Vulnerability archive: section 6, page 21
Open a report to review affected versions, available fixes and original sources. Each report covers a specific issue; its presence does not establish whether your website is affected.
- WP Fusion Lite <= 3.37.18 – Reflected Cross-Site Scripting
- ShopEngine Elementor WooCommerce Builder Addon <= 4.9.4 - Authenticated (Shop Manager+) Privilege Escalation to WXR Import '' Nodes
- S3 Video Plugin < 0.98 - Cross-Site Scripting
- SVG Support <= 2.5.7 - Authenticated (Author+) Cross-Site Scripting via SVG
- WP Job Portal <= 2.2.6 - Insecure Direct Object Reference to Unauthenticated Company Logo Deletion
- de:branding <= 1.0.2 - Authenticated (Subscriber+) Arbitrary Options Update
- e2pdf <= 1.25.05 - Authenticated (Contributor+) Stored Cross-Site Scripting
- Media Library Assistant <= 3.17 - Reflected Cross-Site Scripting
- WorkScout - Job Board WordPress Theme <= 2.0.31 - Stored Cross-Site Scripting
- Easy Canadian Sales Taxes Add-On for iThemes Exchange < 1.1.0 - Reflected Cross-Site Scripting
- Abandoned Cart Recovery for WooCommerce <= 1.1.12 - Missing Authorization
- MP3 Audio Player – Music Player, Podcast Player & Radio by Sonaar <= 5.12 - Missing Authorization
- 360 Javascript Viewer <= 1.7.12 - Missing Authorization to Plugin Settings Update
- Simple Certain Time to Show Content <= 1.2.2 - Reflected Cross-Site Scripting
- rexCrawler <= 1.0.15 - Reflected Cross-Site Scripting via 'url' and 'regex' Parameters
- Weather Layer <= 4.2.1 - Authenticated (Administrator+) Stored Cross-Site Scripting
- Frontend File Manager <= 18.2 - Unauthenticated Arbitrary File Download
- Formality <= 1.5.9 - Unauthenticated Local File Inclusion
- Better Search <= 4.1.0 - Authenticated (Contributor+) Stored Cross-Site Scripting
- LayerSlider 7.11.0 - Authenticated (Contributor+) Stored Cross-Site Scripting via ls_search_form Shortcode
- Sugar Calendar (Lite) <= 3.9.1 - Missing Authorization
- Assist24 Help Desk <= 20150401.2 - Authenticated (Contributor+) Stored Cross-Site Scripting
- Age Verify <= 0.2.8 - Reflected Cross-Site Scripting
- Essence < 1.1 - Reflected Cross-Site Scripting
- Quizlord <= 2.0 - Authenticated (Administrator+) Stored Cross-Site Scripting
- WP Cookies Enabler <= 1.0.1 - Unauthenticated Local File Inclusion
- My Post Order <= 1.2.1.1 - Reflected Cross-Site Scripting
- Locatoraid Store Locator <= 3.9.65 - Authenticated (Administrator+) Stored Cross-Site Scripting
- Appointment Booking Calendar — Simply Schedule Appointments Booking Plugin <= 1.6.10.6 - Unauthenticated Stored Cross-Site Scripting
- Teardrop - Fullscreen Photography Theme | Portfolio <= 1.8.5 - Arbitrary Options Update
- Quads Ads Manager for Google AdSense <= 2.0.98.1 - Authenticated (Contributor+) Stored Cross-Site Scripting via Multiple Ad Metadata Parameters
- Canva – Design beautiful blog graphics <= 1.2.4 - Reflected Cross-Site Scripting
- Ajaxify Comments <= 3.1 - Unauthenticated HTTP Header Injection
- Customer Reviews for WooCommerce <= 5.80.2 - Unauthenticated Stored Cross-Site Scripting via `author` Parameter
- Qubely – Advanced Gutenberg Blocks <= 1.8.13 - Authenticated (Contributor+) Sensitive Information Exposure via qubely_get_content
- Pie Register <= 3.0.9 - SQL Injection
- MapSVG Lite <= 8.6.4 - Missing Authorization
- Social Auto Poster <= 5.3.14 - Cross-Site Request Forgery via Multiple Functions
- Avada (Fusion) Builder <= 3.15.4 - Authenticated (Contributor+) Privilege Escalation
- GetResponse for WordPress <= 5.5.31 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode
- Surbma | Infusionsoft Shortcode <= 2.0.1 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode Attributes
- Featured Comments < 1.2.5 - Cross-Site Request Forgery
- WP Calendar <= 1.5.3 - Authenticated (Contributor+) Cross-Site Scripting
- Bubble Menu – circle floating menu <= 3.0.1 - Cross Site Request Forgery
- Big Boom Directory <= 2.5.0 - Authenticated (Contributor+) Stored Cross-Site Scripting
- WDContactFormBuilder <= 1.0.24 - Authenticated Blind SQL Injection
- Broken Link Checker <= 1.2.6 - Authenticated (Author+) SQL Injection
- Flexible Refund and Return Order for WooCommerce <= 1.0.42 - Incorrect Authorization to Authenticated (Contributor+) Refund Status Update
- WP-BibTeX <= 3.0.1 - Authenticated (Contributor+) Stored Cross-Site Scripting
- Rencontre – Dating Site <= 3.2.1 - Authenticated (Admin+) SQL Injection
- Hive Support <= 1.2.5 - Reflected Cross-Site Scripting
- Ultimate Under Construction <= 1.9.3 - Authenticated (Administrator+) Stored Cross-Site Scripting
- WooCommerce Payments 4.8.0 - 5.6.1 Authentication Bypass and Privilege Escalation
- Ultimate Gift Cards for WooCommerce <= 3.2.9 - Missing Authorization
- OWM Weather <= 5.6.11 - Cross-Site Request Forgery
- Schema Scalpel <= 1.6.1 - Authenticated (Contributor+) Stored Cross-Site Scripting via Post Title in JSON-LD Schema
- Atarim <= 4.2.1 - Unauthenticated Arbitrary File Upload
- Like DisLike Voting <= 1.0.1 - Reflected Cross-Site Scripting via $_SERVER['PHP_SELF']
- AliNext <= 3.5.1 - Open Redirect
- Multi Step Form <= 1.7.25 - Authenticated (Admin+) Arbitrary File Upload
- BP Email Assign Templates <= 1.5 - Reflected Cross-Site Scripting
- Event Tickets and Registration <= 5.29.0.1 - Missing Authorization
- HivePress Claim Listings <= 1.1.3 - Missing Authorization
- Gallery PhotoBlocks <= 1.3.3 - Authenticated (Contributor+) Stored Cross-Site Scripting
- Personizely <= 0.10 - Authenticated (Contributor+) Stored Cross-Site Scripting via widgetId Parameter
- Tom M8te <= 1.5.3 - Directory Traversal
- Anant Addons for Elementor <= 1.1.8 - Cross-Site Request Forgery to Arbitrary Plugin Installation
- Shared Files – Easy Download Manager and File Sharing Plugin with Frontend File Upload <= 1.6.60 - Cross-Site Scripting
- Notification for Telegram <= 3.5 - Unauthenticated Stored Cross-Site Scripting
- Modal Popup Box <= 1.6.1 - Authenticated (Contributor+) PHP Object Injection
- Slimstat Analytics <= 4.8.3 - Cross-Site Request Forgery to Stored Cross-Site Scripting
- Bard <= 2.210 - Cross-Site Request Forgery to Notice Dismissal
- Frontend File Manager Plugin <= 18.2 - Unauthenticated Arbitrary Post Deletion
- Save as PDF plugin by Pdfcrowd <= 4.0.0 - Authenticated (Administrator+) Stored Cross-Site Scripting
- PDF for Contact Form 7 + Drag and Drop Template Builder <= 6.3.3 - Missing Authorization to Authenticated (Subscriber+) Arbitrary Post Duplication
- SlimStat Analytics <= 5.1.3 - Authenticated (Subscriber+) Stored Cross-Site Scripting
- InfusedWoo Pro <= 5.1.2 - Unauthenticated Arbitrary File Read via 'url' Parameter
- WPify Woo <= 5.4.16 - Authenticated (Shop Manager+) Privilege Escalation via Arbitrary Option Update via save_option REST Endpoint
- Download Manager <= 3.2.48 - Cross-Site Request Forgery to Plugin Settings Update
- Simply Schedule Appointments <= 1.6.12.29 - Missing Authorization
- Product Configurator for WooCommerce <= 1.7.2 - Unauthenticated Private/Draft Product Data Disclosure
- Tera Charts <= 1.0 - Reflected Cross-Site Scripting
- AdForest <= 5.1.8 - Authentication Bypass
- Kirki <= 6.0.13 - Authenticated (Editor+) Path Traversal to Arbitrary Directory Deletion via 'family' Parameter
- WP Customer Reviews <= 3.5.5 - Authenticated Stored Cross-Site Scripting
- Perfect Portfolio <= 1.2.4 - Missing Authorization
- WPBot <= 8.5.6 - Missing Authorization to Unauthenticated Arbitrary Chat Session Deletion via 'userid' Parameter
- Photo Album Plus <= 9.2.07.1 - Reflected Cross-Site Scripting
- WP SexyLightBox <= 0.5.3 - Cross-Site Request Forgery to Stored Cross-Site Scripting
- Easy!Appointments <= 1.3.1 - Authenticated (Contributor+) Stored Cross-Site Scripting
- Rocket <= 3.19.4 - Authenticated (Author+) Stored Cross-Site Scripting
- Paid Videochat Turnkey Site – HTML5 PPV Live Webcams <= 7.3.23 - Missing Authorization
- WP Travel Engine – Elementor Widgets | Create Travel Booking Website Using WordPress and Elementor <= 1.3.7 - Authenticated (Contributor+) Local File Inclusion
- WP Helper Premium < 4.6.0 - Reflected Cross-Site Scripting
- Sender – Newsletter, SMS and Email Marketing Automation for WooCommerce <= 2.6.18 - Cross-Site Request Forgery
- Change WP Admin Login <= 1.1.3 - Protection Mechanism Failure to Login Page Disclosure
- Betheme <= 27.5.6 - Authenticated (Contributor+) PHP Object Injection
- Survey Maker <= 5.1.9.4 - Missing Authorization to Unauthenticated Information Exposure
- MomentoPress for Momento360 <= 1.0.1 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode
- Backup Migration 1.0.8 - 1.3.9 - Remote File Inclusion via content-dir