Vulnerability archive: section 6, page 14
Open a report to review affected versions, available fixes and original sources. Each report covers a specific issue; its presence does not establish whether your website is affected.
- Media Library Folders <= 8.3.0 - Missing Authorization to Plugin Settings Change
- Responsive Accordion Slider <= 1.2.2 - Missing Authorization to Authenticated (Contributor+) Slider Update via 'resp_accordion_silder_save_images'
- PostX - Gutenberg Blocks for Post Grid <= 2.4.9 - Unauthorized Access Controls
- Add From Server <= 3.3.1 - Cross-Site Request Forgery
- Qubely – Advanced Gutenberg Blocks <= 1.8.12 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'align' and 'UniqueID'
- Directory Listings WordPress plugin – uListing <= 2.2.0 - Authenticated (Subscriber+) Privilege Escalation
- Debug Tool <= 2.2 - Unauthenticated Remote Code Execution
- WP Discord Invite < 2.5.1 - Cross-Site Request Forgery to Settings Update
- Travel & Tours Meta Search <= 2.3 - Reflected Cross-Site Scripting
- WP eMember <= 10.6.6 - Reflected Cross-Site Scripting via $_SERVER['REQUEST_URI']
- Pinpoint Booking System – #1 WordPress Booking Plugin <= 1.3.1 - Reflected Cross-Site Scripting
- MBStore - Digital WooCommerce WordPress Theme <= 2.3 - Unauthenticated Local File Inclusion
- Tutor LMS <= 1.9.11 - Reflected Cross-Site Scripting
- Generate PDF using Contact Form 7 <= 3.5 - Authenticated (Administrator+) Stored Cross-Site Scripting
- Global Content Blocks <= 2.1.5 - Cross-Site Request Forgery
- Post Carousel Slider for Elementor <= 1.6.0 - Authenticated (Subscriber+) Missing Authorization via process_wbelps_promo_form Function
- WPLMS < 1.9.9.5.2 - Authenticated (Contributor+) Arbitrary Directory Deletion
- Stock Quotes List <= 2.9.11 - Authenticated (Contributor+) Stored Cross-Site Scripting
- Related Posts by Taxonomy <= 2.7.6 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'related_posts_by_tax' Shortcode
- WP All Import <= 3.4.5 - Cross-Site Scripting
- WPBookit <= 1.0.4 - Authenticated (Subscriber+) Arbitrary File Upload
- Betheme <= 28.4 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'icon_box_2' Shortcode
- Wp Maximum Upload File Size <= 1.1.3 - Authenticated (Author+) Full Path Disclosure
- Computer Repair Shop <= 3.8115 - Unauthenticated Arbitrary File Upload
- Advanced Dynamic Pricing for WooCommerce <= 4.1.5 - Missing Authorization
- A Simple Multilanguage Plugin <= 1.0 - Authenticated (Contributor+) Stored Cross-Site Scripting
- St Daily Tip <= 4.7 - Cross-Site Request Forgery to Stored Cross-Site Scripting
- UltraAddons <= 2.0.0 - Cross-Site Request Forgery
- StickEasy Protected Contact Form <= 1.0.1 - Unauthenticated Information Disclosure
- Woffice Core <= 5.4.30 - Missing Authorization
- MailerPress <= 2.0.4 - Authenticated (Author+) Stored Cross-Site Scripting via Campaign HTML Content Field
- XML Sitemaps <= 4.1.1 - Authenticated (Admin+) Cross-Site Scripting
- Source (All Versions) - Cross-Site Scripting
- Custom Order Numbers for WooCommerce <= 1.6.0 - Cross-Site Request Forgery to Notice Dismissal
- Download Monitor < 3.3.6.2 - Cross-Site Scripting via p Parameter
- Genolve – AI image AI video generation <= 5.0.5 - Authenticated (Contributor+) Incorrect Authorization to Privilege Escalation via theopt
- WP Books Gallery <= 4.8.0 - Missing Authorization to Unauthenticated Settings Update via 'permalink_structure' Parameter
- PixTypes <= 1.4.14 - Cross-Site Request Forgery
- Sell Media <= 2.4.1 - Cross-Site Scripting
- SpiderVPlayer <= 1.5.1 - Cross-Site Scripting
- PDF for WPForms <= 5.5.0 - Missing Authorization
- WooCommerce Stripe Payment Gateway <= 7.4.0 - Missing Authorization
- LWS Optimize <= 4.1.1 - Unauthenticated Stored Cross-Site Scripting
- Oshine Modules < 3.3.8 - Unauthenticated Server-Side Request Forgery
- Participants Database <= 1.7.5.9 - Unauthorized Cross-Site Scripting
- WP Helper Premium <= 4.5.1 - Cross-Site Request Forgery via whp_fields
- School Management System for Wordpress <= 93.1.0 - Authenticated (Subscriber+) Local File Inclusion to Privilege Escalation via Password Update
- Frontend File Manager <= 18.2 - Authenticated Settings Change leading to Arbitrary File Upload
- Admin Management Xtended <= 2.4.0 - Missing Authorization Checks
- Pósturinn\'s Shipping with WooCommerce <= 1.3.1 - Reflected Cross-Site Scripting
- Slivery Extender <= 1.0.2 - Authenticated(Contributor+) Remote Code Execution via shortcode
- Folders – Unlimited Folders to Organize Media Library Folder, Pages, Posts, File Manager <= 3.1.5 - Missing Authorization to Authenticated (Author+) Media Replacement
- Store Locator < 3.34 - SQL Injection
- FastPicker, an order picker and order management system (oms) for WooCommerce on steroids <= 1.0.2 - Cross-Site Request Forgery via Settings Save
- AcyMailing – An Ultimate Newsletter Plugin and Marketing Automation Solution for WordPress <= 11.0.5 - Unauthenticated Remote Code Execution
- SexBundle <= 1.4 - Reflected Cross-Site Scripting
- Impacto Patronus <= 1.2.3 - Unauthenticated Local File Inclusion
- 3DPrint <= 3.5.6.8 - Cross-Site Request Forgery to Arbitrary File Download
- Advanced Contact form 7 DB <= 2.1.3 - Missing Authorization to Authenticated (Custom+) Unauthorized Data Import via 'import_cf7_id'
- Salon booking system <= 9.6.5 - Authenticated (Editor+) Stored Cross-Site Scripting via Email Settings
- Altair <= 5.2.2 - Missing Authorization
- scrollup <= 1.1 - Authenticated (Contributor+) Stored Cross-Site Scripting
- demon image annotation <= 4.7 - Cross-Site Request Forgery to Cross-Site Scripting
- RSFirewall! <= 1.1.42 - Authenticated (Admin+) Arbitrary File Read
- WP Time Slots Booking Form <= 1.2.10 - Unauthenticated Stored Cross-Site Scripting
- 360 Javascript Viewer <= 1.7.29 - Authenticated (Administrator+) Stored Cross-Site Scripting
- nBlocks <= 1.0.2 - Authenticated (Contributor+) Local File Inclusion
- School Management <= 93.1.0 - Unauthenticated Insecure Direct Object Reference
- Theme Demo Import <= 1.1.3 - Authenticated (Administrator+) Arbitrary File Upload
- Auberge < 1.4.5 - Cross-Site Scripting
- MagicForm <= 0.1.3 - Unauthenticated Arbitrary File Upload
- EELV Newsletter < 4.6.1 - Cross-Site Scripting
- Album and Image Gallery with Lightbox – Flagallery Photo Portfolio <= 0.59 - SQL Injection
- StoreEngine – Powerful WordPress eCommerce Plugin for Payments, Memberships, Affiliates, Sales & More <= 1.5.0 - Authenticated (Subscriber+) Arbitrary File Upload
- WordPress Activity-o-meter <= 1 - Reflected Cross-Site Scripting
- WP Github <= 1.3.3 - Authenticated (Contributor+) Stored Cross-Site Scripting
- 3D Flipbook PDF Viewer & Embedder <= 1.4.2 - Unauthenticated Server-Side Request Forgery
- Pretty file links <= 0.9 - Authenticated (Contributor+) Stored Cross-Site Scripting
- ListingPro <= 2.9.4 - Cross-Site Request Forgery to Account Takeover
- Easy Digital Downloads <= 3.6.9 - Unauthenticated Stored Cross-Site Scripting via PayPal IPN Parameters
- EM Cost Calculator <= 2.3.1 - Unauthenticated Stored Cross-Site Scripting via 'customer_name'
- Photo Gallery by Ays - Responsive Image Gallery <= 4.4.3 - Authenticated Blind SQL Injections
- WordPress Classifieds Plugin – Ad Directory & Listings by AWP Classifieds < 2.0 - Arbitrary File Upload
- Foxtool All-in-One: Contact chat button, Custom login, Media optimize images <= 2.5.2 - Cross-Site Request Forgery to Google OAuth Connection
- jQuery googleslides <= 1.3 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode Attributes
- ProfilePress <= 4.15.14 - Authenticated (Admin+) Stored Cross-Site Scripting via "Product Files"
- MailArchiver <= 4.5.0 - Authenticated (Admininistrator+) SQL Injection via 'logid' Parameter
- Audio Comments Plugin <= 1.0.4 - Cross-Site Request Forgery to Stored Cross-Site Scripting
- BuddyPress <= 12.4.0 - Authenticated (Subscriber+) Stored Cross-Site Scripting
- Support Board < 3.8.7 - Reflected Cross-Site Scripting
- Service Finder Bookings <= 5.1 - Unauthenticated Privilege Escalation via 'nsl_registration_store_extra_input'
- Ultra Addons Lite for Elementor <= 1.1.8 - Authenticated (Contributor+) Restricted Post Disclosure
- WP Symposium < 11.12.24 - Arbitrary File Upload
- Advanced Custom Fields: Extended < 0.9.2.7 - Unauthenticated Privilege Escalation via Administrator Account Takeover
- Backup Guard <= 1.5.9 - Authenticated Arbitrary File Upload
- Easy Appointments <= 3.11.9 - Cross-Site Request Forgery via multiple AJAX actions
- ProfileGrid <= 5.9.4.8 - Authenticated (Subscriber+) SQL Injection
- Code Snippets Extended <= 1.4.7 - Cross-Site Request Forgery
- Gecko <= 1.9.8 - Unauthenticated Local File Inclusion
- Borderless – Widgets, Elements, Templates and Toolkit for Elementor & Gutenberg <= 1.4.8 - Authenticated (Administrator+) Stored Cross-Site Scripting