Vulnerability archive: section 4, page 13
Open a report to review affected versions, available fixes and original sources. Each report covers a specific issue; its presence does not establish whether your website is affected.
- Redirection for Contact Form 7 <= 2.3.3 - Authenticated Arbitrary Plugin Installation
- Zorka – Wonderful Fashion WooCommerce Theme <= 1.5.7 - Reflected Cross-Site Scripting
- Kipso <= 1.3.4 - Unauthenticated Local File Inclusion
- Debloat <= 1.3.0 - Unauthenticated Arbitrary File Read via 's' Search Parameter via @import url() in Reflected Search-Feed
- Knit Pay – Cashfree, Instamojo, Razorpay, PayPal and more <= 9.6.0.0 - Missing Authorization
- Auto Featured Image <= 4.2.1 - Missing Authorization to Authenticated (Contributor+) Post Thumbnail Modification
- Paid Membership Plugin, Ecommerce, User Registration Form, Login Form, User Profile & Restrict Content – ProfilePress <= 4.15.5 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'reg-single-checkbox'
- DELUCKS SEO <= 2.5.4 - Missing Authorization
- Booking Calendar Contact Form <= 1.0.23 - Authenticated (Subscriber+) Stored Cross-Site Scripting
- Video Metabox <= 1.1 - Stored Cross Site Scripting
- Salon booking system <= 9.6.5 - Authenticated (Editor+) Stored Cross-Site Scripting
- Woocommerce Blocker Lite <= 2.1.5 - Cross-Site Request Forgery
- Simply Schedule Appointments <= 1.6.12.3 - Unauthenticated Stored Cross-Site Scripting
- Cognito Forms <= 2.0.7 - Authenticated (Contributor+) Stored Cross-Site Scripting via id Parameter
- Membership Plugin – Kadence Memberships <= 4.0.0 - Unauthenticated Password Reset Link Poisoning to Account Takeover
- Instantio <= 3.3.30 - Unauthenticated Information Exposure
- Travel Agency <= 1.4.9 - Cross-Site Request Forgery
- NewsXpress <= 1.0.7 - Cross-Site Request Forgery to Notice Dismissal
- Social Login and Register <= 7.7.0 - Authenticated (Administrator+) Local File Inclusion
- Alloggio - Hotel Booking WordPress Theme <= 2.1.2 - Unauthenticated PHP Object Injection
- Tidy.ro <= 1.3 - Reflected Cross-Site Scripting
- TrueBooker – Appointment Booking and Scheduler System <= 1.2.3 - Unauthenticated Privilege Escalation
- WC Shop Sync – Square Payment Gateway and Product Synchronization for WooCommerce <= 4.7.4 - Authenticated (Subscriber+) SQL Injection
- Themify - WooCommerce Product Filter <= 1.3.7 - Reflected Cross-Site Scripting
- Easy Coming Soon <= 2.3 - Authenticated (Administrator+) Stored Cross-Site Scripting via plugin settings
- Olimometer < 2.57 - SQL Injection
- Comments On Feed <= 1.2.1 - Reflected Cross-Site Scripting
- WooCommerce Order Details <= 3.1 - Missing Authorization
- REST API TO MiniProgram <= 4.7.7 - Authenticated (Subscriber+) Media Attachment Deletion
- Schema Lite <= 1.2.2 - Cross-Site Request Forgery
- Formidable Forms <= 6.3 - Authenticated (Subscriber+) Arbitrary Plugin Installation and Activation
- Ajax Search Lite < 4.12 - Authenticated (Admin+) Stored Cross-Site Scripting
- Coming Soon Countdown <= 2.2 - Reflected Cross-Site Scripting
- Mounthood | Ski and Snowboarding HTML Template <= 1.3.2 - Unauthenticated PHP Object Injection
- MarketKing — Ultimate WooCommerce Multivendor Marketplace Solution <= 2.1.71 - Missing Authorization
- WeDesignTech Ultimate Booking Addon <= 1.0.1 - Authenticated (Subscriber+) Authentication Bypass
- Alt Text Generator AI – Auto Generate & Bulk Update Alt Texts For Images <= 1.8.3 - Missing Authorization to Authenticated (Subscriber+) API Key Deletion
- Saphali LiqPay for donate <= 1.0.2 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode
- PropertyHive < 1.4.15 - Cross-Site Scripting
- WP RSS Aggregator – News Feeds, Autoblogging, Youtube Video Feeds and More <= 4.6.3 - Authorization Bypass
- Forminator Forms – Contact Form, Payment Form & Custom Form Builder <= 1.58.0 - Missing Authorization
- WP ULike Pro <= 1.9.3 - Unauthenticated Limited Arbitrary File Upload
- Charitable <= 1.8.5.1 - Authenticated (Administrator+) Stored Cross-Site Scripting
- Molla - eCommerce HTML5 Template < 1.5.19 - Reflected Cross-Site Scripting
- 微信群发助手-Wechat Broadcast <= 1.2.0 - Directory Traversal
- ThemeGrill Demo Importer 1.3.4 - 1.6.1 - Authorization Bypass to Site Reset
- Melos <= 1.6.0 - Authenticated (Contributor+) Stored Cross-Site Scripting
- http-cache-semantics < 4.1.1 - Regular Expression Denial of Service (ReDoS)
- lote27 (All Versions) - Arbitrary File Download
- WooCommerce Support Ticket System <= 17.7 - Authenticated (Subscriber+) Arbitrary File Deletion
- Admin Columns <= 7.0.18 - Authenticated (Contributor+) PHP Object Injection to Remote Code Execution via Custom Field Meta Value
- Auto Affiliate Links <= 6.4.6 - Authenticated (Admin+) SQL Injection
- IDPay Payment Gateway for Woocommerce <= 2.2.5 - Unauthenticated Information Exposure
- Slideshow Wp <= 1.1 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'sswp-slide' Shortcode 'sswpid' Attribute
- WordPress Gallery Plugin <= 1.4 - Unauthenticated Remote File Inclusion
- Avada Builder <= 3.11.12 - Authenticated (Contributor+) Protected Post Disclosure
- Classified Listing – AI-Powered Classified ads & Business Directory Plugin <= 5.3.8 - Missing Authorization
- MAS Videos <= 1.3.2 - Missing Authorization
- ShopLentor – WooCommerce Builder for Elementor & Gutenberg +10 Modules – All in One Solution (formerly WooLentor) <= 2.8.1 - Authenticated (Contributor+) Stored Cross-Site Scripting
- FX Currency Converter <= 0.2.0 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode Attributes
- Page Builder: Live Composer <= 2.0.6 - Authenticated (Contributor+) Stored Cross-Site Scripting
- JS Help Desk <= 2.9.2 - Unauthenticated Local File Inclusion
- Super Custom Login <= 1.1 - Missing Authorization
- weichuncai(WP伪春菜) <= 1.5 - Cross-Site Request Forgery to Stored Cross-Site Scripting
- Uncanny Automator <= 6.3.0.2 - Missing Authorization to Authenticated (Subscriber+) Privilege Escalation
- Happy Addons for Elementor <= 3.12.2 - Authenticated (Contributor+) Sensitive Information Exposure
- IdeaPush <= 8.60 - Authenticated (Subscriber+) Stored Cross-Site Scripting
- Ninja Forms <= 3.6.25 - Authenticated (Administrator+) Stored HTML Injection
- Min and Max Purchase for WooCommerce <= 2.0.0 - Authenticated (Contributor+) Stored Cross-Site Scripting
- MapPress Maps for WordPress <= 2.88.4 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode
- Nokri - Job Board WordPress Theme <= 1.6.6 - Unauthenticated Privilege Escalation via 'token' Parameter
- wpShopGermany - Protected Shops <= 2.0 - Authenticated(Administrator+) Stored Cross-Site Scripting
- Simple Membership <= 4.8.3 - Missing Authorization to Unauthenticated Account Takeover and Sensitive Information Disclosure via 'email' Parameter on Activation Endpoints
- Royal Addons for Elementor <= 1.7.1056 - Missing Authorization to Unauthenticated Form Action Meta Modification
- ShareOpenly < 1.2.1 - Reflected Cross-Site Scripting
- The Pack Elementor addons (Header Footer & WooCommerce Builder, Template Library) <= 2.0.8.2 - Authenticated (Subscriber+) Server-Side Request Forgery
- Jawn <= 1.4.2 - Unauthenticated Privilege Escalation
- PitchPrint <= 11.1.2 - Unauthenticated Arbitrary File Deletion
- Bamazoo – Button Generator <= 1.0 - Authenticated (Contributor+) Stored Cross-Site Scripting via dgs Shortcode
- MapSVG Lite <= 8.6.4 - Authenticated (Contributor+) Arbitrary File Upload
- Karzo < 2.6 - Unauthenticated Local File Inclusion
- Flexi Quote Rotator <= 0.9.4 - Authenticated (Administrator+) Stored Cross-Site Scripting
- Giveaways and Contests by RafflePress – Get More Website Traffic, Email Subscribers, and Social Followers <= 1.12.19 - Unauthenticated Stored Cross-Site Scripting
- All in One Time Clock Lite – Tracking Employee Time Has Never Been Easier <= 2.0 - Reflected Cross-Site Scripting
- InFocus <= 3.3 - Arbitrary File Deletion
- Blogty <= 1.0.11 - Unauthenticated Local File Inclusion
- Cookie Bar <= 2.0 - Authenticated(Administrator+) Stored Cross-Site Scripting
- Add User Role <= 0.0.1 - Authenticated (Administrator+) Stored Cross-Site Scripting
- WebToffee WooCommerce PDF Invoices, Packing Slips, Delivery Notes & Shipping Labels <= 4.9.4 - Unauthenticated Information Exposure
- Widget Options - Extended <= 5.2.1 - Authenticated (Contributor+) Stored Cross-Site Scripting
- Ebook Store <= 5.8009 - Reflected Cross-Site Scripting
- Meta Box AIO <= 3.7.1 - Unauthenticated Privilege Escalation
- School Management System – WPSchoolPress <= 2.1.16 - Stored Cross-Site Scripting
- Simple Logo Carousel <= 1.9.3 - Authenticated (Contributor+) Stored Cross-Site Scripting via id Parameter
- Stockholm <= 9.6 - Unauthenticated Local File Inclusion
- ShiftController Employee Shift Scheduling <= 4.9.66 - Reflected Cross-Site Scripting
- Honeypot for WP Comment <= 2.2.3 - Reflected Cross-Site Scripting via page
- Digital Climate Strike WP <= 1.0.0 - Malicious Redirect
- YITH WooCommerce Gift Cards <= 4.12.0 - Missing Authorization to Unauthenticated WooCommerce Settings Update
- Contact Form by Supsystic < 1.7.20 - Authenticated (Admin+) Stored Cross-Site Scripting