Vulnerability archive: section 6, page 23
Open a report to review affected versions, available fixes and original sources. Each report covers a specific issue; its presence does not establish whether your website is affected.
- PictoBrowser Gallery <= 0.3.1 - Cross-Site Request Forgery
- Tutor LMS Pro <= 3.9.6 - Unauthenticated SQL Injection
- Additional Order Filters for WooCommerce <= 1.22 - Cross-Site Request Forgery
- Bopo – WooCommerce Product Bundle Builder <= 1.1.6 - Unauthenticated Sensitive Information Exposure
- Themify Builder <= 7.6.5 - Authenticated (Contributor+) Stored Cross-Site Scripting
- Portfolio – WordPress Portfolio Plugin <= 2.8.8 - Cross-Site Request Forgery in rtport_spare_me
- Send PDF for Contact Form 7 <= 1.0.2.3 - Missing Authorization
- Invitation Based Registrations <= 2.2.84 - Authenticated (Admin+) Stored Cross-Site Scripting
- HUSKY - Products Filter Professional for WooCommerce <= 1.3.6 - Unauthenticated Time-Based SQL Injection
- HUSKY – Products Filter Professional for WooCommerce <= 1.3.6.1 - Insecure Direct Object Reference to Unsubscribe
- Tutor LMS <= 1.9.10 - Reflected Cross-Site Scripting
- Share This Image <= 2.12 - Missing Authorization
- Ibtana – WordPress Website Builder <= 1.2.4.4 - Authenticated (Contributor+) Stored Cross-Site Scripting via align Attribute
- Shortcut Macros <= 1.3 - Missing Authorization to Settings Update
- Job Board Manager <= 2.1.60 - Missing Authorization
- Fluent Support <= 1.5.7 - Authenticated (Administrator+) SQL Injection
- Icons for Features <= 1.0.0 - Reflected Cross-Site Scripting
- Kubio AI Page Builder <= 2.9.2 - Authenticated (Contributor+) Stored Cross-Site Scripting
- SureForms – Drag and Drop Form Builder for WordPress <= 1.12.0 - Missing Authorization to Authenticated (Contributor+) Form Creation
- Dokan Pro <= 5.0.4 - Authenticated (Subscriber+) SQL Injection via 'orderby' Parameter
- Ultimate Product Catalog < 2.1.1 - Authenticated (Admin+) SQL Injection
- Responsive Sidebar <= 1.2.2 - Unauthenticated Local File Inclusion
- WP-CRM – Customer Relations Management for WordPress <= 1.2.1 - CSV injection
- WP NG Weather <= 1.0.9 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode Attributes
- WP OAuth Server (OAuth Authentication) <= 4.2.5 -Cross-Site Request Forgery
- Prowess <= 1.8.1 - Missing Authorization
- Add RSS <= 1.5 - Cross-Site Request Forgery to Stored Cross-Site Scripting
- Primary Addon for Elementor <= 1.6.0 - Authenticated (Contributor+) Stored Cross-Site Scripting
- MorningTime Lite <= 1.3.2 - Authenticated (Contributor+) Stored Cross-Site Scripting
- Smart Countdown FX <= 1.5.5 - Authenticated (Contributor+) Stored Cross-Site Scripting
- WP images upload on piclect <= 1.0 - Unauthenticated Arbitrary File Upload
- Login No Captcha reCAPTCHA <= 1.6.11 - CAPTCHA Bypass via Whitelisted IP Address Spoofing
- Classified Listing <= 2.4.5 - Cross-Site Request Forgery via rtcl_ajax_thumbnail_delete
- Database Peek <= 1.2 - Reflected Cross-Site Scripting
- NinjaFirewall <= 4.3.3 - Authenticated PHAR Deserialization
- timelineoptinpro Plugin (All Versions) - Cross-Site Scripting
- Integração entre Eduzz e Woocommerce 1.5.0 - 1.7.5 - Missing Authorization to Authenticated (Subscriber+) Privilege Escalation
- Essential Blocks – Page Builder Gutenberg Blocks, Patterns & Templates <= 5.2.3 - Authenticated (Contributor+) Stored Cross-Site Scripting
- Serious Slider <= 1.2.4 - Authenticated (Editor+) Stored Cross-Site Scripting
- Membership For WooCommerce <= 3.0.3 - Unauthenticated Insecure Direct Object Reference
- loader-utils (JS package) < 3.2.1 - Regular Expression Denial of Service
- CSV Importer Improved <= 0.6.1 - Authenticated (Editor+) Stored Cross-Site Scripting
- Unlimited Elements For Elementor (Free Widgets, Addons, Templates) <= 1.5.121 - Reflected Cross-Site Scripting
- Better Messages <= 2.15.19 - Authenticated (Administrator+) Arbitrary File Deletion via Path Traversal via 'file' Parameter
- WP Sentry <= 1.0 - Cross-Site Request Forgery
- spam-stopper <= 3.1.3 - Cross-Site Request Forgery to Stored Cross-Site Scripting
- Download Manager <= 3.3.12 - Authenticated (Author+) Arbitrary File Deletion
- Piotnet Addons For Elementor <= 2.4.27 - Authenticated (Contributor+) Stored Cross-Site Scripting
- RTMKit <= 2.1.5 - Unauthenticated Stored Cross-Site Scripting
- Graphina – Elementor Charts and Graphs <= 1.8.9 - Authenticated (Contributor+) Stored Cross-Site Scripting via Multiple Widgets
- ALD – Dropshipping and Fulfillment for AliExpress and WooCommerce <= 2.2.0 - Missing Authorization
- Z-Downloads <= 1.11.7 - Authenticated (Administrator+) Stored Cross-Site Scripting
- Blog2Social: Social Media Auto Post & Scheduler <= 8.3.3 - Authenticated (Contributor+) Stored Cross-Site Scripting
- Pz-LinkCard <= 2.5.2 - Reflected Cross-Site Scripting
- Kumihimo <= 1.0.2 - Reflected Cross-Site Scripting
- Add Multiple Marker <= 1.2 - Missing Authorization to Unauthenticated Settings Update
- Duplicate Page and Post <= 1.0 - Authenticated (Administrator+) Stored Cross-Site Scripting
- Contact Form by Supsystic < 1.10.0 - Unauthenticated Payment Bypass
- WordPress Core < 4.7.5 - Mishandling Post Meta Values via XML-RPC
- Forminator <= 1.15.2 - Reflected Cross-Site Scripting
- Intuitive Custom Post Order <= 3.1.4.1 - Authenticated (Admin+) SQL Injection
- Donations Made Easy – Smart Donations <= 4.0.12 - Reflected Cross-Site Scripting
- Hostel <= 1.1.5.2 - Reflected Cross-Site Scripting
- VK Block Patterns <= 1.31.1.1 - Cross-Site Request Forgery
- Photo Engine <= 6.3.1 - Authenticated (Author+) Stored Cross-Site Scripting
- Custom Admin-Bar Favorites <= 0.1 - Reflected Cross-Site Scripting
- Social Share, Social Login and Social Comments Plugin <= 7.14.5 - Reflected Cross-Site Scripting via 'heateor_mastodon_share' Parameter
- JNews - Pay Writer <= 11.0.0 - Authenticated (Subscriber+) Local File Inclusion
- Better WishList API <= 1.1.3 - Unauthenticated Stored Cross-Site Scripting
- Ultimate Addons for Elementor < 1.30.0 - Stored Cross-Site Scripting
- Publitio <= 2.1.8 - Missing Authorization
- LA-Studio Element Kit for Elementor <= 1.3.6 - Missing Authorization
- BulletProof Security <= .48.9 - Cross-Site Scripting
- PhotoCrati Theme <= 4.0 - SQL Injection
- Zapier for WordPress <= 1.5.1 - Authenticated (Subscriber+) Blind Server-Side Request Forgery via updated_user Function
- WP Go Maps <= 9.0.40 - Cross-Site Request Forgery
- Appointify <= 1.0.8 - Authenticated (Admin+) Arbitrary File Upload
- 코드엠샵 소셜톡 <= 1.2.0 - Authenticated (Contributor+) Stored Cross-Site Scripting
- Ninja Forms Contact Form <= 3.6.9 - Cross-Site Scripting via field label
- Easy PayPal Gift Certificate <= 1.2.3 - Cross-Site Request Forgery to Stored Cross-Site Scripting via wpppgc_plugin_options
- Groundhogg <= 2.7.11 - Authenticated (Administrator+) SQL Injection
- SS Quiz <= 1.12.2 - Unspecified Vulnerabilities
- Bitly URL Shortener <= 1.4.1 - Cross-Site Request Forgery
- WP Forum <= 2.3 - Multiple SQL Injections
- Newsletters <= 4.9.5 - Information Exposure via Log files
- BoldGrid Easy SEO – Simple and Effective SEO <= 1.6.13 - Authenticated(Contributor+) Stored Cross-Site Scripting via Meta Description
- Appointment Bookings for Zoom GoogleMeet and more – Wappointment <= 2.6.0 - Authenticated (Administrator+) Server-Side Request Forgery
- Salon booking system <= 10.11 - Authenticated Privilege Escalation
- Grid View Gallery <= 1.0 - Authenticated (Editor+) PHP Object Injection
- WP Customer Reviews <= 3.6.6 - Authenticated (Subscriber+) Sensitive Information Exposure
- Google Earth Embed <= 1.0 - Authenticated (Contributor+) Stored Cross-Site Scripting
- Ultimate Review <= 2.4.3 - Unauthenticated Stored Cross-Site Scripting
- Mins To Read <= 1.2.2 - Cross-Site Request Forgery to Stored Cross-Site Scripting
- Jeg Elementor Kit <= 2.5.6 - Authorization Bypass
- Add Shortcodes Actions And Filters <= 2.10 - Reflected Cross-Site Scripting
- Spam Protect for Contact Form 7 < 1.2.10 - Authenticated (Editor+) Remote Code Execution
- GS Insever Portfolio <= 1.4.5 - Missing Authorization to Authenticated (Subscriber+) CSS Injection
- Popup Builder <= 4.1.10 - Authenticated (Admin+) Cross-Site Scripting
- Deliver via Shipos for WooCommerce <= 2.1.7 - Reflected Cross-Site Scripting
- Ed's Social Share <= 3.0 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode Attributes