Vulnerability archive: section 5, page 19
Open a report to review affected versions, available fixes and original sources. Each report covers a specific issue; its presence does not establish whether your website is affected.
- Magazine Blocks <= 1.8.3 - Missing Authorization
- Name Directory <= 1.32.0 - Unauthenticated Stored Cross-Site Scripting via Double HTML-Entity Encoding in Submission Form
- WebSamurai <= 1.0.7 - Missing Authorization
- Alpha Price Table For Elementor <= 1.0.8 - Authenticated (Contributor+) Stored Cross-Site Scripting
- Booster Plus for WooCommerce <= 7.2.4 - Reflected Cross-Site Scripting
- Spiffy Calendar <= 5.0.7 - Missing Authorization
- Business Directory Plugin <= 6.3.10 - Cross-Site Request Forgery
- Kiwi <= 2.1.8 - Authenticated (Contributor+) Stored Cross-Site Scripting
- Smash <= 1.7 - Unauthenticated Local File Inclusion
- Kids Online Store <= 0.8.9 - Authenticated (Subscriber+) Arbitrary File Upload
- Royal Elementor Addons <= 1.3.55 - Cross-Site Request Forgery
- Master Slider - Responsive Touch Slider <= 3.9.10 - Cross-Site Request Forgery via process_bulk_action
- Event Management, Events Calendar, RSVP Event Tickets Plugin <= 3.8.4 - Cross-Site Scripting
- WP Job Portal – AI-Powered Recruitment System for Company or Job Board website <= 2.5.1 - Unauthenticated SQL Injection
- Post Grid and Gutenberg Blocks <= 2.2.93 - Authenticated (Contributor+) Stored Cross-Site Scripting
- WPO365 <= 40.0 - Authenticated (Subscriber+) Server-Side Request Forgery
- Theron Lite <= 2.0 - Authenticated (Contributor+) Stored Cross-Site Scripting via Button Shortcode
- Tournamatch <= 4.6.1 - Authenticated (Contributor+) Stored Cross-Site Scripting
- Betheme <= 26.6.2 - Missing Authorization Check on Core Functionality
- SIBS - WooCommerce <= 2.2.0 - Authenticated (Admin+) SQL Injection via 'referencedId' Parameter
- brodos.net Onlineshop Plugin <= 2.0.2 - Authenticated (Contributor+) Stored Cross-Site Scripting
- Yottis <= 1.0.10 - Unauthenticated Local File Inclusion
- Ultimate Member <= 2.11.0 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode Attributes
- Easy Newsletter Signups <= 1.0.4 - Authenticated (Admin+) SQL Injection
- Incredible Font Awesome <= 1.0 - Authenticated (Contributor+) Stored Cross-Site Scripting
- oik <= 4.15.2 - Cross-Site Request Forgery
- Master Addons for Elementor <= 2.0.5.4.1 - Missing Authorization via get_jltma_save_menuitem_settings()
- Accept Stripe Payments < 2.1.4 - Unauthenticated Open Redirect
- WPS Hide Login <= 1.9.0 - Hidden Login Page Location Disclosure
- MxChat – AI Chatbot for WordPress <= 2.4.6 - Unauthenticated Blind Server-Side Request Forgery
- WordPress Core < 6.2.1 - Cross-Site Request Forgery
- wpCentral <= 1.5.0 - Improper Access Control to Privilege Escalation
- Estatik Real Estate Plugin <= 4.1.0 - Reflected Cross-Site Scripting
- Code Snippets <= 3.5.0 - Cross-Site Request Forgery via load
- Simple Coherent Form <= 2.4.13 - Unauthenticated Arbitrary File Deletion via 'id' Parameter
- Modern Events Calendar Lite <= 5.16.4 - Unauthenticated Events Export
- WP移行専用プラグイン for CPI <= 1.0.2 - Unauthenticated Arbitrary File Upload
- Video Conferencing with Zoom < 3.8.16 - Reflected Cross-Site Scripting
- Demo My WordPress <= 1.0.9.1 - Unauthenticated Privilege Escalation
- Custom post types, Custom Fields & more <= 5.0.4 - Authenticated (Contributor+) Stored Cross-Site Scripting
- Universal Clocks <= 1.2.0 - Missing Authorization
- Ditty <= 3.0.32 - Authenticated (Contributor+) Stored Cross-Scripting via Shortcode
- Able Player <= 1.2.1 - Authenticated (Contributor+) Stored Cross-Site Scripting
- WOLF <= 1.0.7.1 - Cross-Site Request Forgery
- EventON - WordPress Virtual Event Calendar Plugin <= 4.5.4 (Pro) & <= 2.2.7 (Free) - Missing Authorization via get_virtual_users
- Aimogen Pro - All-in-One AI Content Writer, Editor, ChatBot & Automation Toolkit <= 2.8.3 - Unauthenticated Arbitrary File Upload
- WP Travel Engine <= 6.3.5 - Authenticated (Contributor+) Local File Inclusion
- Page Builder: Pagelayer – Drag and Drop website builder <= 1.1.1 - Missing Authorization to Cross-Site Scripting
- Colibri Page Builder < 1.0.334 - Authenticated (Shop manager+) Stored Cross-Site Scripting
- TP Restore Categories And Taxonomies <= 1.0.1 - Missing Authorization to Authenticated (Subscriber+) Taxonomy Deletion via 'tpmcattt_delete_term' AJAX Action
- Visitor Traffic Real Time Statistics pro <= 11.10 - Unauthenticated Stored Cross-Site Scripting
- GDPR/CCPA Cookie Consent Banner <= 3.2 - Missing Authorization via handle_consent_toggle()
- Spotlight - Social Media Feeds (Premium) <= 1.7.1 - Unauthenticated Information Exposure
- WP Job Portal <= 2.2.2 - Authenticated (Admin+) SQL Injection via wpjobportal_deactivate()
- Echo RSS Feed Post Generator <= 5.4.6 - Unauthenticated Privilege Escalation
- WP Video Lightbox <= 1.9.6 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode
- CodeColorer <= 0.10.0 - Authenticated (Administrator+) Stored Cross-Site Scripting
- Metform Elementor Contact Form Builder <= 3.4.0 - Missing Authorization via submit
- YITH Essential Kit for WooCommerce #1 <= 2.34.0 - Missing Authorization to Authenticated (Subscriber+) Limited Plugin Install, Activation, and Deactivation
- WP-Footnotes <= 2.2 - Multiple Cross-Site Scripting
- WordPress Core < 3.8.2 - SQL Injection
- SMS <= 6.9.12 - Authenticated (Administrator+) SQL Injection
- Maintenance Notice <= 1.0.6 - Cross-Site Request Forgery
- Author Bio Box <= 3.3.1 - Authenticated Stored Cross-Site Scripting
- FluentBoards 1.95 - 2.0.15 - Unauthenticated Information Exposure
- Plainview Protect Passwords <= 1.4 - Reflected Cross-Site Scripting
- ZM Gallery <= 1.0 - Authenticated (Admin+) SQL Injection
- OMIGO <= 3.3 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode
- Equadio <= 1.1.3 - Unauthenticated Local File Inclusion
- LifePress <= 2.1.3 - Missing Authorization
- WordPress Core < 5.4.1 - Authenticated Cross-Site Scripting via Customizer
- Whistle - Sports Club <= 4.2 - Reflected Cross-Site Scripting
- Ad Inserter <= 2.7.30 - Unauthenticated Sensitive Information Exposure via ai_ajax
- Erident Custom Login & Dashboard <= 3.4.1 - Cross-Site Request Forgery
- Smart Forms <= 2.6.91 - Missing Authorization to Notice Dismissal
- Annonces <= 1.2.0.1 - Arbitrary File Upload
- SB Child List <= 4.5 - Cross-Site Request Forgery via 'sb_cl_update_settings'
- Smart Forms <= 2.6.104 - Unauthenticated Stored Cross-Site Scripting via 'formString' Parameter
- ARK Related Posts <= 2.19 - Cross-Site Request Forgery to Settings Update
- HIPAA Compliant Forms with Drag’n’Drop HIPAA Form Builder. Sign HIPAA documents <= 1.3.4 - Authenticated (Contributor+) Stored Cross-Site Scripting
- Slide Anything <= 2.4.7 - Authenticated (Author+) Stored Cross-Site Scripting
- MStore API – Create Native Android & iOS Apps On The Cloud <= 4.14.7 - Authentication Bypass
- Product Feed on WooCommerce for Google <= 3.5.7 - Authenticated (Administrator+) SQL Injection
- Paytium <= 4.4.10 - Missing Authorization
- Easy Shortcode Buttons <= 1.2 - Authenticated (Contributor+) Stored Cross-Site Scripting
- Responsive Poll < 1.7.6 - Cross-Site Request Forgery to Cross-Site Scripting
- Plugin Central <= 2.5.1 - Cross-Site Request Forgery to Arbitrary File Deletion
- Contest Gallery – Files Upload and Contest Plugin for WordPress <= 17.0.4 - Admin+ SQL Injection
- Oganro Travel Portal Search Widget for HotelBeds APITUDE API <= 1.0 - Cross-Site Request Forgery
- jQuery TwentyTwenty <= 1.0 - Authenticated (Contributor+) Stored Cross-Site Scripting
- Contest Gallery <= 19.1.4.1 - Authenticated (Author+) SQL Injection via wp_user_id
- Booktics 1.0.22 - Authenticated (Subscriber+) SQL Injection
- Ninja Forms Contact Form – The Drag and Drop Form Builder for WordPress <= 3.6.7 - Email Address Disclosure
- SL User Create < 0.2.5 - Information Disclosure
- Click to Chat – WP Support All-in-One Floating Widget <= 2.3.3 - Authenticated (Contributor+) Stored Cross-Site Scripting
- XV Random Quotes <= 2.0.0 - Unauthenticated SQL Injection
- Active Products Tables for WooCommerce. Use constructor to create tables <= 1.0.7 - Authenticated (Contributor+) Stored Cross-Site Scripting
- Post Grid <= 2.1.12 - Contributor+ SQL Injection
- Showbiz Pro Responsive Teaser WordPress Plugin <= 1.7.1 - Arbitrary File Upload
- Royal Addons for Elementor <= 1.7.1064 - Authenticated (Contributor+) Server-Side Request Forgery via Form Builder Widget 'webhook_url' Setting