Vulnerability archive: section 4, page 23
Open a report to review affected versions, available fixes and original sources. Each report covers a specific issue; its presence does not establish whether your website is affected.
- Tainacan <= 0.21.8 - Authenticated (Subscriber+) SQL Injection
- Message Filter for Contact Form 7 <= 1.6.1.1 - Reflected Cross-Site Scripting
- FormBuilder < 1.08 - Cross-Site Request Forgery
- Salon booking system <= 10.29.6 - Missing Authorization
- Userbase Access Control <= 1.0 - Reflected Cross-Site Scripting
- Chaty <= 3.0.9 - Reflected Cross-Site Scripting
- WP All Import <= 4.0.0 - Reflected Cross-Site Scripting via 'filepath'
- IT Residence <= 3.2.1 - Authenticated (Subscriber+) Arbitrary File Upload
- Essential Addons for Elementor – Best Elementor Addon, Templates, Widgets, Kits & WooCommerce Builders <= 6.0.7 - Authenticated (Contributor+) Stored Cross-Site Scripting
- EZPZ One Click Backup <= 12.03.10 - Unauthenticated Command Injection
- NewsCard <= 1.3 - Unauthenticated Local File Inclusion
- Léonie <= 1.2.1 - Unauthenticated PHP Object Injection
- WP Recipe Maker <= 10.2.3 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode
- SetSail Membership <= 1.0.3 - Authentication Bypass via Account Takeover
- Conversios.io <= 7.2.3 - Missing Authorization
- WP Meta and Date Remover < 2.2.0 - Authenticated (Subscriber+) Stored Cross-Site Scripting via settings
- WooCommerce Designer Pro <= 1.9.33 - Authenticated (Subscriber+) Remote Code Execution
- ContentStudio <= 1.3.7 - Cross-Site Request Forgery to Settings Update
- Webmention <= 4.0.8 - Reflected Cross-Site Scripting via 'replytocom'
- User Role <= 1.5.5 - Cross-Site Scripting
- ARMember <= 4.0 - Reflected Cross-Site Scripting
- EventPrime <= 4.2.8.3 - Unauthenticated Information Exposure
- Teddy Bear Customize Addon <= 1.0.5 - Unauthenticated Arbitrary File Upload
- WP Multistore Locator <= 2.5.2 - Unauthenticated SQL Injection
- Malcure Malware Scanner <= 16.8 - Missing Authorization
- FlagEm (Unknown Versions) - Cross-Site Scripting
- Welcart e-Commerce <= 2.8.5 - Authenticated (Subscriber+) Information Disclosure and PHAR deserialization
- Product Filter for WooCommerce by WBW <= 3.1.2 - Unauthenticated SQL Injection
- ECT Product Carousel <= 1.9 - Cross-Site Request Forgery to Stored Cross-Site Scripting
- Immocaster WordPress <= 1.3.6 - Unauthenticated Local File Inclusion
- Custom Field List Widget <= 1.5.1 - Unauthenticated Local File Inclusion
- Control horas <= 1.0.1 - Authenticated (Contributor+) Stored Cross-Site Scripting
- Angio <= 1.1.1 - Authenticated (Subscriber+) PHP Object Injection
- Photo Video Store <= 21.07 - Reflected Cross-Site Scripting
- WP Photo Album Plus <= 9.3.03.002 - Unauthenticated Stored Cross-Site Scripting via REQUEST_URI Session History
- Builderall for WordPress <= 3.0.1 - Missing Authorization to Unauthenticated OAuth Update
- Brave Popup Builder <= 0.7.0 - Cross-Site Request Forgery
- WP DB Manager < 2.7.2 - Arbitrary File Read
- Productive Style <= 1.1.23 - Authenticated (Contributor+) Stored Cross-Site Scripting via display_productive_breadcrumb Shortcode
- ClickFunnels <= 3.1.1 - Cross-Site Request Forgery to Settings Update
- ImageRecycle pdf & image compression <= 3.1.11 - Reflected Cross-Site Scripting
- ActiveCampaign <= 8.1.14 - Authenticated (Administrator+) Server-Side Request Forgery
- VikBooking Hotel Booking Engine & PMS <= 1.5.3 - Arbitrary File Upload
- MemeOne <= 2.0.5 - Cross-Site Request Forgery to Stored Cross-Site Scripting
- Ninja Forms Contact Form – The Drag and Drop Form Builder for WordPress <= 3.6.12 - Authenticated (Administrator+) PHP Objection Injection
- Image Map Pro <= 6.0.20 - Missing Authorization to Authenticated (Contributor+) Map Project Add/Update/Delete
- HMS Testimonials <= 2.0.10 - Cross-Site Request Forgery
- WP Shop <= 3.4.3.18 - Cross-Site Request Forgery to Stored Cross-Site Scripting
- Customize Login Page <= 1.1 - Cross-Site Request Forgery
- Locatoraid Store Locator <= 3.9.23 - Reflected Cross-Site Scripting
- WordPress Core < 4.7.3 - Authenticated Cross-Site Scripting in Youtube URL Embeds
- Admin Font Editor <= 1.7 - Reflected Cross-Site Scripting
- Adning Advertising <= 1.5.5 - Arbitrary File Upload
- Quiz and Survey Master (QSM) <= 11.1.0 - Unauthenticated Shortcode Injection Leading to Arbitrary Quiz Result Disclosure via Quiz Answer Text Input Fields
- iPhone Webclip Manager <= 0.5 - Cross-Site Request Forgery to Stored Cross-Site Scripting
- PayPlus Payment Gateway <= 8.2.1 - Unauthenticated Order Payment Manipulation
- Heateor Social Login WordPress <= 1.1.39 - Cross-Site Request Forgery
- Sina Extension for Elementor <= 3.5.91 - Authenticated (Contributor+) Stored DOM-Based Cross-Site Scripting via Sina Image Differ
- LMSACE Connect <= 3.4 - Missing Authorization
- Ultimate Store Kit Elementor Addons, Woocommerce Builder, EDD Builder, Elementor Store Builder, Product Grid, Product Table, Woocommerce Slider <= 2.3.0 - Missing Authorization
- Echelon <= 2.4 - Arbitrary File Deletion
- Addison < 1.4.8 - Unauthenticated PHP Object Injection
- Bookly <= 21.5 - Unauthenticated Stored Cross-Site Scripting via Name
- The Plus Addons for Elementor – Elementor Addons, Page Templates, Widgets, Mega Menu, WooCommerce <= 5.5.2 - Authenticated (Contributor+) Stored Cross-Site Scripting
- IRM Newsroom <= 1.2.19 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'irmcalendarview' Shortcode
- Easy Digital Downloads <= 3.2.11 - Unauthenticated Sensitive Information Exposure
- JobSearch WP Job Board <= 1.5.1 - Stored Cross-Site Scripting
- Laposta Signup Basic <= 1.4.1 - Missing Authorization
- Simple Download Monitor <= 3.9.4 - Contributor+ Stored Cross-Site Scripting via File Thumbnail
- Accessibility Suite by Online ADA < 2.0.11 - SQL Injection
- Export Users to CSV <= 1.1.1 - CSV Injection
- miniOrange's Google Authenticator <= 5.6.1 - Sensitive Data Exposure of Multifactor Backup Codes
- Adventure Journal <= 1.7.2 - Authenticated (Contributor+) Stored Cross-Site Scripting
- Team Section Block <= 2.0.0 - Authenticated (Contributor+) Stored Cross-Site Scripting via Social Network Link
- GA Universal < 1.0.1 - Cross-Site Request Forgery
- Login Configurator <= 2.1 - Authenticated (Administrator+) Stored Cross-Site Scripting
- WP-Table Reloaded <= 1.9.4 - Authenticated (Contributor+) Stored Cross-Site Scripting
- Booked < 2.4.4 - Unauthenticated Sensitive Information Exposure
- Product Feed for WooCommerce <= 2.2.8 - Missing Authorization
- Elementor AI Addons <= 2.2.1 - Authenticated (Contributor+) Stored Cross-Site Scripting
- Safe Redirect Manager <= 2.2.0 - Unauthenticated Open Redirect
- Genki Announcement <= 1.4.1 - Cross-Site Request Forgery to Stored Cross-Site Scripting
- Dokan Pro <= 5.0.4 - Authenticated (Vendor+) Privilege Escalation via update_capabilities REST Endpoint
- Duplicate Page Plugins <= (Various Versions) - SQL Injection
- PowerPress Podcasting <= 11.12.5 - Authenticated (Contributor+) Stored Cross-Site Scripting
- WP Post Disclaimer <= 1.0.3 - Authenticated (Contributor+) Stored Cross-Site Scripting
- SimpleGMaps <= 1.0 - Authenticated (Contributor+) Stored Cross-Site Scripting
- SensitiveTagCloud <= 1.4.1 - Cross-Site Request Forgery
- Pay with Contact Form 7 <= 1.0.4 - Cross-Site Request Forgery
- WP Shopping Pages <= 1.14 - Cross-Site Request Forgery to Stored Cross-Site Scripting
- The Pack Elementor addons <= 2.0.8.8 - Authenticated (Author+) Stored Cross-Site Scripting
- Seraphinite Alternative Slugs Manager <= 1.3 - Cross-Site Request Forgery
- Post Duplicator <= 2.35 - Missing Authorization
- Content No Cache: prevent specific content from being cached <= 0.1.2 - Unauthenticated Private Content Disclosure
- Hercules Core <= 6.5 - Missing Authorization to Settings Update
- WPLP Cookie Consent <= 4.4.3 - Unauthenticated Stored Cross-Site Scripting
- TicketBAI Facturas para WooCommerce <= 3.18 - Unauthenticated Arbitrary File Deletion
- PowerPress <= 11.0.6 - Authenticated (Contributor+) Server-Side Request Forgery via wp_ajax_powerpress_media_info
- LT Unleashed <= 1.1.1 - Authenticated (Contributor+) Local File Inclusion via 'template' Parameter
- CM Download Manager <= 2.7.0 - Authenticated Stored Cross-Site Scripting