Vulnerability archive: section 6, page 12
Open a report to review affected versions, available fixes and original sources. Each report covers a specific issue; its presence does not establish whether your website is affected.
- Content Staging <= 2.0.1 - Authenticated (Admin+) Stored Cross-Site Scripting
- HotelRunner Booking Widget <= 1.6 - Cross-Site Request Forgery
- Easy Testimonial Slider and Form <= 1.0.2 - Authenticated (Admin+) SQL injection
- Elegant Visitor Counter <= 3.1 - Authenticated (Administrator+) Stored Cross-Site Scripting
- ThemeFuse Maintenance Mode <= 1.1.3 - Cross-Site Request Forgery to Stored Cross-Site Scripting
- UserPro <= 4.9.27 - Privilege Escalation
- Cliengo – Chatbot <= 3.0.4 - Cross-Site Request Forgery
- BuddyPress WooCommerce My Account Integration. Create WooCommerce Member Pages <= 3.4.20 - Authenticated (Subscriber+) PHP Object Injection in get_simple_request
- Multiple Page Generator Plugin <= 3.3.17 - Authenticated (Administrator+) SQL Injection
- Forminator Forms – Contact Form, Payment Form & Custom Form Builder <= 1.57.3 - Cross-Site Request Forgery
- Hot Linked Image Cacher <= 1.16 - Cross-Site Request Forgery
- Element Pack Elementor Addons <= 5.4.11 - Missing Authorization via bdt_duplicate_as_draft
- Chamber Dashboard Business Directory < 3.3.1 - Cross-Site Scripting
- Dreamstime Stock Photos <= 4.1 - Reflected Cross-Site Scripting
- iframe forms <= 1.0 - Authenticated (Contributor+) Stored Cross-Site Scripting via iframe Shortcode
- Simple Stripe <= 0.9.17 - Cross-Site Request Forgery
- Page Builder by AZEXO <= 1.27.133 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode
- Church Admin <= 5.0.26 - Missing Authorization
- Better Messages <= 1.9.9.148 - Cross-Site Request Forgery
- BackupEase – Scheduled Backup, Restore & Site Migration <= 2.2.2 - Unauthenticated Information Exposure
- Anton Extensions <= 1.2.2 - Unauthenticated Arbitrary File Upload
- Profile Builder <= 3.4.7 - Authenticated (Administrator+) Stored Cross-Site Scripting
- Bold Page Builder <= 4.3.2 - Authenticated (Admin+) Stored Cross-Site Scripting
- Login with phone number <= 1.7.16 - Unauthorized Account Password Change to Privilege Escalation
- New User Approve <= 2.6.2 - Missing Authorization
- WP Recipe Maker <= 9.1.2 - Missing Authorization to Authenticated (Subscriber+) SQL Injecton
- ExactMetrics 7.1.0 - 9.0.2 - Authenticated (Custom) Improper Privilege Management to Role Privilege Escalation via Settings Update
- Web Directory Free <= 1.7.2 - Unauthenticated Local File Inclusion
- Simple Events Calendar < 1.3.6 - Authenticated (Admin+) SQL Injection
- Tabs – Responsive Tabs with WooCommerce Product Tab Extension <= 3.6.0 - Authenticated (Admin+) Arbitrary Options Update
- WP Facethumb <= 1.0 - Cross-Site Scripting
- Dropdown and scrollable Text <= 2.0 Reflected Cross-Site Scripting
- Animated Number Counters <= 3.0 - Authenticated (Editor+) SQL Injection via 'counterid' Parameter
- Airano MCP Bridge <= 2.11.0 - Missing Authorization
- Meloo < 2.8.2 - Authenticated (Subscriber+) PHP Object Injection
- Mobi2Go <= 1.0.0 - Authenticated (Administrator+) Stored Cross-Site Scripting
- Simple:Press Forum <= 6.10.11 - Reflected Cross-Site Scripting
- Profile Builder <= 2.4.0 - Privilege Escalation
- Amazon Auto Links <= 4.6.19 - Reflected Cross-Site Scripting
- N5 Upload Form <= 1.0 - Arbitrary File Upload
- Malcure Malware Scanner — #1 Toolset for WordPress Malware Removal <= 17.0 - Authenticated (Subscriber+) Arbitrary File Deletion
- The Plus Addons for Elementor <= 5.5.4 - Authenticated (Contibutor+) Stored Cross-Site Scripting via Hover Card
- WPML Multilingual CMS 3.6.0 - 4.7.3 - Authenticated (Contributor+) Stored Cross-Site Scripting via wpml_language_switcher Shortcode
- Tasty Recipes Lite <= 1.1.5 - Missing Authorization
- Ultimate Addons for Elementor Lite <= 2.4.9 - Authenticated (Author+) Stored Cross-Site Scripting via SVG Upload
- MailChimp Subscribe Forms <= 4.1 - Authenticated (Contributor+) Stored Cross-Site Scripting
- WordPress Core < 4.3.1 - Authorization Bypass to Information Disclosure
- Dashboard To-Do List <= 1.2.0 - Missing Authorization via ardtdw_widgetsetup()
- Backhoe <= 2.0 - Unauthenticated Local File Inclusion
- Post Grid Elementor Addon <= 2.0.18 - Authenticated (Contributor+) Stored Cross-Site Scripting
- Fancy Product Designer <= 6.5.2 - Unauthenticated Stored Cross-Site Scripting via 'productTitle' in '_fpd_data' Order Item Meta
- Bit Assist <= 1.5.11 - Missing Authorization
- Cooked – Recipe Management <= 1.7.15.4 - Cross-Site Request Forgery to Template Apply
- Wordpress Core < 5.5 - Unauthorized Password Reset via Interception
- WebinarIgnition – Live, Automated & Evergreen Webinar System also for WooCommerce < 4.08.253 - Unauthenticated Privilege Escalation
- Sketchfab Embed <= 1.5 - Authenticated (Contributor+) Stored Cross-Site Scripting
- Video Posts Webcam Recorder < 3.2.4 - Cross-Site Scripting
- Export Categories <= 1.0 - Missing Authorization
- Lorem Ipsum | Books & Media Store <= 1.2.6 - Unauthenticated PHP Object Injection
- Ultimate Maps by Supsystic <= 1.2.4 - Reflected Cross-Site scripting
- All In One WP Security & Firewall <= 3.9.0 - SQL Injection
- WPComplete <= 2.9.5 - Authenticated (Contributor+) Stored Cross-Site Scripting
- WPC Product Bundles for WooCommerce <= 8.6.6 - Unauthenticated Stored Cross-Site Scripting via 'qty' Parameter
- Betheme <= 27.6.1 - Authenticated (Contributor+) Stored Cross-Site Scripting via Custom JS
- NP Quote Request for WooCommerce <= 1.9.179 - Insecure Direct Object Reference to Unauthenticated Sensitive Information Disclosure
- FluentBoards <= 2.0.14 - Authenticated (Subscriber+) Information Exposure
- Quill Forms | The Best Typeform Alternative | Create Conversational Multi Step Form, Survey, Quiz, Cost Estimation or Donation Form on WordPress <= 3.10.0 - Authenticated (Contributor+) Stored Cross-Site Scripting
- Comment Reply Notification <= 1.4 - Cross-Site Request Forgery
- ImageMagick Engine <= 1.7.5 - Cross-Site Request Forgery to PHAR Deserialization
- Message Filter for Contact Form 7 <= 1.6.3 - Missing Authorization
- Webmention <= 5.8.0 - Unauthenticated Stored Cross-Site Scripting via MF2 'photo'/'url' Author Properties
- WP All Import <= 3.4.6 - Cross-Site Scripting
- Gioia <= 1.4 - Unauthenticated Local File Inclusion
- LatePoint – Calendar Booking Plugin for Appointments and Events <= 5.2.6 - Missing Authorization to Booking Details Exposure
- PublishPress Revisions: Duplicate Posts, Submit, Approve and Schedule Content Changes <= 3.7.22 - Cross-Site Request Forgery
- Google Apps Login <= 3.4.4 - Authenticated (Administrator+) Stored Cross-Site Scripting
- WP CSV Exporter <= 1.3.6 - CSV Injection
- Import any XML or CSV File to WordPress <= 3.6.6 - Reflected Cross-Site Scripting
- WordPress Core < 5.4.2 - Arbitrary User Meta Update
- Visitor Traffic Real Time Statistics <= 2.13 - Cross-Site Request Forgery to Arbitrary Plugin Installation/Activation
- TITLE ANIMATOR <= 1.0 - Cross-Site Request Forgery to Settings Update
- Newsletter Subscriptions <= 2.1 - Reflected Cross-Site Scripting
- WordPress Integrator <= 1.32 - Cross-Site Scripting
- wp secure <= 1.2 - Reflected Cross-Site Scripting
- Metform Elementor Contact Form Builder <= 3.8.5 - Authenticated (Contributor+) Stored Cross-Site Scripting via Widgets
- Daily Prayer Time <= 2024.08.26 - Authenticated (Contributor+) SQL Injection
- Tonda Core <= 2.1.2 - Authenticated (Contributor+) Local File Inclusion
- Simple User Registration <= 6.6 - Unauthenticated Stored Cross-Site Scripting
- Cost Calculator Builder <= 3.6.17 - Missing Authorization to Authenticated (Subscriber+) Sensitive Information Disclosure
- Online Booking & Scheduling Calendar by vcita <= 4.6.0 - Missing Authorization
- Fluent Support <= 2.3.0 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'redirect-to' Shortcode Attribute
- Easy Testimonials <= 1.36.1 - Authenticated Stored Cross-Site Scripting
- Redirect Redirection <= 1.1.3 - Missing Authorization in 'liveSearch' function
- Bootscraper <= 3.0.0 - Unauthenticated Local File Inclusion
- Copy or Move Comments < 1.0.1 - Cross-Site Scripting and SQL Injection
- Publish approval <= 1.1 - Cross-Site Request Forgery
- Zynith SEO <= 7.4.9 - Missing Authorization to Unauthenticated Arbitrary Option Deletion
- Modal Window <= 6.0.3 - Authenticated (Contributor+) Stored Cross-Site Scripting
- Gutenverse Form – Contact Form Builder, Block Form & Booking Form < 3.0.11 - Authenticated (Contributor+) Stored Cross-Site Scripting
- EmbedPress <= 3.9.1 - Reflected Cross-Site Scripting