Vulnerability archive: section 5, page 7
Open a report to review affected versions, available fixes and original sources. Each report covers a specific issue; its presence does not establish whether your website is affected.
- Mikiurl Wordpress Eklentisi <= 2.0 - Cross-Site Scripting
- Gotham Block Extra Light <= 1.5.0 - Authenticated (Administrator+) Stored Cross-Site Scripting via Plugin Settings
- EazyDocs <= 2.5.0 - Authenticated (Contributor+) Stored Cross-Site Scripting
- Aitasi Coming Soon <= 2.0.2 - Authenticated (Administrator+) PHP Object Injection
- Events Made Easy <= 1.6.20 - Stored Cross-Site Scripting
- Hello in All Languages <= 1.0.6 - Cross-Site Request Forgery to Stored Cross-Site Scripting
- MainWP Clone Extension <= 4.0.2 - Missing Authorization to Plugin Settings Change
- BWL Advanced FAQ Manager Lite <= 1.1.1 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'sbox_id' Shortcode Attribute
- WPLMS < 1.9.9.5 - Authenticated (Student+) Remote Code Execution
- Audio Player Block 1.1.0 - 1.6.2 - Authenticated (Contributor+) Stored Cross-Site Scripting
- Felan Framework <= 1.1.3 - Reflected Cross-Site Scripting
- MStore API <= 4.20.0 - Missing Authorization
- Master Slider <= 3.7.0 - Authenticated Stored Cross-Site Scripting
- Sermon Manager <= 2.30.0 - Missing Authorization
- SureCart <= 4.0.2 - Missing Authorization
- ICDSoft Reseller Store <= 2.4.5 - Reflected Cross-Site Scripting
- SupportCandy <= 3.4.1 - Cross-Site Request Forgery
- myCred <= 2.9.4.2 - Missing Authorization
- All In One SEO Pack <= 4.8.7.1 - Authenticated (Contributor+) Sensitive Information Exposure
- Sifalo Pay – Mobile Money & Card Payments for WooCommerce 2.0 - 2.5.2 - Missing Authorization
- Woomotiv <= 3.6.1 - Unauthenticated SQL Injection
- Restore Permanently delete Post or Page Data <= 1.0 - Cross-Site Request Forgery
- Universal Video Player - Addon for WPBakery Page Builder <= 3.2.1 - Reflected Cross-Site Scripting
- WP EasyPay – Square for WordPress <= 3.2.0 - Cross-Site Request Forgery Bypass
- VK Google Job Posting Manager <= 1.2.23 - Authenticated (Author+) Stored Cross-Site Scripting via Job Description Field
- Event Tickets <= 5.11.0.4 - Cross-Site Request Forgery
- EZP Coming Soon Page <= 1.0.7.3 - Authenticated (Admin+) Stored Cross Site Scripting
- MK Google Directions <= 3.1.1 - Authenticated (Contributor+) Stored Cross-Site Scripting
- Sticky Social Icons <= 1.2.1 - Authenticated (Administrator+) Stored Cross-Site Scripting
- Advanced Shipment Tracking for WooCommerce <= 3.5.2 - Cross-Site Request Forgery via paginate_shipping_provider_list and filter_shipping_provider_list
- Restaurant Menu by MotoPress <= 2.4.6 - Cross-Site Request Forgery
- Pin WP < 7.2 - Authenticated (Subscriber+) Arbitrary File Upload
- Elementor Website Builder Pro – More than Just a Page Builder <= 3.25.10 - Authenticated (Contributor+) Sensitive Information Exposure via Shortcode
- Ruven Toolkit <= 2.0 - Reflected Cross-Site Scripting
- WordPress Qwizcards <= 3.94 - Reflected Cross-Site Scripting
- Woocommerce Category Banner Management <= 2.5.1 - Authenticated (Contributor+) PHP Object Injection
- WordPress Core <= 3.5.1 - Content-Spoofing Attacks
- Granola <= 1.13 - Unauthenticated Local File Inclusion
- Cyberus Key <= 1.0 - Authenticated (Administrator+) Stored Cross-Site Scripting
- 404like <= 1.0 - SQL Injection
- MailCWP <= 1.100 - Arbitrary File Upload
- Frontend Admin by DynamiApps <= 3.28.23 - Unauthenticated Stored Cross-Site Scripting via 'update_field'
- OnLeash <= 1.5.2 - Unauthenticated Local File Inclusion
- Modern Events Calendar (Lite & Pro) <= 7.33.0 - Unauthenticated SQL Injection
- Tweeple <= 0.9.5 - Reflected Cross-Site Scripting via id
- Discover the Best Woocommerce Product Brands Plugin for WordPress – Woocommerce Brands Plugin <= 1.3.2 - Authenticated (Contributor+) Stored Cross-Site Scripting
- WP-CRM System <= 3.2.9 - Authenticated (Administrator+) Stored Cross-Site Scripting
- Chat Help – Click to Chat Button & Form <= 3.1.3 - Missing Authorization to Unauthenticated Sensitive Information Exposure
- Mail Masta <= 1.0 - SQL Injection via list_id parameter
- Sitepact's Contact Form 7 Extension For Klaviyo <= 1.0.5 - Unauthenticated SQL Injection
- Namaste! LMS <= 2.6.2 - Authenticated (Student+) Stored Cross-Site Scripting
- Cart66 Lite :: WordPress Ecommerce < 1.5.1.15 - Cross-Site Scripting
- WANotifier <= 2.7.13 - Missing Authorization
- Contact Manager <= 8.6.4 - Unauthenticated Arbitrary Double File Extension Upload
- WPGlobus – Multilingual Everything! <= 1.9.6 - Cross-Site Scripting via wpglobus_option[post_type][page]
- RomethemeKit For Elementor <= 1.5.4 - Authenticated (Subscriber+) Arbitrary Plugin Installation/Activation
- Anti-Spam: Spam Protection | Block Spam Users, Comments, Forms <= 2024.7 - Cross-Site Request Forgery to Multiple Administrative Actions
- Tour Master - Tour Booking, Travel, Hotel <= 5.3.4 - Reflected Cross-Site Scripting
- Ninja Tables – Easy Data Table <= 5.0.16 - Authenticated (Admin+) Stored Cross-Site Scripting
- Newsletters <= 4.15 - Unauthenticated API Authorization Bypass via Type Juggling
- Viral Loops WP Integration <= 3.8.1 - Missing Authorization
- Propovoice CRM <= 1.7.6.2 - Unauthenticated Stored Cross-Site Scripting
- Play.ht – Make Your Blog Posts Accessible With Text to Speech Audio <= 3.6.4 - Missing Authorization
- Droip <= 2.2.6 - Missing Authorization to Authenticated (Subscriber+) Many Actions
- Kubio AI Page Builder <= 2.9.2 - Unauthenticated Stored Cross-Site Scripting via SVG Comment Content (KSES Allowlist Bypass)
- Easy Appointments <= 3.11.18 - Authenticated (Contributor+) Stored Cross-Site Scripting
- Trackserver <= 5.1.0 - Authenticated (Contributor+) Stored Cross-Site Scripting
- Easy Mega Menu Plugin for WordPress – ThemeHunk <= 1.1.0 - Authenticated (Subscriber+) Stored Cross-Site Scripting
- FareHarbor for WordPress <= 3.6.7 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode
- BuddyPress Docs <= 2.2.4 - Authenticated (Subscriber+) Insecure Direct Object Reference to Arbitrary Document Read/Update
- Flex Local Fonts <= 1.0.0 - Authenticated (Admin+) Stored Cross-Site Scripting
- CM Answers <= 3.2.6 - Missing Authorization
- Gravity 2 PDF <= 3.1.3 - Reflected Cross-Site Scripting
- Photography < 7.7.5 - Unauthenticated Local File Inclusion
- Browser and Operating System Finder <= 1.1 - Cross-Site Request Forgery
- Custom Fields Search by BestWebSoft < 1.3.2 - Reflected Cross-Site Scripting
- Podlove Podcast Publisher <= 3.8.2 - Authenticated (Admin+) Stored Cross-Site Scripting
- DT Chocolate <= 1.0 - Open Redirect
- Blogger 301 Redirect <= 2.5.3 - Unauthenticated SQL Injection via br
- WP-DownloadManager plugin <= 1.68.6 - Stored Cross-Site Scripting
- Seriously Simple Stats <= 1.5.1 - Reflected Cross-Site Scripting
- aThemes Addons for Elementor <= 1.1.8 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'title_tag' Widget Setting
- Raptive Ads <= 3.8.0 - Reflected Cross-Site Scripting
- Related Post Shortcode <= 1.2 - Authenticated (Administrator+) Stored Cross-Site Scripting
- Cookiebot by Usercentrics – Automatic Cookie Banner for GDPR/CCPA & Google Consent Mode <= 4.6.4 - Missing Authorization
- Domain Sharding <= 1.2.1 - Cross-Site Request Forgery to Stored Cross-Site Scripting
- 워드프레스 결제 심플페이 – 우커머스 결제 플러그인 <= 5.2.2 - Reflected Cross-Site Scripting via add_query_arg Function
- Station Pro <= 2.4.2 - Authenticated (Contributor+) Stored Cross-Site Scripting via width and height Parameters
- WP Time Slots Booking Form <= 1.2.30 - Cross-Site Request Forgery
- Simplistic SEO <= 2.3.0 - Reflected Cross-Site Scripting
- RT Mega Menu – Mega Menu Builder for Elementor & Gutenberg <= 1.5.1 - Authenticated (Subscriber+) Stored Cross-Site Scripting
- VOD Infomaniak <= 1.5.7 - Cross-Site Request Forgery
- Custom Sidebars <= 3.0.8 - Cross-Site Request Forgery
- Site Reviews <= 2.15.2 - Cross-Site Scripting
- WordPress Contact Forms by Cimatti <= 1.5.7 - Missing Authorization
- WordPress Core < 4.0.1 - Cross-Site Scripting via Shortcode Brackets
- OAuth client Single Sign On for WordPress ( OAuth 2.0 SSO ) <= 3.0.3 - Missing Authorization
- Membership <= 1.6.4 - Authenticated (Subscriber+) Privilege Escalation
- Zero Spam <= 5.5.6 - Spam Protection Bypass
- Motors – Car Dealership & Classified Listings Plugin <= 1.4.109 - Unauthenticated SQL Injection