange's Google Authenticator <= 5.4.52 - Unauthenticated Arbitrary Options Deletion
- RTMKit <= 2.0.7 - Authenticated (Contributor+) Limited Local File Inclusion via 'template' Parameter
- Rosebud - Flower Shop and Florist WordPress Theme <= 1.4 - Unauthenticated Local File Inclusion
- Fast WP Speed <= 1.0.0 - Reflected Cross-Site Scripting
- Masteriyo LMS – LMS Course Builder, Quizzes & Certificates <= 2.3.0 - Authenticated (Subscriber+) Stored Cross-Site Scripting
- Nexter Blocks <= 4.7.4 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'commentIcon' Block Attribute
- Booking Calendar < 11.8 - Unauthenticated Information Exposure