Vulnerability archive: section 6, page 17
Open a report to review affected versions, available fixes and original sources. Each report covers a specific issue; its presence does not establish whether your website is affected.
- WP Google Calendar Manager <= 2.1 - Authenticated (Subscriber+) SQL Injection
- Bing Search API Integration <= 0.3.3 - Reflected Cross-Site Scripting
- Jetpack Boost <= 3.4.6 - Authenticated (Admin+) Server-Side Request Forgery
- Taqnix <= 1.0.3 - Cross-Site Request Forgery to Account Deletion via 'taqnix_delete_my_account' AJAX Action
- Event Manager, Events Calendar, Tickets, Registrations – Eventin <= 4.0.8 - Authenticated (Contributor+) Local File Inclusion
- Dynamic Font Replacement DFR4WP EN <= 1.3 EN - Arbitrary File Deletion
- Permalink Manager Lite <= 2.5.3.3 - Authenticated (Contributor+) Stored Cross-Site Scripting via Post Title
- MLL Audio Player MP3 Ajax <= 0.7 - Authenticated (Subscriber+) Stored Cross-Site Scripting
- King Addons for Elementor – 80+ Elementor Widgets, 4 000+ Elementor Templates, WooCommerce, Mega Menu, Popup Builder < 51.1.77 - Authenticated (Contributor+) Stored Cross-Site Scripting
- ApplyOnline – Application Form Builder and Manager <= 2.6.7.1 - Missing Authorization
- ShortPixel Adaptive Images <= 3.7.1 - Cross-Site Request Forgery via shortpixel_ai_handle_page_action
- Profitori 2.0.6.0 - 2.1.1.3 - Missing Authorization to Unauthenticated Privilege Escalation via stocktend_object Endpoint
- Export All URLs <= 4.2 - Cross-Site Request Forgery to Sensitive Data Export
- Boo Recipes <= 2.4.1 - Authenticated (Contributor+) Stored Cross-Site Scripting
- UserPlus <= 2.0 - Cross-Site Request Forgery to Stored Cross-Site Scripting
- Opti-Behavior <= 1.9.2.1 - Unauthenticated Stored DOM-Based Cross-Site Scripting via 'targetUrl' Parameter
- Smart Custom Fields <= 5.0.7 - Authenticated (Author+) Stored Cross-Site Scripting via Attachment Title
- LuckyWP Table of Contents <= 2.1.10 - Cross-Site Request Forgery to Reflected Cross-Site Scripting
- rtMedia for WordPress, BuddyPress and bbPress <= 4.6.14 - Missing Authorization to Sensitive Information Exposure
- Church Admin <= 3.7.29 - Reflected Cross-Site Scripting
- Booking for Appointments and Events Calendar – Amelia 1.2.32 - 2.4.8 - Missing Authorization
- Gutenverse Form <= 2.3.2 - Authenticated (Author+) Stored Cross-Site Scripting via SVG File Upload
- 爱采集数据采集和发布插件 <= 1.0.0 - Missing Authorization
- YOP Poll <= 6.5.26 - Race Condition to Vote Manipulation
- iXML – Google XML sitemap generator <= 0.6 - Reflected Cross-Site Scripting via 'iXML_email' Parameter
- FormCraft <= 3.9.14 - Unauthenticated Stored Cross-Site Scripting via Matrix Field Sub-Parameters
- VikRestaurants Table Reservations and Take-Away <= 1.5.2 - Reflected Cross-Site Scripting
- Content Blocks (Custom Post Widget) <= 3.3.0 - Authenticated (Contributor+) Stored Cross-Site Scripting via content_block Shortcode
- Category Post List Widget <= 2.0 - Unauthenticated Stored Cross-Site Scripting via custom_css
- LearnPress <= 4.3.2.8 - Missing Authorization to Unauthenticated Arbitrary Quiz Answer Deletion
- Social Analytics <= 0.2 - Cross-Site Request Forgery to Stored Cross-Site Scripting
- CM Pop-Up banners <= 1.5.10 - Authenticated (Subscriber+) SQL Injection via getStatistics
- eMagicOne Store Manager for WooCommerce <= 1.2.5 - Unauthenticated Arbitrary File Read
- WordPress Poll <= 36 - SQL Injection
- WP AutoKeyword <= 1.0 - Missing Authorization
- Category Custom Fields <= 1.0 - Cross-Site Request Forgery to Stored Cross-Site Scripting
- Spider Facebook <= 1.0.15 - Cross-Site Request Forgery
- NinjaTeam Header Footer Custom Code < 1.2 - Authenticated (Admin+) Stored Cross-Site Scripting via CSS Styles
- Pure Chat – Live Chat Plugin & More! <= 2.22 - Authenticated (Subscriber+) Stored Cross-Site Scripting
- Email Subscribers by Icegram Express – Affordable, Powerful Email Marketing for WordPress & WooCommerce <= 5.7.44 - Authenticated (Admin+) Stored Cross-Site Scripting
- Job Openings <= 3.0.0 - Authenticated (Administrator+) Stored Cross-Site Scripting
- WPForms Lite <= 1.9.3.1 - Authenticated (Contributor+) Stored Cross-Site Scripting via fieldHTML Parameter
- BSK PDF Manager <= 1.4 - Authenticated SQL Injection
- Passster – Password Protect Pages and Content <= 4.2.10 - Unauthenticated Content Restriction Bypass to Sensitive Information Exposure
- Event Tickets and Registration <= 5.26.5 - Unauthenticated Ticket Payment Bypass
- xPinner Lite <= 2.2 - Cross-Site Request Forgery
- Nexter Blocks <= 4.5.4 - Authenticated (Contributor+) Stored Cross-Site Scripting via Multiple Widgets
- WooCommerce Point Of Sale (POS) <= 1.4 - Authenticated (Subscriber+) SQL Injection
- WordPress Core <= 2.3.2 - Cross-Site Scripting
- WPFront User Role Editor <= 3.2.0 - Reflected Cross-Site Scripting
- Paytium: Mollie payment forms & donations <= 4.3.7 - Missing Authorization in 'paytium_notice_dismiss'
- Easy Digital Downloads – Simple eCommerce for Selling Digital Files <= 2.11.2 - Reflected Cross-Site Scripting
- Ideal Interactive Map <= 1.2.4 - Authenticated (Contributor+) Stored Cross-Site Scripting
- Ultimate TinyMCE <= 5.7 - Authenticated (Contributor+) Stored Cross-Site Scripting
- Envira Gallery <= 1.12.4 - Authenticated (Author+) Stored Cross-Site Scripting via Gallery Description
- ActivityPub <= 0.17.0 - Authenticated (Contributor+) Stored Cross-Site Scripting via Post Content
- ULeak Security & Monitoring Plugin <= 1.2.3 - Stored Cross-Site Scripting
- WordPress Core 4.7.0 - 7.1.2 - Unauthenticated Sensitive Information Exposure via Comment Feeds
- Custom 404 Pro <= 3.12.0 - Cross-Site Request Forgery
- Dropdown Multisite selector <= 0.9.2 - Authenticated (Contributor+) Stored Cross-Site Scripting via shortcode
- HT Mega – Absolute Addons For Elementor <= 2.5.5 - Authenticated (Contributor+) Stored Cross-Site Scripting via Video Player Widget Settings
- Qi Blocks <= 1.3 - Authenticated (Contributor+) Stored Cross-Site Scripting
- Google Docs RSVP <= 2.0.1 - Cross-Site Request Forgery to Stored Cross-Site Scripting
- Avada (Fusion) Builder <= 3.14.1 - Authenticated (Contributor+) Stored Cross-Site Scripting
- Pie Register <= 3.8.4.13 - Unauthenticated Information Exposure
- s2Member <= 260127 - Unauthenticated Privilege Escalation via Account Takeover
- The Events Calendar <= 6.13.2 - Authenticated (Contributor+) DOM-Based Stored Cross-Site Scripting
- GiveWP <= 2.25.1 - Cross-Site Request Forgery via process_bulk_action
- Popup Builder <= 1.1.33 - Authenticated (Contributor+) Stored Cross-Site Scripting
- WP Express Checkout (Accept PayPal Payments) <= 2.3.7 - Unauthenticated Price Manipulation
- Video Conferencing with Zoom <= 4.6.9 - Authenticated (Contributor+) Stored Cross-Site Scripting
- Gmedia Photo Gallery <= 1.6.4 - Local File Inclusion
- Responsive Addons for Elementor – Free Elementor Addons Plugin and Elementor Templates <= 1.6.8 - Authenticated (Contributor+) Sensitive Information Exposure
- Super Store Finder <= 6.1, Super Interactive Maps <= 1.9, Super Logo Showcase <= 2.2 - Arbitrary File Upload
- Slider by 10Web – Responsive Image Slider <= 1.2.63 - Authenticated (Author+) SQL Injection
- WP w3all phpBB <= 3.0.5 - Authenticated (Subscriber+) SQL Injection
- Gallery Block (Meow Gallery) <= 5.1.3 - Authenticated (Contributor+) Stored Cross-Site Scripting
- affiliate-toolkit – WordPress Affiliate Plugin <= 3.3.3 - Authenticated (Editor+) Stored Cross-Site Scripting
- Resca <= 3.0.2 - Reflected Cross-Site Scripting
- File Manager Pro <= 8.3.9 - Unauthenticated Backup File Download and Upload
- Quantum <= 1.0 - Unauthenticated Local File Inclusion
- WishSuite <= 1.3.4 - Authenticated (Administrator+) Stored Cross-Site Scripting
- Import and export users and customers <= 2.4.5 - Authenticated (Custom+) Stored Cross-Site Scripting via User Meta Profile Fields
- Taxi Booking Manager for WooCommerce – WordPress plugin | Ecab <= 1.1.8 - Authenticated (Contributor+) PHP Object Injection
- Solene <= 3.4 - Unauthenticated Local File Inclusion
- Funnelforms Free <= 3.4 - Cross-Site Request Forgery to Arbitrary Post Deletion
- Youzify <= 1.3.6 - Authenticated (Subscriber+) Stored Cross-Site Scripting via 'checkin_place_id' Parameter
- Login Page Styler <= 6.2 - Authenticated (Administrator+) Stored Cross-Site Scripting
- Busiprof <= 2.4.8 - Authenticated (Contributor+) Stored Cross-Site Scripting
- Block Referer Spam <= 1.1.9.4 - Authenticated (Administrator+) Stored Cross-Site Scripting
- Bit File Manager <= 5.2.7 - Authenticated (Admin+) PHP Object Injection
- Custom Fields Account Registration For WooCommerce <= 1.3 - Unauthenticated Privilege Escalation
- Gallery Bank – WordPress Photo Gallery Plugin <= 3.0.229 - SQL Injection
- Beacon Lead Magnets and Lead Capture <= 1.5.7 - Reflected Cross-Site Scripting
- Rate my Post - WP Rating System <= 3.4.1 - Insecure Direct Object Reference
- Eagle Booking <= 1.3.4.3 - Missing Authorization to Authenticated (Subscriber+) Settings Change
- Limit Login Attempts (Spam Protection) <= 2.9 - Cross-Site Request Forgery to Arbitrary Plugin Installation/Activation
- Charitable <= 1.8.11.1 - Authenticated (Subscriber+) Insecure Direct Object Reference to Arbitrary Attachment Deletion via 'avatar' Parameter
- Post SMTP <= 2.9.9 - Authenticated (Administrator+) SQL Injection
- SpeakOut! Email Petitions <= 2.13.1.1 - Cross-Site Scripting