Vulnerability archive: section 4, page 19
Open a report to review affected versions, available fixes and original sources. Each report covers a specific issue; its presence does not establish whether your website is affected.
- Happyforms <= 1.26.2 - Authenticated (Admin+) Stored Cross-Site Scripting
- WCP Contact Form <= 3.1.0 - Missing Authorization
- Digitally <= 1.0.8 - Reflected Cross-Site Scripting
- Upcoming Events Lists <= 1.4.0 - Authenticated (Subscriber+) Insecure Direct Object Reference
- Neuvoo Jobroll <= 2.0 - Reflected Cross-Site Scripting
- Bulk Featured Image <= 1.2.2 - Authenticated (Admin+) Arbitrary File Upload
- Login by Auth0 3.11.0 - 3.11.2 - Cross-Site Scripting
- The Events Calendar <= 6.17.4 - Unauthenticated PHP Object Injection
- Xin <= 1.0.8.1 - Unauthenticated PHP Object Injection
- The Plus Addons for Elementor <= 6.4.15 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'carousel_direction' Parameter
- WordPress Meta Data and Taxonomies Filter (MDTF) <= 1.3.3.1 - Cross-Site Request Forgery
- EduKart Pro <= 1.0.3 - Unauthenticated Privilege Escalation
- PropertyHive <= 2.0.13 - Authenticated (Contributor+) Stored Cross-Site Scripting
- Widgets for Social Photo Feed <= 1.7.9 - Unauthenticated Stored Cross-Site Scripting via feed_data
- USPS Shipping for WooCommerce – Live Rates <= 1.9.4 - Sensitive Information Exposure
- Flexible Maps <= 1.18.0 - Authenticated (Contributor+) Stored Cross-Site Scripting via Flexible Maps Shortcode
- Cordobo Green Park (All Versions) - Cross-Site Scripting
- WP Directory Kit <= 1.4.4 - Authentication Bypass to Privilege Escalation via Account Takeover
- MP3 Audio Player – Music Player, Podcast Player & Radio by Sonaar <= 5.13.1 - Unauthenticated Stored Cross-Site Scripting
- Contractor Contact Form Website to Workflow Tool <= 4.0.0 - Reflected Cross-Site Scripting
- Halstein < 1.8 - Unauthenticated PHP Object Injection
- Persian Woocommerce SMS <= 7.0.5 - Reflected Cross-Site Scripting
- Eventin – Event Calendar, Tickets, Registration, Booking & WooCommerce < 4.1.16 - Unauthenticated Payment Bypass
- User Email Verification for WooCommerce <= 3.5.0 - Reflected Cross-Site Scripting
- Embed documents shortcode <= 1.5 - Authenticated (Contributor+) Stored Cross-Site Scripting
- Post Duplicator <= 2.16 - Reflected Cross-Site Scripting
- Countdowner for Elementor <= 1.0.4 - Missing Authorization
- underConstruction < 1.09 - Cross-Site Request Forgery
- Giveaway <= 1.2.2 - Authenticated (Admin+) SQL Injection
- Popup by Supsystic <= 1.10.8 - Sensitive Information Disclosure
- WP Datepicker <= 2.1.1 - Authenticated (Administrator+) Stored Cross-Site Scripting
- Ultimate Auction <= 4.0.5 - Cross-Site Request Forgery and Cross-Site Scripting
- Goto - Tour & Travel WordPress Theme < 2.1 - SQL Injection
- Chama <= 1.0.12 - Missing Authorization
- The Events Calendar < 6.17.3.1 - Authenticated (Contributor+) Information Exposure
- Magze <= 1.0.9 - Unauthenticated Local File Inclusion
- EventPrime < 3.2.0 - Reflected Cross-Site Scripting via keyword and ep_filter_date
- Evently <= 1.7 - Unauthenticated Local File Inclusion
- Risk Warning Bar <= 1.0 - Reflected Cross-Site Scripting
- LA-Studio Element Kit for Elementor <= 1.5.2 - Authenticated (Contributor+) DOM-Based Stored Cross-Site Scripting via data-lakit-element-link Parameter
- WP Security Question <= 1.0.5 - Cross-Site Request Forgery Bypass
- pootle button <= 1.1.1 - Reflected Cross-Site Scripting
- Featured Comments < 1.2.5 - Cross-Site Request Forgery
- CarePlus - Health & Medical Responsive WordPress Theme <= 1.2 - Cross-Site Scripting
- Podlove Podcast Publisher <= 4.5.5 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'episode_contributor[..][..][comment]' Parameter
- Podcasting Plugin by TSG < 3.0.5 - Remote File Inclusion
- Creator LMS <= 1.1.12 - Missing Authorization
- Carousel, Slider, Gallery by WP Carousel – Image Carousel & Photo Gallery, Post Carousel & Post Grid, Product Carousel & Product Grid for WooCommerce <= 2.6.3 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'sp_wp_carousel_shortcode'
- Form Vibes <= 1.4.10 - Authenticated (Subscriber+) SQL Injection via fv_export_data
- User Activity Log <= 1.6.4 - Unauthenticated SQL Injection
- Barcode Scanner (+Mobile App) – Inventory manager, Order fulfillment system, POS (Point of Sale) <= 1.13.1 - Authenticated (Subscriber+) SQL Injection
- Simple File List <= 4.4.12 - Cross-Site Request Forgery to Page Creation
- wpForo Forum <= 2.4.13 - Authenticated (Subscriber+) PHP Object Injection
- Woocommerce Email Report <= 2.4 - Unauthenticated Cross-Site Scripting
- Contact Form Entries – Contact Form 7, WPforms and more <= 1.2.0 - Reflected Cross-Site Scripting
- Masteriyo LMS – LMS Course Builder, Quizzes & Certificates <= 2.3.1 - Authenticated (Subscriber+) Insecure Direct Object Reference
- Click to Chat <= 4.39 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'num' Shortcode Parameter
- Simple Cloudflare Turnstile <= 1.23.1 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode
- HTML5 Video Player <= 2.5.24 - Unauthenticated SQL Injection via id
- Bit Assist <= 1.5.2 - Path Traversal to Authenticated (Administrator+) Arbitrary File Read via downloadResponseFile Function
- Snippet Shortcodes <= 4.1.6 - Authenticated (Subscriber+) Shortcode Deletion
- TheRoof <= 1.0.3 - Reflected Cross-Site Scripting
- Visualizer <= 4.0.5 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'backend-title' Parameter
- AI Copilot – Content Generator <= 1.5.9 - Authenticated (Subscriber+) Privilege Escalation
- SpiderCatalog <= 1.7.3 - Authenticated (Admin+) SQL Injection
- Inline Related Posts <= 3.8.0 - Authenticated (Contributor+) Stored Cross-Site Scripting
- Contest Gallery – Photo Contest Plugin for WordPress <= 13.1.0.5 - SQL Injection
- WP 2FA – Two-factor authentication for WordPress < 4.2.0 - Authenticated (Administrator+) Insecure Direct Object Reference
- WP Code Highlight.js <= 0.6.2 - Cross-Site Request Forgery to Cross-Site Scripting
- GiveWP – Donation Plugin and Fundraising Platform <= 2.20.2 - Sensitive Information Disclosure
- ProfileGrid <= 5.9.8.1 - Missing Authorization to Authenticated (Subscriber+) Arbitrary Message Deletion
- NEX-Forms – Ultimate Form Builder <= 8.4.2 - Cross-Site Request Forgery to Cross-Site Scripting
- Praison SEO WordPress <= 4.0.15 - Authenticated (Author+) Stored Cross-Site Scripting
- B1.lt for WooCommerce <= 2.2.57 - Missing Authorization to Authenticated (Subscriber+) Arbitrary SQL Injection
- FormGent – Next-Gen AI Form Builder for WordPress with Multi-Step, Quizzes, Payments & More <= 1.9.2 - Unauthenticated Stored Cross-Site Scripting
- LambertGroup - AllInOne - Banner with Playlist <= 3.8 - Reflected Cross-Site Scripting
- Eventin – Event Calendar, Event Registration, Tickets & Booking (AI Powered) <= 4.1.12 - Missing Authorization
- Sticky Popup <= 1.2 - Authenticated (Admin+) Stored Cross-Site Scripting
- WS Form LITE <= 1.9.217 - Unauthenticated CSV Injection
- Gutentor <= 3.4.6 - Authenticated (Administrator+) SQL Injection
- TheGem Theme Elements (for WPBakery) <= 5.11.0 - Authenticated (Contributor+) Stored Cross-Site Scripting
- Landing Page Cat – Coming Soon Page, Maintenance Page & Squeeze Pages <= 1.7.6 - Reflected Cross-Site Scripting
- EazyDocs <= 2.3.5 - Missing Authorization via doc_one_page and edit_doc_one_page
- Widget Options – Advanced Conditional Visibility for Gutenberg Blocks & Classic Widgets <= 4.2.3 - Authenticated (Contributor+) Remote Code Execution
- DM Albums <= 1.9.2 - Remote File Inclusion
- TI WooCommerce Wishlist <= 2.8.2 - Unauthenticated SQL Injection
- Mavix Education <= 1.0 - Missing Authorization to Authenticated (Subscriber+) 'Creativ Demo Importer' Plugin Activation
- Forminator Forms – Contact Form, Payment Form & Custom Form Builder <= 1.57.0 - Unauthenticated PHP Object Injection
- ZoloBlocks <= 2.3.11 - Missing Authorization to Unauthenticated Popup Enable/Disable
- Blocksy Companion <= 1.8.81 - Authenticated(Subscriber+) Sensitive Information Exposure via blocksy_posts shortcode
- Medcity < 1.1.9 - Unauthenticated Arbitrary File Upload
- Autoptimize <= 3.1.13 - Authenticated (Contributor+) Stored Cross-Site Scripting
- Client Invoicing by Sprout Invoices <= 20.8.7 - Unauthenticated PHP Object Injection
- Request a Quote <= 2.3.8 - CSV Injection
- Elessi < 6.4.1 - Authenticated (Subscriber+) Local File Inclusion
- Podiant <= 1.1 - Unauthenticated Local File Inclusion
- Fontiran <= 2.1 - Cross-Site Request Forgery
- Phone Orders for WooCommerce <= 3.7.1 - Missing Authorization
- Affiliates Manager <= 2.9.50 - Unauthenticated Information Exposure
- G Web Pro Store Locator <= 2.1 - Reflected Cross-Site Scripting