Vulnerability archive: section 4, page 16
Open a report to review affected versions, available fixes and original sources. Each report covers a specific issue; its presence does not establish whether your website is affected.
- DiveBook <= 1.1.4 - SQL Injection
- SALESmanago & Leadoo <= 3.11.2 - Unauthenticated SQL Injection
- Media Library Tools <= 1.6.15 - Authenticated (Author+) SQL Injection
- Libsyn Publisher Hub <= 1.4.4 - Sensitive Information Exposure
- InPost Gallery <= 2.1.4.1 - Reflected Cross-Site Scripting via 'imgurl'
- Download Monitor <= 5.1.8 - Authenticated (Contributor+) SQL Injection
- Redirect Redirection <= 1.1.3 - Missing Authorization in 'addRedirectRule' function
- Related Products Manager for WooCommerce <= 1.6.2 - Authenticated (Contributor+) Stored Cross-Site Scripting
- Ads Pro Plugin - Multi-Purpose WordPress Advertising Manager <= 4.88 - Unauthenticated SQL Injection
- WPeMatico RSS Feed Fetcher <= 2.8.10 - Authenticated (Subscriber+) Sensitive Information Exposure
- Hotel Booking <= 2.2.8 - Cross-Site Request Forgery
- Booking calendar, Appointment Booking System <= 2.1.7 - Cross-Site Scripting
- WP Socializer – Simple & Easy Social Media Share Icons <= 7.2 - Authenticated (Administrator+) Stored Cross-Site Scripting
- JetTricks <= 2.0.1 - Authenticated (Contributor+) Stored Cross-Site Scripting
- Quantity Plus Minus Button for WooCommerce by CodeAstrology <= 1.1.9 - Cross-Site Request Forgery via wqpmb_form_submit
- Admin and Site Enhancements <= 8.8.3 - Missing Authorization
- CG Scroll To Top <= 3.5 - Cross-Site Request Forgery to Stored Cross-Site Scripting
- wpDiscuz <= 7.6.33 - Missing Authorization
- Shuffle <= 0.5 - Authenticated (Subscriber+) SQL Injection
- Video Conferencing with Zoom <= 4.4.4 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode
- Hero Mega Menu - Responsive WordPress Menu Plugin <= 1.16.5 - Authenticated (Subscriber+) SQL Injection
- Quentn WP <= 1.2.8 - Unauthenticated Privilege Escalation
- Registrations for the Events Calendar – Event Registration Plugin <= 2.12.2 - Authenticated (Contributor+) SQL Injection
- Perfmatters <= 2.6.4 - Unauthenticated Stored Cross-Site Scripting
- Crown Art | Drawing and Music School WordPress Theme <= 1.2.11 - Unauthenticated Local File Inclusion
- amr shortcodes <= 1.7 - Reflected Cross-Site Scripting
- ElementInvader Addons for Elementor <= 1.3.1 - Missing Authorization to Arbitrary Options Read
- WordPress Security <= 4.2 - Admin+ Stored Cross-Site Scripting
- WP-DownloadCounter <= 1.01 - Cross-Site Request Forgery
- Refraction <= 1.3 - Multiple Vulnerabilities
- Booked <= 3.0.0 - Authentication Bypass
- Wishlist for WooCommerce: Multi Wishlists Per Customer <= 3.1.2 - Reflected Cross-Site Scripting
- JetTabs <= 2.2.12 - Authenticated (Contributor+) Stored Cross-Site Scripting
- Ultimate Viral Quiz <= 1.0 - Cross-Site Request Forgery to Settings Update
- Lead Capturing Pages <= 2.5 - Unauthenticated SQL Injection
- azurecurve BBCode <= 2.0.4 - Authenticated (Contributor+) Stored Cross-Site Scripting via url Shortcode
- Moosend Landing Pages <= 1.1.6 - Missing Authorization to Authenticated (Subscriber+) Option Deletion
- LearnPress – WordPress LMS Plugin <= 4.0.0 - Cross-Site Request Forgery to Privilege Escalation
- Reality <= 2.3.0 - Stored Cross-Site Scripting
- Global Flash Gallery <= 0.15.1 - SQL Injection
- Theater for WordPress <= 0.18.8 - Missing Authorization
- WP Original Media Path <= 2.4.0 - Authenticated (Administrator+) Stored Cross-Site Scripting via plugin settings
- Easy WP Tiles <= 1 - Authenticated (Administrator+) Stored Cross-Site Scripting
- URL Shortener | Conversion Tracking | AB Testing | WooCommerce <= 9.0.2 - Reflected Cross-Site Scripting
- Echo <= 1.15.0 - Unauthenticated Local File Inclusion
- Donate With QRCode <= 1.4.5 - Cross-Site Request Forgery to Settings Update
- RTMKit <= 2.1.5 - Cross-Site Request Forgery
- HT Slider For Elementor <= 1.6.5 - Authenticated (Contributor+) Stored Cross-Site Scripting
- SVG Map Plugin <= 1.0.0 - Cross-Site Request Forgery to Settings Update and Stored Cross-Site Scripting
- weDocs: AI Powered Knowledge Base, Docs, Documentation, Wiki & AI Chatbot <= 2.3.0 - Missing Authorization to Authenticated (Subscriber+) Data Migration via wedocs_migrate_betterdocs_to_wedocs AJAX Action
- Spectra – WordPress Gutenberg Blocks <= 2.16.2 - Authenticated (Contributor+) Stored Cross-Site Scripting via Team Widget
- WP 2FA – Two-factor authentication for WordPress <= 2.2.0 - Missing Authorization
- Premmerce Redirect Manager <= 1.0.11 - Authenticated (Administrator+) Stored Cross-Site Scripting
- Conformer for Elementor <= 1.0.7 - Missing Authorization
- MagicPost <= 1.2.1 - Authenticated (Contributor+) Stored Cross-Site Scripting via wb_share_social Shortcode
- Dave's WordPress Live Search <= 4.5 - Reflected Cross-Site Scripting
- Car Seller - Auto Classifieds Script <= 2.1.0 - Unauthenticated SQL Injection
- System Dashboard <= 2.8.14 - Authenticated (Admin+) Arbitrary File Read
- Analytify Pro <= 7.0.3 - Unauthenticated Information Exposure
- WP Fusion (Pro) <= 3.47.13 - Authenticated (Subscriber+) Privilege Escalation via ThriveCart Auto Login 'role' Parameter
- SendPulse Free Web Push <= 1.3.1 - Cross-Site Request Forgery via sendpulse_config
- VidoRev <= 2.9.9.9.9.9.7 - Unauthenticated Local File Inclusion
- WP Statistics <= 14.16.4 - Unauthenticated Stored Cross-Site Scripting via 'utm_source' Parameter
- Dokan: AI Powered WooCommerce Multivendor Marketplace Solution – Build Your Own Amazon, eBay, Etsy < 5.0.14 - Authenticated (Shop Manager+) Remote Code Execution
- Maniac SEO <= 2.0 - Reflected Cross-Site Scripting
- WordPress Core < 2.8.3 - Missing Authorization
- Zippy <= 1.6.9 - Authenticated (Editor+) Arbitrary File Upload
- Visualizer <= 3.11.1 - Authenticated (Subscriber+) SQL Injection
- EmbedPress <= 3.7.3 - Sensitive Information Exposure
- Appointment Booking Calendar — Simply Schedule Appointments Booking Plugin <= 1.6.12.4 - Missing Authorization
- .TUBE Video Curator <= 1.1.9 - Reflected Cross-Site Scripting
- World Travel Information <= 1.0.0 - Reflected Cross-Site Scripting
- Mobigate <= 1.0.3 - Reflected Cross-Site Scripting
- Bailly <= 1.3.4 - Unauthenticated Local File Inclusion
- Discussion Board <= 2.5.7 - Missing Authorization
- Advance Menu Manager <= 3.0.6 - Cross-Site Request Forgery
- Nexa Blocks <= 1.1.0 - Authenticated (Contributor+) Stored Cross-Site Scripting via Google Maps Widget
- Download After Email 2.1.5 - 2.1.6 - Unauthorized Repeated Form Submissions
- YITH Custom Login <= 1.7.3 - Reflected Cross-Site Scripting
- Memberlite Shortcodes <= 1.4.1 - Authenticated (Contributor+) Stored Cross-Site Scripting
- Ultimate Form Builder Lite <= 1.3.2 - Reflected Cross-Site Scripting
- Rife Free <= 2.4.19 - Authenticated (Contributor+) Stored Cross-Site Scripting
- Download After Email <= 2.1.9 - Missing Authorization
- Timeline Block <= 1.3.3 - Insecure Direct Object Reference to Authenticated (Author+) Private Timeline Exposure via Shortcode Attribute
- Master Slider – Responsive Touch Slider <= 3.9.9 - Authenticated (Contributor+) Stored Cross-Site Scripting
- Porto Theme - Functionality < 3.7.3 - Missing Authorization
- Newsletters < 4.17 - Cross-Site Request Forgery
- GEO my WP <= 4.5.5 - Unauthenticated SQL Injection via 'swlatlng' / 'nelatlng' Parameters
- Navigation menu as Dropdown Widget <= 1.3.4 - Authenticated (Admin+) Stored Cross-Site Scripting
- MailPoet Newsletters <= 2.2 - Multiple SQL Injections
- PawFriends - Pet Shop and Veterinary WordPress <= 1.3 - Unauthenticated Local File Inclusion
- WP Social Bookmarking Light <= 2.0.7 - Cross-Site Request Forgery
- Ultimate WP Mail <= 1.3.13 - Open Redirect
- Knowband Mobile App Builder <= 2.0.8 - Missing Authorization to Unauthenticated Arbitrary User Deletion
- Amelia <= 1.2.38 - Missing Authorization
- WP ULike <= 5.0.1 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode Attribute
- Backup Migration <= 2.1.6 - Authenticated (Administrator+) Privilege Escalation
- Zermatt <= 1.6.1 - Unauthenticated PHP Object Injection
- WP EasyPay <= 4.0.4 - Reflected Cross-Site Scripting
- FC United <= 1.1.1 - Unauthenticated PHP Object Injection