Vulnerability archive: section 6, page 26
Open a report to review affected versions, available fixes and original sources. Each report covers a specific issue; its presence does not establish whether your website is affected.
- Youzify <= 1.2.6 - Missing Authorization
- Seraphinite Accelerator <= 2.20.47 - Unauthenticated Sensitive Information Exposure via Log File
- Shared Files – File Upload & Download Manager <= 1.7.69 - Authenticated (Contributor+) Server-Side Request Forgery
- Essential Addons for Elementor – Best Elementor Templates, Widgets, Kits & WooCommerce Builders <= 5.9.22 - Authenticated (Contributor+) Stored Cross-Site Scripting
- Poll Maker <= 5.6.5 - Authenticated (Administrator+) SQL Injection
- Fusion Builder <= 3.11.1 - Missing Authorization
- External Login <= 1.11.2 - Unauthenticated SQL Injection via log
- LayerSlider <= 6.2.0 - Cross-Site Request Forgery to Stored Cross-Site Scripting
- VDZ Google Analytics or Google Tag Manager / GTM <= 1.5.5 - Stored Cross-Site Scripting
- Auto Affiliate Links <= 6.4.2.5 - Cross-Site Request Forgery
- MC Woocommerce Wishlist <= 1.9.1 - Reflected Cross-Site Scripting
- BuildKit <= 1.0.28 - Authenticated (Contributor+) SQL Injection
- ShopLentor <= 2.8.7 - Authenticated (Contributor+) Stored Cross-Site Scripting
- Youzify – BuddyPress Community, User Profile, Social Network & Membership Plugin for WordPress <= 1.3.7 - Unauthenticated Stored Cross-Site Scripting
- WP Event Manager <= 3.1.51 - Unauthenticated Local File Inclusion
- Events Manager <= 7.0.3 - Unauthenticated SQL Injection via `orderby` Parameter
- RSVPMaker <= 9.9.3 - Authenticated (Admin+) SQL Injection via 'delete' parameter
- The Plus Addons for Elementor – Elementor Addons, Page Templates, Widgets, Mega Menu, WooCommerce <= 6.1.8 - Authenticated (Contributor+) Stored Cross-Site Scripting
- Soledad <= 8.4.5 - Missing Authorization
- YaMaps for WordPress <= 0.6.40 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode Parameters
- Accordions <= 2.3.5 - Authenticated (Administrator+) Stored Cross-Site Scripting
- Contact Form by Bit Form: Multi Step Form, Calculation Contact Form, Payment Contact Form & Custom Contact Form builder 2.0 - 2.13.9 - Authenticated (Administrator+) SQL Injection
- Advanced Form Integration <= 2.6.0 - Missing Authorization to Authenticated (Subscriber+) Arbitrary MailUp OAuth Token Overwrite via auth_redirect() Function
- WordPress Core < 5.2.3 - Authenticated Cross-Site Scripting via Post Previews
- RSS for Yandex Turbo <= 1.29 - Authenticated Stored Cross-Site Scripting
- Advanced Woo Labels – Product Labels & Badges for WooCommerce <= 2.51 - Improper Authorization to Authenticated (Subscriber+) Stored Cross-Site Scripting
- RegistrationMagic <= 6.0.9.8 - Unauthenticated Payment Bypass
- PDF Flipbook, 3D Flipbook – DearFlip <= 2.2.26 - Authenticated (Contributor+) Stored Cross-Site Scripting
- Responsive Lightbox & Gallery <= 2.5.3 - Authenticated (Author+) Server-Side Request Forgery
- Themesflat Addons For Elementor <= 2.2.1 - Authenticated (Contributor+) Stored Cross-Site Scripting
- Everest Backup – WordPress Cloud Backup, Migration, Restore & Cloning Plugin <= 2.3.8 - Missing Authorization to Unauthenticated Backup Failure
- Comment Date and Gravatar remover <= 1.0 - Cross-Site Request Forgery
- WP Content Protection <= 1.3 - Cross-Site Request Forgery
- Gallery by BestWebSoft – Customizable Image and Photo Galleries for WordPress <= 4.7.3 - Authenticated (Administrator+) PHP Object Injection
- Cooked Pro < 1.8.0 - Unauthenticated Arbitrary File Upload
- Curator.io: Show all your social media posts in a beautiful feed. <= 1.9.1 - Authenticated (Contributor+) Stored Cross-Site Scripting via feed_id Attribute
- Product Slider, Product Grid, Product Masonry <= 1.13.62 - Authenticated (Contributor+) Insecure Direct Object Reference
- Slider for Writers <= 1.3 - Cross-Site Request Forgery to Stored Cross-Site Scripting
- Elementor Header & Footer Builder <= 1.5.7 - Stored Cross-Site Scripting
- Thecs <= 1.4.7 - Reflected Cross-Site Scripting
- WordPress Fancy Comments <= 1.2.10 - Authenticated (Contributor+) Stored Cross Site Scripting via Shortcode
- WordPress Gallery Plugin – NextGEN Gallery 1.9.10 - 1.9.11 - Full Path Disclosure
- ReviewX <= 1.6.22 - Authenticated (Contributor+) Stored Cross-Site Scripting
- Email Address Encoder <= 1.0.23 - Cross-Site Request Forgery via eae_clear_caches()
- Thank You Page Customizer for WooCommerce – Increase Your Sales <= 1.1.2 - Missing Authorization to Authenticated (Subscriber+) Arbitrary Shortcode Execution
- Booking Calendar <= 9.7.3.3 - Authenticated(Contributor+) Stored Cross-Site Scripting via shortcode
- Testimonial Slider Shortcode <= 1.1.9 - Authenticated (Contributor+) Stored Cross-Site Scripting
- WordPress Core < 3.0.2 - Spam Protection Bypass
- BNE Gallery Extended <= 1.2.1 - Authenticated (Contributor+) Stored Cross-Site Scripting via gallery Shortcode
- WP Front-end login and register <= 2.1.0 - Reflected Cross-Site Scripting
- Magn WP Drag And Drop Media Uploader <= 1.2.0 - Arbitrary File Upload
- TableOn – WordPress Posts Table Filterable <= 1.0.0 - Reflected Cross-Site Scripting
- PDF Flipbook, 3D Flipbook WordPress – DearFlip Lite <= 1.7.12 - Contributor+ Stored Cross-Site Scripting
- PDF for Contact Form 7 + Drag and Drop Template Builder <= 7.1.0 - Unauthenticated Arbitrary File Read
- ShortPixel Adaptive Images <= 3.11.5 - Missing Authorization to Authenticated (Subscriber+) Third-Party Plugin Option Modification via 'causer' Parameter
- Fancy Product Designer <= 6.4.3 - Unauthenticated Arbitrary File Upload
- LatePoint <= 5.1.6 - Authenticated (Contributor+) Stored Cross-Site Scripting
- WP Triggers Lite <= 2.5.3 - Authenticated (Admin+) SQL Injection
- Salon booking system <= 7.9 - Reflected Cross-Site Scripting
- Vitepos – Point of Sale (POS) for WooCommerce <= 3.6.1 - Authenticated (Custom Role+) SQL Injection
- TabaPay Gateway <= 1.4.0 - Unauthenticated Privilege Escalation
- Top 10 – Popular posts plugin for WordPress <= 3.2.2 - Authenticated (Contributor+) Stored Cross-Site Scripting via Blocks
- Masteriyo LMS PRO <= 2.20.0 - Unauthenticated Privilege Escalation
- Shared Files Pro < 1.7.70 & Shared Files Free < 1.7.67 - Unauthenticated Limited File Upload
- Ashe Extra <= 1.2.91 - Missing Authorization via multiple AJAX actions
- King Addons for Elementor <= 51.1.36 - Unauthenticated Privilege Escalation
- PICA Photo Gallery <= 1.0 - SQL Injection
- Connexion Logs <= 3.0.2 - Authenticated (Admin+) SQL Injection
- Button Generator – easily Button Builder <= 2.3.8 - Missing Authorization
- Contact Form Maker <= 1.7.30 - Authenticated (Admin+) SQL Injection
- Awesome Event Booking <= 2.7.1 - Reflected Cross-Site Scripting
- Premmerce <= 1.3.19 - Cross-Site Request Forgery
- ThemeHunk <= 1.2.0 - Missing Authorization
- CheckBot <= 1.05 - Cross-Site Request Forgery to Stored Cross-Site Scripting
- WP Crowdfunding <= 2.2.1 - Authenticated (Shop Manager+) SQL Injection via 'wpneo_reward' Post Meta
- The Hospital <= 1.8.1 - Unauthenticated PHP Object Injection
- Video & Photo Gallery for Ultimate Member <= 1.1.1 - Reflected Cross-Site Scripting
- WooCommerce PDF Invoices & Packing Slips <= 3.8.6 - Missing Authorization
- adBuddy+ (AdBlocker Detection) by NetfunkDesign <= 1.1.3 - Authenticated (Admin+) Stored Cross-Site Scripting
- WP-lightpop <= 0.8.5.6 - Remote Media File Inclusion
- WPC Smart Linked Products - Upsells & Cross-sells for WooCommerce <= 1.3.5 - Authenticated (Contributor+) Privilege Escalation
- ListingPro <= 2.9.9 - Missing Authorization
- Ninja Forms – The Contact Form Builder That Grows With You <= 3.15.3 - Unauthenticated Stored Cross-Site Scripting
- MyPixs <= 0.3 - Local File Inclusion
- eshop <= 6.3.13 - Cross-Site Forgery Request and Reflected Cross-Site Scripting
- 2D Tag Cloud <= 6.0.2 - Reflected Cross-Site Scripting via add_query_arg Parameter
- Forms for Mailchimp by Optin Cat <= 2.5.4 - Authenticated (Editor+) Stored Cross-Site Scripting
- Nota Fiscal Eletrônica WooCommerce <= 3.4.0.9 - Authenticated (Shop manager+) Stored Cross-Site Scripting
- Post Status Notifier Lite <= 1.11.0 - Reflected Cross-Site Scripting
- PDF Flipbook, 3D Flipbook, PDF embed, PDF viewer – DearFlip <= 2.3.32 - Reflected Cross-Site Scripting
- WeedMaps Menu for WordPress <= 1.2.0 - Authenticated (Contributor+) Stored Cross-Site Scripting via weedmaps_menu Shortcode
- Stylish Google Sheet Reader <= 4.0 - Reflected Cross-Site Scripting
- Waiting: One-click countdowns <= 0.6.2 - Missing Authorization Checks leading to Authenticated (Subscriber+) Stored Cross-Site Scripting
- Riode Core <= 1.6.26 - Unauthenticated SQL Injection
- Bold Page Builder <= 4.8.8 - Authenticated (Contributor+) Stored Cross-Site Scripting via bt_bb_price_list Shortcode
- Responsive Gallery Grid <= 2.3.8 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode
- Contact Form 7 Database Addon <= 1.2.6.3 - CSV Injection
- WordPress Importer : Import any XML File to WordPress < 1.0.1 - Server-Side Request Forgery
- Ultimate Dashboard <= 3.7.10 - Login Page Disclosure on Multi-site
- WP-CRM System <= 3.4.6 - Missing Authorization