Vulnerability archive: section 6, page 1
Open a report to review affected versions, available fixes and original sources. Each report covers a specific issue; its presence does not establish whether your website is affected.
- Stencies <= 0.58 - Reflected Cross-Site Scripting
- Popup Maker <= 1.19.0 - Authenticated (Contributor+) Stored Cross-Site Scripting
- MDC YouTube Downloader < 2.1.1 - Directory Traversal
- Classified Listing – AI-Powered Classified ads & Business Directory <= 6.1.3 - Missing Authorization
- Xpro Elementor Addons <= 1.4.10 - Authenticated (Contributor+) Stored Cross-Site Scripting
- Supermalink <= 1.1 - Authenticated (Contributor+) Stored Cross-Site Scripting
- WP SendFox <= 1.3.0 - Missing Authorization
- Contact Form 7 GetResponse Extension <= 1.0.8 - Unauthenticated Information Exposure
- Advanced File Manager <= 5.2.8 - Authenticated (Administrator+) Local JavaScript File Inclusion via fma_locale
- Event Booking Manager for WooCommerce <= 5.3.7 - Unauthenticated Insecure Direct Object Reference
- Issues and Series for Newspapers, Magazines, Publishers, Writers <= 2.17.0 - Authenticated (Administrator+) Stored Cross-Site Scripting
- Stacks Mobile App Builder <= 5.2.3 - Unauthenticated Sensitive Information Disclosure
- System Dashboard <= 2.8.14 - Unauthenticated Stored Cross-Site Scripting
- Kama SpamBlock <= 1.8.2 - Reflected Cross-Site Scripting
- Accept Cryptocurrencies with Plisio <= 2.0.6 - Missing Authorization
- xPromoter <= 1.3.4 - Authenticated (Contributor+) SQL Injection
- Ultimate Maps by Supsystic <= 1.2.16 - Cross-Site Request Forgery
- WPBot Pro Wordpress Chatbot <= 13.5.5 - Missing Authorization to Authenticated (Subscriber+) Simple Text Response Creation
- Crowdfunding <= 2.2.0 - Missing Authorization
- Smart Online Order for Clover <= 1.6.0 - Missing Authorization
- Fluent Support – Helpdesk & Customer Support Ticket System <= 2.3.2 - Missing Authorization
- Social Sharing Plugin - Social Warfare <= 4.4.3 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode
- Exzo <= 1.2.4 - Missing Authorization
- HelloLeads CRM Form Shortcode <= 1.0 - Missing Authorization to Unauthenticated Settings Reset
- Easy Digital Downloads – Sell Digital Files & Subscriptions (eCommerce Store + Payments Made Easy) <= 3.3.2 - Authenticated (Admin+) Stored Cross-Site Scripting via Currency Settings
- GravatarLocalCache <= 1.1.2 - Cross-Site Request Forgery to Stored Cross-Site Scripting
- Custom field finder <= 0.3 - Authenticated (Author+) PHP Object Injection
- Google Transliteration <= 1.7.2 - Reflected Cross-Site Scripting
- KP Fastest Tawk.to Chat <= 1.1.1 - Authenticated (Administrator+) Stored Cross-Site Scripting
- Freemius SDK <= 2.4.2 - Missing Authorization Checks
- AMP for WP – Accelerated Mobile Pages <= 1.0.96.1 - Authenticated (Author+) Stored Cross-Site Scripting via SVG File Upload
- MediaView <= 1.1.2 - Reflected Cross-Site Scripting
- GoToWP <= 5.1.1 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode
- Events Maker by dFactory <= 1.6.14 - Authenticated (Contributor+) Stored Cross-Site Scripting
- Pop Up <= 0.1 - Authenticated (Administrator+) Stored Cross-Site Scripting
- JK Html To Pdf <= 1.0.0 - Cross-Site Request Forgery to Stored Cross-Site Scripting
- PT Luxa Addons <= 1.2.2 - Authenticated (Subscriber+) Arbitrary File Upload
- Social Locker <= 1.1 - Authenticated (Contributor+) Stored Cross-Site Scripting
- Survey Maker by AYS <= 5.2.2.5 - Unauthenticated Stored Cross-Site Scripting
- Content Slide <= 1.4.2 - Cross-Site Request Forgery
- SV Forms <= 2.0.05 - Authenticated (Contributor+) Stored Cross-Site Scripting
- Clockwork SMS Plugins - Multiple Versions - Cross-Site Scripting
- PDF Generator For Fluent Forms <= 1.1.7 - Cross-Site Scripting
- Extra Product Options & Add-Ons for WooCommerce < 7.6 - Unauthenticated Arbitrary File Download
- Auto Ad Inserter – Increase Google Adsense and Ad Manager Revenue <= 1.5 - Missing Authorization to Authenticated (Editor+) Settings Update
- LINE Notify <= 1.4.4 - Reflected Cross-Site Scripting via 'uid'
- My Calendar <= 2.3.29 - Path Traversal to Remote Code Execution
- Support Board <= 3.4.1 - Authenticated SQL Injection
- Social Media Widget <= 2.2 - Stored Cross-Site Scripting
- The World <= 0.4 - Cross-Site Request Forgery to Stored Cross-Site Scripting
- WP Performance Score Booster <= 2.0 - Settings Change via Cross-Site Request Forgery
- SeedProd Pro <= 6.18.12 - Authenticated (Administrator+) SQL Injection
- Mail Subscribe List <= 2.0.9 - Unauthenticated Stored Cross-Site Scripting
- Rootspersona <= 3.7.5 - Cross-Site Request Forgery
- Coupon Affiliates <= 5.12.7 - Reflected Cross-Site Scripting
- Divi <= 4.20.2 - Authenticated (Contributor+) Stored Cross-Site Scripting
- Simple Custom Login Page <= 1.0.3 - Authenticated (Admin+) Stored Cross-Site Scripting
- WooCommerce Product Stock Alert <= 2.0.1 - Information Disclosure
- Shown Connector <= 1.2.10 - Missing Authorization to Unauthenticated Settings Update
- Login Manager – Design Login Page, View Login Activity, Limit Login Attempts <= 2.0.5 - Authenticated (Administrator+) Stored Cross-Site Scripting via Custom URL
- Helvig <= 1.0 - Unauthenticated Local File Inclusion
- Gravity Forms <= 2.9.28.1 - Authenticated (Subscriber+) Stored Cross-Site Scripting via Form Title
- WP TripAdvisor Review Slider <= 10.7 - Authenticated (Subscriber+) SQL Injection
- JobSearch WP Job Board <= 2.9.2 - Authentication Bypass via Social Logins
- FoodBoxBooker <= 1.0.6 - Privilege Escalation to Unauthenticated Arbitrary Password Reset
- UniTravel <= 1.4.2 - Unauthenticated Local File Inclusion
- Remove NoFollow Commenter URL <= 1.0 - Cross-Site Request Forgery to Settings Update
- Extensive VC Addons for WPBakery page builder <= 1.9.1 - Unauthenticated Local File Inclusion via 'shortcode_name' Parameter
- Blocksy Companion <= 2.1.55 - Missing Authorization
- Progress Planner <= 1.10.0 - Missing Authorization
- Dwell <= 1.7.0 - Unauthenticated Local File Inclusion
- SureTriggers – Connect All Your Plugins, Apps, Tools & Automate Everything! <= 1.0.46 - Authenticated (Contributor+) Stored Cross-Site Scripting via Trigger Link Shortcode
- Corona Virus (COVID-19) Banner & Live Data <= 1.7.0.6 - Cross-Site Request Forgery
- AIKCT Engine Chatbot, ChatGPT, Gemini, GPT-4o Best AI Chatbot <= 1.6.2 - Cross-Site Request Forgery via update_integration_option
- EZ SQL Reports Shortcode Widget and DB Backup <= 5.25.08 - Cross-Site Request Forgery to Stored Cross-Site Scripting
- VEDA - MultiPurpose WordPress Theme <= 4.2 - Authenticated (Subscriber+) PHP Object Injection
- Recover abandoned cart for WooCommerce <= 2.2 - Cross-Site Request Forgery
- Heureka <= 1.1.0 - Missing Authorization
- DeMomentSomTres WordPress Export Posts With Images <= 20220825 - Missing Authorization to Blog Data Export
- ShopLentor <= 2.8.1 - Authenticated(Contributor+) Stored Cross-Site Scripting via Banner Link
- Visit Counter 1.0 - Cross-Site Request Forgery to Stored Cross-Site Scripting
- WordPress Tooltips <= 9.4.3 - Authenticated (Contributor+) SQL Injection
- Bookit — Booking & Appointment Calendar < 2.6.0.1 - Unauthenticated Information Exposure
- Redirect Redirection <= 1.1.3 - Missing Authorization in 'saveRedirectSettings' function
- YITH plugins by YITHEMES <= (Various Versions) - Cross-Site Request Forgery
- Compfight < 1.5 - Reflected Cross-Site Scripting
- Cost Calculator Builder <= 3.6.9 - Missing Authorization to Unauthenticated Payment Status Bypass
- WC Shop Sync – Square Payment Gateway and Product Synchronization for WooCommerce <= 4.7.3 - Unauthenticated Information Exposure
- UnitechPay <= 1.0.2 - Missing Authorization
- Lana Downloads Manager <= 1.9.0 - Authenticated (Admin+) Arbitrary File Download
- Embed Privacy <= 1.8.0 - Authenticated (Contributor+) Stored Cross-Site Scripting
- ImageRecycle pdf & image compression <= 3.1.10 - Reflected Cross-Site Scripting
- CE21 Suite <= 2.2.0 - Missing Authorization to Unauthenticated Plugin Settings Change
- WP Visitor Statistics (Real Time Traffic) <= 7.8 - Authenticated (Contributor+) Stored Cross-Site Scripting
- Embed RSS <= 3.1 - Authenticated (Subscriber+) Arbitrary Shortcode Execution
- Optimole <= 4.2.3 - Reflected Cross-Site Scripting via Page Profiler URL
- Nexter Extension <= 4.7.11 - Authenticated (Subscriber+) Privilege Escalation to 'reset-view' Parameter
- WPZOOM Forms – Drag & Drop Contact Form Builder for WordPress <= 2.0.7 - Authenticated (Contributor+) Stored Cross-Site Scripting
- WP 404 Auto Redirect <= 1.0.5 - Authenticated (Admin+) Stored Cross-Site Scripting
- Easy!Appointments <= 1.4.2 - Cross-Site Request Forgery to Settings Update