Vulnerability archive: section 5, page 3
Open a report to review affected versions, available fixes and original sources. Each report covers a specific issue; its presence does not establish whether your website is affected.
- sitetweet <= 0.2 - Cross-Site Request Forgery to Stored Cross-Site Scripting
- Plugin Propagator <= 0.1 - Unauthenticated Arbitrary File Upload
- Conditional CAPTCHA <= 4.0.0 - Unauthenticated Open Redirect
- Elementor Addon Elements <= 1.13.6 - Authenticated (Contributor+) Stored Cross-Site Scripting via Multiple Widgets
- Academy LMS Pro <= 3.3.7 - Unauthenticated Privilege Escalation via Social Login Addon
- Bulk Page Generator <= 2.5.7 - Authenticated (Contributor+) Stored Cross-Site Scripting via Post Title
- Premmerce Brands for WooCommerce <= 1.2.13 - Cross-Site Request Forgery
- ThemeLoom Widgets <= 1.8.5 - Authenticated (Contributor+) Stored Cross-Site Scripting
- Simple Membership <= 4.4.3 - Authenticated(Contributor+) Stored Cross-Site Scripting via Shortcode
- Really Simple Security – Simple and Performant Security (formerly Really Simple SSL) <= 9.8.0 - Unauthenticated Denial of Service
- SAML Single Sign On – SSO Login <= 5.4.3 - Unauthenticated Privilege Escalation
- Grill and Chow <= 1.6 - Unauthenticated Local File Inclusion
- Oyster - Photography WordPress <= 4.4.3 - Unauthenticated Stored Cross-Site Scripting
- SendPress Newsletters < 1.2 - Authenticated SQL Injection
- JobCareer <= 3.4 - Cross-Site Scripting
- Saoshyant Slider <= 3.0 - Unauthenticated PHP Object Injection
- Trendy News <= 1.0.15 - Cross-Site Request Forgery
- Easy SVG Support <= 4.0 - Authenticated (Author+) Stored Cross-Site Scripting via SVG File Upload
- Donations Made Easy – Smart Donations <= 4.0.12 - Missing Authorization
- The Plus Addons for Elementor – Mega Menu, Header Footer, Post Grid, AI Widgets & Templates <= 6.5.1 - Authenticated (Contributor+) Stored Cross-Site Scripting
- Kadence Blocks <= 3.7.7 - Missing Authorization to Authenticated (Contributor+) Arbitrary Media Attachment Creation via kadence_import_process_pattern/kadence_import_process_data AJAX Actions
- Kentha <= 4.7.2 - Reflected Cross-Site Scripting
- 3D Tag Cloud <= 3.8 - Cross-Site Request Forgery
- Easy Plugin for AdSense < 6.10 - Cross-Site Request Forgery
- RingCentral Communications 1.5 - 1.6.8 - Missing Server‑Side Verification to Authentication Bypass via ringcentral_admin_login_2fa_verify Function
- WP GoToWebinar <= 15.7 - Cross-Site Request Forgery to Stored Cross-Site Scripting
- Bit Form <= 3.2.0 - Authenticated (Administrator+) SQL Injection via 'filterText' Parameter
- Post Grid, Slider & Carousel Ultimate <= 1.6.6 - Authenticated (Contributor+) Stored Cross-Site Scripting
- WordPress Exit Strategy <= 1.55 - Cross-Site Request Forgery
- Advanced Local Pickup for WooCommerce <= 1.5.2 - Cross-Site Request Forgery
- WP Live.php <= 1.2.1 - Cross-Site Scripting
- Captcha Code <= 2.7 - Cross-Site Request Forgery to Plugin Settings Update
- NEX-Forms <= 9.2.2 - Unauthenticated Stored Cross-Site Scripting
- HEL Online Classroom: AI-powered Online Classrooms <= 1.0.3 - Missing Authorization to Unauthenticated Arbitrary Classroom Deletion via 'id' Parameter
- WP资源下载管理 <= 1.3.9 - Authenticated (Administrator+) Stored Cross-Site Scripting
- Gum Addon for Elementor <= 1.3.15 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'pop_tag' Widget Setting
- Fusion <= 1.6.1 - Authenticated (Contributor+) Stored Cross-Site Scripting
- Private Feed Key <= 0.1 - Authentication Bypass
- Modular DS 2.5.2 - Unauthenticated Privilege Escalation
- oik <= 4.15.4 - Authenticated (Subscriber+) Stored Cross-Site Scripting
- UberSlider Ultra <= 2.3 - Reflected Cross-Site Scripting
- SEO LAT Auto Post <= 2.2.1 - Missing Authorization to File Overwrite/Upload (Remote Code Execution)
- Hospital Doctor Directory <= 1.3.9 - Missing Authorization
- Backuply <= 1.5.8 - Authenticated (Subscriber+) Second-Order SQL Injection via Restore to Privilege Escalation
- MainWP Dashboard <= 4.6.0.1 - Cross-Site Request Forgery via posting_bulk
- byBrick Accordion <= 1.0 - Authenticated (Contributor+) Stored Cross-Site Scripting
- Display Custom Post <= 2.2.1 - Authenticated (Contributor+) Stored Cross-Site Scripting
- Chained Quiz <= 1.3.2.5 - Authenticated (Admin+) Stored Cross-Site Scripting
- Lime Developer Login <= 1.4.0 - Reflected Cross-Site Scripting
- Responsive Image Gallery, Gallery Album <= 2.0.3 - Missing Authorization via Multiple AJAX Actions
- Easy Google Analytics for WordPress <= 1.6.0 - Cross-Site Request Forgery
- NEX-Forms LITE < 8.2 - Unauthenticated Stored Cross-Site Scripting
- Ecommerce - Two Factor Authentication <= 1.0.4 - Reflected Cross-Site Scripting
- Local Business Addons For Elementor <= 1.1.5 - Authenticated (Contributor+) Stored Cross-Site Scripting
- Kids Planet <= 2.2.14 - Unauthenticated PHP Object Injection
- SpeedyCache <= 1.1.2 - Authenticated (Subscriber+) Server-Side Request Forgery
- WP Safe Search <= 0.7 - Cross-Site Scripting
- WP Cookies Alert <= 1.1.1 - Cross-Site Request Forgery to Stored Cross-Site Scripting
- Nelio AB Testing < 4.6.4 - Cross-Site Request Forgery
- Binary MLM Woocommerce <= 2.0 - Reflected Cross-Site Scripting via 'page'
- wpDataTables – WordPress Data Table, Dynamic Tables & Table Charts Plugin <= 6.5.0.4 - Unauthenticated Stored Cross-Site Scripting via CSV/Excel Data Import
- Realtyna Organic IDX plugin <= 4.14.4 - Unauthenticated SQL Injection
- Entry Views <= 1.0.0 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode
- Jardi | Winery, Vineyard & Wine Shop WordPress Theme <= 1.7.2 - Unauthenticated PHP Object Injection
- Image Optimizer, Resizer and CDN – Sirv <= 8.2.5 - Authenticated (Contributor+) SQL Injection
- Blog Designer <= 3.1.8 - Missing Authorization
- WeDesignTech Ultimate Booking Addon <= 1.0.3 - Missing Authorization
- Premium Gallery Manager (Unknown Versions) - Arbitrary File Upload
- Variation Images Gallery for WooCommerce <= 2.3.3 - Reflected Cross-Site Scripting via style
- Backup by 10Web <= 1.0.20 - Reflected Cross-Site Scripting
- Additional Order Filters for WooCommerce <= 1.24 - Unauthenticated Stored Cross-Site Scripting
- Optima Express + MarketBoost IDX Plugin <= 7.3.0 - Authenticated (Administrator+) Stored Cross-Site Scripting
- Photo Gallery by 10Web <= 1.5.87 - Unauthenticated SQL Injection via bwg_tag_id_bwg_thumbnails_0 Parameter
- Rank Math SEO with AI Best SEO Tools <= 1.0.218 - Authenticated (Contributor+) Stored Cross-Site Scripting
- WP Compress <= 6.50.54 - Missing Authorization
- Awesome Testimonials <= 2.2.1 - Cross-Site Request Forgery
- Keyword Rank Tracker <= 1.0.7 - Stored Cross-Site Scripting
- Contact Form Plugin by FluentForm <= 4.3.12 - CSV Injection
- Pie Register - Social Sites Login (Add on) <= 1.7.7 - Authentication Bypass
- WP Fastest Cache <= 1.1.2 - Cross-Site Request Forgery via 'wpfc_remove_cdn_integration_ajax_request_callback'
- CIP4 Folder Download Widget < 1.11 - Local File Inclusion
- kk Star Ratings <= 5.4.10.3 - Unauthenticated Arbitrary Shortcode Execution via 'payload' Parameter
- Easy Waveform Player <= 1.2.0 - Authenticated (Contributor+) Stored Cross-Site Scripting
- WP-Recall <= 16.24.47 - Reflected Cross-Site Scripting
- Filled In <= 1.9.2 - Cross-Site Request Forgery to Stored Cross-Site Scripting
- WP Insurance – WordPress Insurance Service Plugin <= 2.1.3 - Cross-Site Request Forgery leading to Arbitrary Plugin Activation
- Contact Form Email <= 1.3.11 - Cross-Site Request Forgery to Cross-Site Scripting
- Academy LMS <= 3.8.0 - Authenticated (Subscriber+) Insecure Direct Object Reference via 'user_id' Parameter
- Mesmerize Companion <= 1.6.133 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode
- Video Onclick <= 0.4.7 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode
- AudioIgniter Music Player <= 2.0.2 - Unauthenticated Insecure Direct Object Reference to 'audioigniter_playlist_id' Parameter
- Album and Image Gallery with Lightbox – Flagallery Photo Portfolio < 3.1.0 - Arbitrary File Deletion
- School Management <= 93.2.0 - Authenticated (Support staff+) SQL Injection
- Envo's Elementor Templates & Widgets for WooCommerce <= 1.4.16 - Authenticated (Author+) Stored Cross-Site Scripting
- DobsonDev Shortcodes <= 2.1.12 - Authenticated (Contributor+) Stored Cross-Site Scripting
- Flickr Gallery <= 1.5.2 - Unauthenticated PHP Object Injection
- Advance Product Search- Voice & Ajax Search for WooCommerce <= 1.4.4 - Unauthenticated SQL Injection via 's' and 'match' Parameter
- Better WP Login Page <= 1.1.2 - Authenticated (Administrator+) Stored Cross-Site Scripting
- Slicko <= 1.2.0 - Authenticated (Contributor+) Stored Cross-Site Scripting
- WP Rocket < 3.23.5 - Unauthenticated Denial of Service