Vulnerability archive: section 6, page 10
Open a report to review affected versions, available fixes and original sources. Each report covers a specific issue; its presence does not establish whether your website is affected.
- Administrator Z <= 2025.03.28 - Authenticated (Admin+) Directory Traversal
- LayerSlider <= 4.6.1 - Cross-Site Request Forgery
- Noo JobMonster < 4.5.2.9 - Reflected Cross-Site Scripting
- Blockons <= 1.2.15 - Missing Authorization
- Snow Club <= 1.1 - Unauthenticated Local File Inclusion
- Searchie <= 1.17.0 - Authenticated (Contributor+) Stored Cross-Site Scripting
- Profile Builder <= 3.10.7 - Insecure Direct Object Reference to Sensitive Information Exposure via user_meta Shortcode
- Solid Mail – SMTP email and logging made by SolidWP <= 2.1.5 - Unauthenticated Stored Cross-Site Scripting via Email
- LWS Affiliation <= 2.3.4 - Missing Authorization
- CubeWP Framework <= 1.1.30 - Insecure Direct Object Reference to Authenticated (Contributor+) Arbitrary Post and User Meta Disclosure
- Bookingor <= 2.0.1 - Missing Authorization
- Coinpress <= 1.0.15 - Unauthenticated PHP Object Injection
- History timeline <= 0.7.2 - Reflected Cross-Site Scripting
- Book Landing Page <= 1.2.7 - Missing Authorization
- ICS Button <= 0.6 - Authenticated (Contributor+) Stored Cross-Site Scripting
- Broadstreet Ads <= 1.52.1 - Missing Authorization
- Avantage <= 2.4.9 - Unauthenticated PHP Object Injection
- Max Mega Menu <= 3.3. - Missing Authorization
- Fluent Booking <= 2.0.01 - Unauthenticated Stored Cross-Site Scripting via Multiple Parameters
- Bold Page Builder <= 5.7.2 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'background_image' Parameter
- BSK PDF Manager <= 3.4.1 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode
- RegistrationMagic – Custom Registration Forms and User Login <= 4.6.0.3 - Authenticated Settings Import to Privilege Escalation
- Golo <= 1.7.1 - Reflected Cross-Site Scripting
- Modular Connector <= 2.5.1 - Cross-Site Request Forgery via postConfirmOauth
- WP Import Export Lite <= 3.9.27 - Authenticated (Contributor+) DOM-Based Stored Cross-Site Scripting
- SVG Support <= 2.5.16 - Authenticated (Author+) Stored Cross-Site Scripting
- WordPress Download Manager <= 3.2.33 - Authenticated SQL Injection
- Themify Builder <= 7.0.5 - Cross-Site Request Forgery
- User Language Switch <= 1.6.10 - Authenticated (Administrator+) Server-Side Request Forgery via 'info_language' Parameter
- Optimize More! – CSS <= 1.0.3 - Cross-Site Request Forgery to Plugin Settings Reset
- ZoomSounds - WordPress Wave Audio Player with Playlist <= 6.45 - Directory Traversal
- Backuply – Backup, Restore, Migrate and Clone <= 1.2.3 - Authenticated (Administrator+) Directory Traversal
- Download Manager <= 3.3.24 - Cross-Site Request Forgery
- Persuasion <= 2.4 - Arbitrary File Deletion
- Invelity MyGLS connect <= 1.1.1 - Cross-Site Request Forgery
- Companion Auto Update <= 3.2.0 - Cross-Site Request Forgery
- Emaurri <= 1.0.1 - Unauthenticated Local File Inclusion
- Autochat Automatic Conversation <= 1.1.9 - Missing Authorization to Unauthenticated Settings Update
- MStore API <= 3.9.6 - Cross-Site Request Forgery to Order Message Update
- Travelly – Tour & Travel Booking Manager for WooCommerce | Tour & Hotel Booking Solution <= 2.1.5 - Missing Authorization
- Visual Composer Website Builder <= 45.13.0 - Authenticated (Contributor+) Stored Cross-Site Scripting
- Loginizer <= 1.7.5 - Reflected Cross-Site Scripting via 'name'
- Shortcodes Ultimate <= 5.12.0 - Cross-Site Request Forgery
- Payment Gateway for PayPal on WooCommerce <= 9.0.53 - Missing Authorization
- WooCommerce Multilingual & Multicurrency with WPML <= 5.3.3.1 - Authenticated (Shop Manager+) SQL Injection
- Ryviu – Product Reviews for WooCommerce <= 3.1.26 - Missing Authorization
- MapPress <= 2.88.16 - Authenticated (Contributor+) Stored Cross-Site Scripting via Map Settings
- Customer Reviews for WooCommerce <= 5.46.0 - Missing Authorization to Authenticated (Subscriber+) Coupon Search
- BNG Gateway For WooCommerce <= 1.6.10 - Cross-Site Request Forgery
- Dictionary <= 1.0 - Unauthenticated Stored Cross-Site Scripting
- YAWPP (Yet Another WordPress Petition Plugin) <= 1.2.2 - Cross-Site Scripting
- Booking Calendar and Booking Calendar Pro <= Multiple Versions - Reflected Cross-Site Scripting via 'calendar_id'
- Charitable <= 1.7.0.10 - Reflected Cross-Site Scripting
- ELEX WordPress HelpDesk & Customer Ticketing System <= 3.3.6 - Authenticated (Subscriber+) SQL Injection
- User Frontend <= 4.3.7 - Missing Authorization to Unauthenticated Arbitrary Attachment Deletion via 'attach_id' Parameter
- Amelia <= 2.1.1 - Authenticated (Custom role+) SQL Injection
- Post Rating and Review <= 1.3.4 - Authenticated (Contributor+) Stored Cross-Site Scripting via class Parameter
- Product list Widget for Woocommerce <= 1.0 - Reflected Cross-Site Scripting
- Captcha by BestWebSoft <= 5.2.0 - Captcha Bypass
- CM Map Locations <= 2.1.6 - Reflected Cross-Site Scripting
- Popup Builder <= 4.2.1 - Authenticated (Admin+) Stored Cross-Site Scripting
- OSS Upload <= 4.8.9 - Cross-Site Request Forgery
- Event Tickets and Registration <= 5.30.0.1 - Missing Authorization
- Off-Canvas Sidebars & Menus (Slidebars) <= 0.5.8.4 - Reflected Cross-Site Scripting
- iubenda | All-in-one Compliance for GDPR / CCPA Cookie Consent + more <= 3.13.4 - Unauthenticated Stored Cross-Site Scripting via Comment Content
- Create by Mediavine <= 2.5.3 - Unauthenticated Information Exposure
- Global Logistics <= 3.20 - Unauthenticated Local File Inclusion
- Indeed Membership Pro 7.3 - 8.6 - Authentication Bypass
- Event Tickets, RSVPs, Calendar <= 1.0.2 - Authenticated (Contributor+) Stored Cross-Site Scripting
- Yoast SEO Premium <= 27.6.0 - Authenticated (Author+) Remote Code Execution
- WP Radio – Worldwide Online Radio Stations Directory for WordPress <= 3.1.9 - Authenticated(Subscriber+) Stored Cross-Site Scripting via Settings
- Woo Custom Emails <= 2.2 - Missing Authorization to Unauthenticated Settings Change
- Responsive Addons for Elementor <= 2.0.8 - Missing Authorization
- Wanderic <= 1.0.10 - Unauthenticated Local File Inclusion
- NEX-Forms <= 7.7.1 - Missing Authorization on Various AJAX Actions
- NativeChurch <= 1.6.1 - Arbitrary File Download
- Lenix scss compiler <= 1.2 - Cross-Site Request Forgery
- HT Event <= 1.4.6 - Reflected Cross-Site Scripting
- WP File Download <= 6.3.8 - Authenticated (Subscriber+) Arbitrary File Read via Path Traversal in 'remoteurl' Parameter
- Tediss <= 1.2.4 - Unauthenticated Local File Inclusion
- Wide Banner <= 1.0.4 - Missing Authorization
- Musician's Pack for Elementor <= 1.8.4.1 - Authenticated (Contributor+) Stored Cross-Site Scripting
- Captchinoo Captcha <= 2.3 - Missing Authorization to Arbitrary Plugin Installation/Activation
- Accordion <= 2.3.11 - Authenticated (Contributor+) PHP Object Injection
- Notification – Custom Notifications and Alerts for WordPress <= 7.2.4 - Authenticated Stored Cross-Site Scripting
- Companion Auto Update <= 3.9.2 - Authenticated (Administrator+) Stored Cross-Site Scripting via update_delay_days parameter
- Super Forms <= 6.3.316 - Unauthenticated Path Traversal to Arbitrary File Read via 'sfgtfi' URL Path Parameter
- Razorpay for WooCommerce <= 4.5.6 - Cross-Site Request Forgery
- Reviews and Rating – Google My Business <= 4.14 - Missing Authorization
- Simple-Backup <= 2.7.11 - Unauthenticated Arbitrary File Download
- Modern Footnotes <= 1.4.15 - Authenticated (Administrator+) Stored Cross-Site Scripting
- IP2Location Variables <= 2.9.5 - Cross-Site Request Forgery
- markdown-it < 1.3.2 - Uncontrolled Resource Consumption
- Constant Contact Forms <= 2.4.2 - Information Disclosure via Log Files
- Oneline Lite <= 6.6 - Missing Authorization
- Paid Membership Subscriptions – Effortless Memberships, Recurring Payments & Content Restriction <= 2.13.0 - Unauthenticated Arbitrary Shortcode Execution
- Essential Addons for Elementor – Best Elementor Templates, Widgets, Kits & WooCommerce Builders <= 6.1.12 - Authenticated(Contributor+) Stored Cross-Site Scripting via Pricing Table Widget
- Nanosoft < 1.3.2 - Missing Authorization
- Optimole – Optimize Images | Convert WebP & AVIF | CDN & Lazy Load | Image Optimization <= 4.2.14 - Missing Authorization
- PostX <= 4.1.16 - Missing Authorization to Arbitrary Plugin Installation/Activation