Vulnerability archive: section 4, page 25
Open a report to review affected versions, available fixes and original sources. Each report covers a specific issue; its presence does not establish whether your website is affected.
- Files Download Delay <= 1.0.6 - Missing Authorization to Settings Reset
- Go Live Update Urls <= 7.0.8 - Authenticated (Contributor+) PHP Object Injection
- eHive Search <= 2.5.0 - Reflected Cross-Site Scripting
- webpack JS package <= 5.75.0 - Sandbox Bypass
- TownHub <= 1.2.9 - Reflected Cross-Site Scripting
- Shortcode Redirect <= 1.0.01 - Cross-Site Scripting
- Ninja Forms <= 3.6.24 - Authenticated (Admin+) Arbitrary File Deletion
- WP Helper Premium <= 4.2.0 - Authenticated (Contributor+) SQL Injection
- Protección de datos – RGPD <= 0.68 - Missing Authorization
- RomethemeForm For Elementor <= 1.1.5 - Missing Authorization via export_entries, rtformnewform, and rtformupdate
- WP Easy Gallery <= 1.7 - Cross-Site Scripting
- wpShopGermany IT-RECHT KANZLEI <= 1.7 - Authenticated (Administrator+) Stored Cross-Site Scripting
- CPT Bootstrap Carousel <= 1.12 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode
- ELEX WooCommerce Advanced Bulk Edit Products, Prices & Attributes <= 1.4.9 - Authenticated (Shop manager+) SQL Injection
- Gum Elementor Addon <= 1.3.5 - Authenticated (Editor+) Stored Cross-Site Scripting
- Get Better Reviews for WooCommerce <= 4.0.6 - Missing Authorization
- Chilexpress woo oficial <= 1.2.9 - Reflected Cross-Site Scripting
- WP Matterport Shortcode <= 2.1.7 - Authenticated (Contributor+) Stored Cross-Site Scripting
- Front User Submit | Front Editor <= 3.8.4 - Authenticated (Subscriber+) Stored Cross-Site Scripting
- Covert VideoPress (All Known Versions) - Cross-Site Scripting
- UserPro <= 5.1.1 - Authentication Bypass to Administrator
- WP Google Maps <= 6.3.14 - Stored Cross-Site Scripting
- Custom Content Type Manager <= 0.9.8.5 - Authenticated (Admin+) Remote Code Execution
- WP MultiTasking <= 0.1.12 - Cross-Site Request Forgery to Permalink Suffix Update
- JetMenu <= 3.0.5 - Authenticated (Contributor+) Stored Cross-Site Scripting
- RSVP ME <= 1.9.9 - Authenticated (Subscriber+) Stored Cross-Site Scripting
- Easy Appointments 4.0 - 4.0.2.1 - Unauthenticated Insecure Direct Object Reference
- Brizy <= 2.8.18 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'brizy-compiled-sections' Post Meta
- Easy Digital Downloads <= 3.7.0 - Unauthenticated Unauthorized Account Creation
- Yoga Schedule Momoyoga <= 2.9.0 - Authenticated (Contributor+) Stored Cross-Site Scripting
- Boldman <= 7.7 - Authenticated (Contributor+) Local File Inclusion
- ekommart < 4.3.1 - Authenticated (Contributor+) Local File Inclusion
- Under Construction <= 3.96 - Cross-Site Request Forgery via admin_action_install_weglot
- 活动链接推广插件 <= 1.2.3 - Authenticated (Contributor+) Stored Cross-Site Scripting
- WPCargo <= 6.8.9 - Unauthenticated Remote Code Execution
- Yotpo Reviews for WooCommerce (Unofficial) <= 2.0.4 - Cross-Site Request Forgery to Plugin Settings Update
- ClickBank Affiliate Ads <= 1.20 - Cross-Site Scripting
- MasterStudy LMS Pro Plus <= 4.8.20 - Authenticated (Instructor+) SQL Injection via 'columns' Parameter
- GDPR CCPA Compliance Support <= 2.7.3 - Missing Authorization
- Responsive HTML5 Audio Player PRO With Playlist <= 3.5.8 - Reflected Cross-Site Scripting
- Slider Revolution < 6.6.19 - Authenticated (Author+) PHP Object Injection
- Seraphinite Accelerator Premium <= 2.21.13 - Cross-Site Request Forgery to Arbitrary File Deletion
- Save as PDF Plugin by Pdfcrowd <= 3.2.3 - Authenticated (Contributor+) Stored Cross-Site Scripting
- DirectoryPress – Business Directory And Classified Ad Listing <= 3.6.26 - Missing Authorization
- Gallery Widget <= 1.2.1 - Authenticated (Contributor+) SQL Injection
- W3 Total Cache <= 0.9.7.3 - Improper Input Validation via openssl_verify
- Pearl <= 1.3.9 - Missing Authorization
- LatestCheckins <= 1 - Cross-Site Request Forgery to Stored Cross-Site Scripting
- WP ERP <= 1.12.8 - Authenticated (Accounting manager+) SQL Injection
- Gallery Plugin for WordPress – Envira Photo Gallery <= 1.12.0 - Missing Authorization to Authenticated (Author+) Multiple Gallery Actions
- Binge Site Verification using Meta Tag <= 1.0 - Authenticated (Admin+) Stored Cross-Site Scripting via Admin Settings
- Five Star Restaurant Reservations <= 2.4.11 - Missing Authorization to Stored Cross-Site Scripting
- Popup Like box – Page <= 3.7.2 - Authenticated (Administrator+) Stored Cross-Site Scripting
- Hostel <= 1.1.8 - Authenticated (Administrator+) Stored Cross-Site Scripting via 'custom_currency' Parameter and Localization file URL Setting
- Energox <= 1.2 - Authenticated (Subscriber+) Arbitrary File Deletion
- LearnPress 4.4.3 - 4.4.6 - Unauthenticated Information Exposure
- Maintenance Redirect <= 2.0.1 - IP Spoofing to Maintenance Mode Bypass
- Configure SMTP <= 3.1 - Reflected Cross-Site Scripting
- Falang multilanguage <= 1.3.51 - Cross-Site Request Forgery
- Magical Posts Display <= 1.2.52 - Authenticated (Contributor+) Stored Cross-Site Scripting
- SocialMark <= 2.0.7 - Authenticated (Subscriber+) Server-Side Request Forgery
- Cookie Notice & Consent <= 1.6.4 - Unauthenticated Stored Cross-Site Scripting
- Autopay dla WooCommerce <= 2.2.27 - Missing Authorization
- Contact Form Email <= 1.3.31 - Cross-Site Request Forgery to Feedback Submission
- Web Minimalist 200901 <= 1.1 - Cross-Site Scripting
- Cyr to Lat Reloaded – Transliteration of Links and File Names <= 1.3.3 - Missing Authorization
- Ashe <= 2.233 - Cross-Site Request Forgery to Notice Dismissal
- Personalized WooCommerce Cart Page <= 2.4 - Cross-Site Request Forgery
- Jetpack CRM <= 5.5.0 - Authenticated (Client+) Stored Cross-Site Scripting
- Loco Translate <= 2.8.7 - Authenticated (Translator+) Stored Cross-Site Scripting via PO File Extracted Comments
- FiboSearch <= 1.32.1 - Missing Authorization
- Avada <= 7.11.1 - Authenticated(Author+) Arbitrary File Upload via Zip Extraction
- PowerPack Pro for Elementor <= 2.10.6 - Missing Authorization to Settings Reset
- atec Duplicate Page & Post <= 1.2.20 - Missing Authorization to Authenticated (Contributor+) Arbitrary Post Duplication and Data Exposure
- Widgets for Google Reviews <= 13.3 - Authenticated (Editor+) Stored Cross-Site Scripting via 'fomo-title' and 'fomo-text' Parameters
- News Ticker Widget for Elementor <= 1.3.2 - Authenticated (Contributor+) Stored Cross-Site Scripting
- Mr. SEO <= 2.0 - Unauthenticated Local File Inclusion
- Widget Wrangler <= 2.3.9 - Authenticated (Author+) Remote Code Execution
- Webmaster Tools <= 2.0 - Authenticated (Administrator+) Stored Cross-Site Scripting
- Structured Content <= 1.5.3 - Authenticated (Contributor+) Stored Cross-Site Scripting
- SiteGround Security <= 1.3.0 - Authenticated (Administrator+) SQL Injection
- Elementor Header & Footer Builder <= 1.6.26 - Authenticated (Contributor+) Stored Cross-Site Scripting
- Count per Day < 3.5.5 - Reflected Cross-Site Scripting
- Powerplay Gallery <= 3.3 - Arbitrary File Upload
- Essential Blocks – Page Builder Gutenberg Blocks, Patterns & Templates <= 5.3.1 - Authenticated (Contributor+) Stored Cross-Site Scripting
- FontMeister <= 1.08 - Reflected Cross-Site Scripting
- DVS Custom Notification <= 1.0.1 - Cross-Site Request Forgery
- Convex <= 1.11 - Unauthenticated Local File Inclusion
- Typing Text <= 1.2.6 - Authenticated (Contributor+) Stored Cross-Site Scripting
- Team Builder <= 1.5.7 - Missing Authorization
- Smart Manager – Advanced WooCommerce Bulk Edit & Inventory Management <= 8.85.0 - Authenticated (Contributor+) Privilege Escalation
- Picture Gallery – Frontend Image Uploads, AJAX Photo List <= 1.6.5 - Authenticated (Contributor+) Arbitrary File Deletion
- WordPress Core < 5.0.1 - PHP Object Injection
- RealHomes Memberships <= 3.0.0 - Authenticated (Subscriber+) Payment Bypass
- WooCommerce Checkout & Funnel Builder by CartFlows – Create High Converting Stores For WooCommerce <= 1.5.15 - Cross-Site Request Forgery Bypass
- AHAthat Plugin <= 1.6 - Cross-Site Request Forgery to AHA Page Deletion
- Certifica WP <= 3.1 - Authenticated (Contributor+) Stored Cross-Site Scripting via evento Parameter
- Herd Effects <= 5.2 - Local File Inclusion
- Inline Related Posts <= 3.3.1 - Cross-Site Request Forgery
- Code Snippets < 2.7.0 - Reflected Cross-Site Scripting