Vulnerability archive: section 4, page 20
Open a report to review affected versions, available fixes and original sources. Each report covers a specific issue; its presence does not establish whether your website is affected.
- WordPress Core < 2.9.2 - Authorization Bypass
- WPGraphQL <= 0.3.4 - Information Exposure
- Leyka <= 3.29.2 - Unauthenticated Stored Cross-Site Scripting
- Extra Block Design, Style, CSS for ANY Gutenberg Blocks <= 0.2.6 - Cross-Site Request Forgery
- Keenarch < 2.0.1 - Authenticated (Subscriber+) Arbitrary File Upload
- WooCommerce Brands <= 1.6.49 - Cross-Site Request Forgery
- Donation Forms by Charitable – Donations Plugin & Fundraising Platform for WordPress <= 1.8.1.14 - Insecure Direct Object Reference to Account Takeover and Privilege Escalation
- Top Flash Embed <= 0.3.4 - Authenticated (Contributor+) Stored Cross-Site Scripting
- Soledad < = 8.6.9 - Missing Authorization to Authenticated (Subscriber+) Arbitrary Options Update
- picu – Online Photo Proofing Gallery <= 3.10.1 - Unauthenticated Stored Cross-Site Scripting
- WSMS (formerly WP SMS) – SMS & MMS Notifications with OTP and 2FA for WooCommerce <= 7.2.1 - Authenticated (Subscriber+) Information Exposure
- Responsive Videos <= 2.1 - Authenticated (Contributor+) Stored Cross-Site Scripting
- Essential Addons for Elementor Pro <= 5.8.11 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'title_html_tag'
- CM Ad Changer < 1.7.6 - Cross-Site Scripting
- My Calendar <= 3.3.24.1 - Cross-Site Request Forgery
- CLEVER - HTML5 Radio Player With History - Shoutcast and Icecast - Elementor Widget Addon <= 2.4 - Unauthenticated Arbitrary File Read
- Matomo <= 4.15.3 - Reflected Cross-Site Scripting via idsite
- Simple Login Log < 1.1.2 - SQL Injection
- LWS SMS <= 2.4.1 - Cross-Site Request Forgery
- WP Talroo <= 2.4 - Reflected Cross-Site Scripting
- Chaty Pro <= 3.5.5 - Authenticated (Subscriber+) SQL Injection via 'widget_id' Parameter
- Kopa Nictitate Toolkit <= 1.0.2 - Authenticated (Contributor+) Stored Cross-Site Scripting
- eRoom – Zoom Meetings & Webinar <= 1.4.18 - Missing Authorization to Information Exposure
- Gigaom Sphinx <= 0.1 - Reflected Cross-Site Scripting
- Auto More Tag <= 4.0.0 - Authenticated (Admin+) Stored Cross-Site Scripting
- Houzez <= 4.0.4 - Missing Authorization
- Demo Importer Plus <= 2.0.1 - Authenticated (Author+) Stored Cross-Site Scripting via SVG File Upload
- WHMCS Bridge <= 6.9 - Unauthenticated Arbitrary File Upload via 'ccce' Parameter
- Form Builder <= 1.9.9.0 - Cross-Site Request Forgery
- Parsi Date <= 4.0.1 - Reflected Cross-Site Scripting
- ARI Fancy Lightbox <= 1.4.0 - Authenticated (Contributor+) Stored Cross-Site Scripting
- Download Monitor <= 4.4.6 - Authenticated (Admin+) Stored Cross-Site Scripting
- efence <= 1.3.2 - Multiple Cross-Site Scripting
- MailerLite - WooCommerce integration <= 3.1.3 - Missing Authorization to Data Deletion
- Classified Listing <= 3.1.16 - Authenticated (Contributor+) Local File Inclusion
- Site Notes <= 2.0.0 - Cross-Site Request Forgery to Admin Note Deletion
- FluentCommunity <= 2.0.0 - Missing Authorization
- WP Social Ninja – Embed Social Feeds, Customer Reviews, Chat Widgets (Google Reviews, YouTube Feed, Photo Feeds, and More) <= 3.20.3 - Unauthenticated Stored Cross-Site Scripting via External Content Import
- RH Frontend Publishing Pro < 4.3.4 - Reflected Cross-Site Scripting
- Awesome Filterable Portfolio <= 1.9.7 - Missing Authorization to Plugin Settings Change
- WPListCal <= 1.3.5 - Authenticated (Subscriber+) SQL Injection
- 0 Day Analytics <= 4.0.0 - Authenticated (Administrator+) SQL Injection
- BookingPress <= 1.0.76 - Authenticated (Administrator+) Arbitrary File Upload
- Homeo <= 1.2.59 - Authenticated (Contributor+) Local File Inclusion
- Essay Wizard (wpCRES) <= 1.0.6.4 - Reflected Cross-Site Scripting
- Google Maps Plugin by Intergeo <= 2.3.2 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode
- Eshop Magic < 0.2 - Arbitrary File Read
- Simple Archive Generator <= 5.2 - Reflected Cross-Site Scripting
- Woocommerce Gifts Product <= 1.0.0 - Cross-Site Request Forgery
- Advanced Text Widget <= 2.0.1 - Cross-Site Scripting
- JetEngine <= 3.7.2 - Authenticated (Contributor+) Remote Code Execution
- Simple File List <= 3.2.4 - Arbitrary File Deletion
- Zero Spam for WordPress <= 5.7.10 - Unauthenticated Stored Cross-Site Scripting via Nested POST Array Keys via Contact Form 7 Integration
- Loginplus <= 1.2 - Missing Authorization
- Launcher: Coming Soon & Maintenance Mode < 1.0.11 - Stored Cross-Site Scripting
- Arrival <= 1.4.5 - Unauthenticated Local File Inclusion
- Goodnex Responsive HTML5/CSS3 Site Template < 1.1.3 - Sensitive Information Disclosure
- EP4 More Embeds <= 1.0.0 - Unauthenticated Stored Cross-Site Scripting
- WP Jump Menu <= 3.6.4 - Authenticated (Administrator+) Stored Cross-Site Scripting
- Add to Calendar Button <= 1.5.0 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode
- Clickbank WordPress Plugin (Niche Storefront) <= 1.3.5 - Cross-Site Request Forgery to Stored Cross-Site Scripting
- Eco Nature - Environment & Ecology WordPress Theme <= 2.0.4 - Missing Authorization to Authenticated (Subscriber+) Limited Options Update
- Multi-column Tag Map <= 17.0.33 - Authenticated (Contributor+) Stored Cross-Site Scripting via mctagmap Shortcode
- GamiPress <= 7.6.6 - Cross-Site Request Forgery
- GTmetrix for WordPress <= 0.4.6 - Reflected Cross-Site Scripting via 'report_id' and 'event_id'
- Dekoro <= 1.0.7 - Unauthenticated Local File Inclusion
- Wholesale Suite <= 2.1.5 - Authenticated (Subscriber+) Cross-Site Scripting
- Classic Addons – WPBakery Page Builder <= 3.5 - Authenticated (Contributor+) Stored Cross-Site Scripting
- Easy PayPal Events <= 1.1.6 - Reflected Cross-Site Scripting via Page
- Lightweight Accordion <= 1.5.16 - Authenticated(Contributor+) Stored Cross-Site Scripting via Shortcode
- JetFormBuilder — Dynamic Blocks Form Builder <= 3.6.5.1 - Unauthenticated Stored Cross-Site Scripting
- No Page Comment <= 1.1 - Cross-Site-Request Forgery to Settings Change
- WPJobBoard <= 5.9.0 - Unauthenticated SQL Injection
- FlatNews <= 5.8 - Reflected Cross-Site Scripting
- Product Table & List Builder For WooCommerce <= 5.6.0 - Unauthenticated CSS Injection via 'laptop_scroll_offset' Parameter
- CopySafe Web Protection < 2.6 - Cross-Site Request Forgery
- Tutor LMS <= 2.0.9 - Authenticated (Administrator+) Stored Cross-Site Scripting
- Captchinoo, admin login page protection with Google recaptcha <= 2.4 - Cross-Site Request Forgery to Arbitrary Plugin Installation/Activation
- Sprout Invoices – Client Invoicing & Estimates <= 20.8.17 - Unauthenticated Insecure Direct Object Reference
- Rockhoist Ratings < 1.2.3 - SQL Injection
- Conditional Menus <= 1.2.0 - Reflected Cross-Site Scripting
- SrbTransLatin <= 1.46 - Cross-Site Request Forgery
- GistPress < 3.0.2 - Cross-Site Scripting
- 404 Solution <= 2.34.0 - Authenticated(Administrator+) SQL Injection
- WP Applink <= 0.4.1 - Authenticated (Contributor+) Stored Cross-Site Scripting via title Parameter
- Quick Restaurant Reservations <= 1.5.4 - Cross-Site Request Forgery
- WPMozo Addons Lite for Elementor <= 1.2.0 - Authenticated (Contributor+) Stored Cross-Site Scripting
- Job Board Manager <= 2.1.60 - Missing Authorization
- SearchWiz <= 1.0.0 - Authenticated (Contributor+) Stored Cross-Site Scripting via Post Title
- MonsterInsights <= 8.9.0 - Unauthenticated Stored Cross-Site Scripting via Google Analytics
- Wp Social Login and Register Social Counter <= 3.0.7 - Authentication Bypass via WordPress.com OAuth provider
- SysBasics Customize My Account for WooCommerce <= 4.3.6 - Reflected Cross-Site Scripting via 'tab' Parameter
- Quotes and Tips by BestWebSoft <= 1.44 - Authenticated (Admin+) Arbitrary File Upload
- W4 Post List <= 3.0.6 - Authenticated (Editor+) SQL Injection
- WPML <= 4.5.10 - Missing Authorization to Settings Change
- ColorFolio <= 1.3 - Authenticated (Subscriber+) PHP Object Injection
- Motors – Car Dealer & Classified Ads <= 1.4.5 - Cross-Site Request Forgery via Multiple Functions
- Pocket Widget <= 0.1.3 - Authenticated (Admin+) Stored Cross-Site Scripting
- Email Obfuscate Shortcode <= 2.0 - Authenticated (Contributor+) Stored Cross-Site Scripting
- Autopay <= 5.0.0 - Unauthenticated Stored Cross-Site Scripting via 'bm_woocommerce_css_editor_content' Parameter