Vulnerability archive: section 4, page 14
Open a report to review affected versions, available fixes and original sources. Each report covers a specific issue; its presence does not establish whether your website is affected.
- Restrict Content <= 3.2.8 - Missing Authorization
- Sticky Anything <= 2.1.5 - Unauthenticated Stored Cross-Site Scripting
- WP Abstracts <= 2.6.2 - Authenticated (Administrator+) Stored Cross-Site Scripting
- Workup – Job Board WordPress Theme <= 2.1.5 - Reflected Cross-Site Scripting
- Gillion <= 4.13 - Missing Authorization
- Paid Membership Subscriptions – Effortless Memberships, Recurring Payments & Content Restriction <= 2.17.3 - Reflected Cross-Site Scripting
- Pexels: Free Stock Photos <= 1.2.2 - Authenticated (Contributor+) Server-Side Request Forgery
- All In One WP Security & Firewall <= 3.8.7 - SQL Injection
- Newsletter, SMTP, Email marketing and Subscribe forms by Sendinblue <= 3.1.24 - Reflected Cross-Site Scripting
- F4 Media Taxonomies <= 1.1.4 - Missing Authorization
- Game Tabs <= 0.4.0 - Cross-Site Scripting
- Newsletters <= 4.9.5 - Authenticated (Admin+) Arbitrary File Upload
- PostX <= 5.0.13 - Authenticated (Contributor+) Stored Cross-Site Scripting via Post Comments Block
- Multifox Plus <= 1.1.6 - Authenticated (Contributor+) Stored Cross-Site Scripting
- Royal Elementor Addons and Template <= 1.7.1001 - Authenticated (Contributor+) DOM-Based Stored Cross-Site Scripting via Google Maps Widget
- Ship To eCourier <= 1.0.1 - Cross-Site Request Forgery
- Peter’s Collaboration E-mails <= 2.2.0 - Cross-Site Request Forgery
- Post Grid <= 2.0.12 - Arbitrary File Deletion
- ShayanWeb Admin FontChanger <= 1.9.1 - Cross-Site Request Forgery
- Hummingbird – Speed Optimization, Caching, Minify, Compress & CDN <= 3.21.0 - Unauthenticated Remote Code Execution via Cookie Name in Page Cache Debug Log
- Simple File List <= 3.2.7 - Arbitrary File Download
- UDesign Core <= 4.14.0 - Authenticated (Contributor+) Local File Inclusion
- LMS <= 9.7 - Reflected Cross-Site Scripting
- Pie Register <= 1.30 - Multiple Cross-Site Scripting
- MDTF – Meta Data and Taxonomies Filter <= 1.3.3.3 - Unauthenticated Arbitrary Shortcode Execution
- Review Schema <= 2.2.4 - Authenticated (Contributor+) Local File Inclusion via Post Meta
- KLEO < 5.4.4 - Missing Authorization
- Superb Social Media Share Buttons and Follow Buttons <= 1.1.3 - Cross-Site Request Forgery via spbsmAjax
- Simple Membership <= 4.7.5 - Missing Authorization to Unauthenticated Arbitrary Member Account Deactivation via Forged Stripe 'charge.refunded' Webhook
- Contextual Related Posts <= 1.8.6 - Cross-Site Request Forgery to Cross-Site Scripting
- Guest posting / Frontend Posting wordpress plugin – WP Front User Submit / Front Editor <= 4.4.5 - Authenticated (Administrator+) Stored Cross-Site Scripting
- Fluent Forms Pro 6.2.7 & Ninja Tables Pro 5.2.13 - Remote Code Execution via Backdoor
- Simple Light Weight Social Share (Tweet, Like, Share and Linkedin) <= 2.0 - Authenticated (Administrator+) Stored Cross-Site Scripting
- Beaver Builder – WordPress Page Builder <= 2.7.4.2 - Authenticated (Contributor+) Stored Cross-Site Scripting
- Passster – Password Protect Pages and Content <= 4.2.6.2 - Missing Authorization to Sensitive Information Exposure
- Chauffeur Taxi Booking System for WordPress <= 7.2 - Unauthenticated Arbitrary File Upload
- Gutenberg Blocks by Kadence Blocks – Page Builder Features <= 3.2.25 - Authenticated (Contributor+) Stored Cross-Site Scripting via Testimonial Widget
- GPT AI Power <= 1.4.37 - Missing Authorization
- Corpkit <= 2.0 - Authenticated (Subscriber+) Arbitrary File Upload
- Events Shortcodes & Templates For The Events Calendar <= 2.3.1 - Authenticated (Contributor+) SQL Injection via shortcode
- SMS Alert Order Notifications <= 3.8.8 - Missing Authorization
- Ivory Search <= 4.7.1 - Authenticated (Contributor+) Stored Cross-Site Scripting
- LuxeDrive <= 1.0 - Unauthenticated Local File Inclusion
- WP-Members Membership <= 3.4.7.3 - Missing Authorization to Settings Update
- WordPress Core 2.2.1 - Backdoor
- Contact Form by Supsystic <= 1.7.28 - Authenticated (Administrator+) Stored Cross-Site Scripting
- Snazzy Social Media Feed <= 2.5 - Unauthenticated Arbitrary File Upload via 'pluginURL' Parameter
- Ninja Forms – The Contact Form Builder That Grows With You <= 3.12.0 - Cross-Site Request Forgery to Plugin Settings Update
- WordPress Post Grid Layouts with Pagination – Sogrid <= 1.5.6 - Authenticated (Admin+) Local File Inclusion
- BeyondCart Connector <= 3.0.1 - Missing Configuration of JWT Secret to Unauthenticated Privilege Escalation via determine_current_user Filter
- Smart Slider 3 <= 3.5.1.33 - Missing Authorization to Authenticated (Contributor+) Slider Data Read and Image Record Manipulation
- Shared Files Pro < 1.7.68 & Shared Files Free < 1.7.67 - Unauthenticated Arbitrary File Deletion
- Modula Image Gallery <= 3.0.11 - Missing Authorization to Unauthenticated Sensitive Information Exposure via Exposed 'modulaSettings' REST field on the modula-gallery CPT
- DZS Video Gallery <= 12.39 - Authenticated (Subscriber+) SQL Injection
- Flog <= 0.1 - Cross-Site Scripting
- Traveler < 3.2.2 - Unauthenticated SQL Injection
- BNE Testimonials <= 2.0.8 - Authenticated (Contributor+) Stored Cross-Site Scripting
- Freshchat <= 2.3.4 - Cross-Site Request Forgery
- GS Pins for Pinterest <= 1.8.2 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shorcode
- DethemeKit For Elementor <= 2.1.8 - Authenticated (Contributor+) Stored Cross-Site Scripting
- Post Duplicator <= 3.0.10 - Authenticated (Contributor+) PHP Object Injection
- Attesa Extra <= 1.4.2 - Authenticated (Contributor+) Post Disclosure
- WPGuppy <= 1.1.0 - Unauthenticated PHP Object Injection
- AI Feeds <= 1.0.11 - Unauthenticated Arbitrary File Upload
- BP Group Documents <= 1.2.1 - Path Traversal
- JS Help Desk <= 2.7.1 - Unauthenticated SQL Injection
- ЮKassa для WooCommerce <= 2.3.0 - Missing Authorization
- EPROLO Dropshipping <= 2.3.1 - Missing Authorization to Authenticated (Subscriber+) Tracking Data Modification
- Translate WordPress with GTranslate <= 2.9.6 - Reflected Cross-Site Scripting
- Splendour <= 1.23 - Unauthenticated PHP Object Injection
- ZeroBounce Email Verification & Validation <= 1.0.11 - Authenticated (Administrator+) Stored Cross-Site Scripting
- Shortcodes and extra features for Phlox theme <= 2.14.0 - Unauthenticated Local File Inclusion
- WooCommerce Products without featured images <= 0.1 - Cross-Site Request Forgery
- TS Poll – Best Poll Plugin for WordPress <1.3.4 - Missing Authorization
- Locations <= 4.0 - Authenticated (Contributor+) Stored Cross-Site Scripting
- Custom API for WP <= 4.2.2 - Authenticated (Subscriber+) Privilege Escalation
- Remove slug from custom post type <= 1.0.3 - Cross-Site Request Forgery
- Ultimate Member <= 2.13.1 - Unauthenticated Stored Cross-Site Scripting via 'form_id' Parameter
- LifterLMS <= 7.4.2 - Authenticated(Administrator+) Directory Traversal to Arbitrary CSV File Deletion
- Contact Forms by Cimatti <= 1.8.0 - Authenticated (Administrator+) Stored Cross-Site Scripting
- MultiVendorX <= 5.0.18 - Authenticated (Store Manager+) SQL Injection via 'order_by' Parameter
- Flozen < 1.5.1 - Unauthenticated Arbitrary File Upload
- Squadeno <= 1.11.0 - Missing Authorization
- WP Real Estate Manager <= 2.8 - Authentication Bypass via Account Takeover
- News Articles <= 1.0.0 - Authenticated (Contributor+) Stored Cross-Site Scripting
- CoDesigner <= 4.30 - Missing Authorization
- Tune Library <= 1.6.3 - Missing Authorization to Authenticated (Subscriber+) Stored Cross-Site Scripting via CSV Import
- Bulk Creator <= 1.0.1 - Reflected Cross-Site Scripting
- HM Portfolio <= 1.1.1 - Reflected Cross-Site Scripting
- Aajoda Testimonials <= 2.2.2 - Authenticated (Contributor+) Stored Cross-Site Scripting
- E2Pdf <= 1.32.26 - Missing Authorization to Authenticated (Custom+) Arbitrary Option Update / Privilege Escalation via 'screen_action' Parameter
- Drag and Drop Multiple File Upload for Contact Form 7 <= 1.3.9.7 - Unauthenticated Arbitrary File Upload via Non-ASCII Filename Blacklist Bypass
- drop in image slideshow gallery <= 12.0 - Authenticated (Contributor+) Stored Cross-Site Scripting
- UPI QR Code Payment Gateway for WooCommerce <= 1.6.2 - Missing Authorization
- FAPI Member <= 2.2.29 - Unauthenticated Insecure Direct Object Reference
- Gutentools <= 1.1.3 - Authenticated (Contributor+) Stored Cross-Site Scripting via Post Slider Block Attributes
- Social Network Tabs - Social Media API Key Leakage <= 1.7.1 - Information Exposure
- ShowTime Slideshow <= 1.6 - Cross-Site Request Forgery to Stored Cross-Site Scripting
- FastBook <= 1.1 - Cross-Site Request Forgery
- All-in-One Events Calendar < 1.10 - SQL Injection