Vulnerability archive: section 7, page 13
Open a report to review affected versions, available fixes and original sources. Each report covers a specific issue; its presence does not establish whether your website is affected.
- DHL eCommerce (Benelux) for WooCommerce <= 2.2.3 - Missing Authorization to Authenticated (Subscriber+) Arbitrary Shipping Label Creation and Deletion via dhlpwc_label_create and dhlpwc_label_delete AJAX Actions
- AcyMailing – An Ultimate Newsletter Plugin and Marketing Automation Solution for WordPress <= 9.11.0 - Reflected Cross-Site Scripting
- WishList Member X < 3.26.7 - Missing Authorization to Stored Cross-Site Scripting
- Mobile Domain <= 1.5.2 - Cross-Site Request Forgery and Stored Cross-Site Scripting
- wp-login customizer <= 1.0 - Cross-Site Request Forgery to Stored Cross-Site Scripting
- Events Made Easy <= 3.2.5 - Unauthenticated Stored Cross-Site Scripting
- WebinarPress <= 1.33.30 - Missing Authorization
- Display post meta, term meta, comment meta, and user meta <= 1.0.0 - Authenticated (Contributor+) Stored Cross-Site Scripting
- Rife Elementor Extensions & Templates <= 1.2.1 - Authenticated (Contributor+) Stored Cross-Site Scripting via Writing Effect Headline Widget
- Paid Membership Subscriptions – Effortless Memberships, Recurring Payments & Content Restriction <= 3.0.7 - Insecure Direct Object Reference
- Custom Post Type Attachment <= 3.4.6 - Authenticated (Contributor+) Stored Cross-Site Scripting
- Page Builder Gutenberg Blocks – CoBlocks <= 3.1.16 - Authenticated (Contributor+) Stored Cross-Site Scripting
- WP JobSearch <= 2.6.7 - Unauthenticated Arbitrary File Upload
- WP User Manager <= 2.9.10 - Cross-Site Request Forgery
- User Avatar <= 1.4.11 - Reflected Cross-Site Scripting
- Email Marketing for WooCommerce by Omnisend <= 1.19.0 - Missing Authorization
- SH Contextual Help <= 3.2.1 - Cross-Site Request Forgery to Stored Cross-Site Scripting
- WP User Profile Avatar <= 1.0.2 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode
- JetFormBuilder <= 3.1.4 - Unauthenticated Content Injection
- EventON (Pro) <= 4.9.9 - Missing Authorization
- StreamWeasels Kick Integration <= 1.1.5 - Authenticated (Contributor+) Stored Cross-Site Scripting via vodsChannel Parameter
- turboSMTP <= 4.6 - Reflected Cross-Site Scripting via 'page'
- Gutenberg Blocks with AI by Kadence WP <= 3.2.36 - Authenticated (Contributor+) Stored Cross-Site Scripting via Block Link
- WP Service Payment Form With Authorize.net <= 2.6.0 - Cross-Site Request Forgery to Reflected Cross-Site Scripting
- Icons Factory <= 1.6.12 - Missing Authorization to Unauthenticated Arbitrary File Deletion via delete_files() Function
- Members <= 3.2.22 - Unauthenticated Sensitive Information Disclosure via REST API Pagination Side Channel
- Live Composer <= 2.1.18 - Authenticated (Contributor+) PHP Object Injection via Shortcode
- WC Affiliate <= 2.16 - Authenticated (Subscriber+) PHP Object Injection
- Verdure Core <= 1.2 - Unauthenticated Local File Inclusion
- Smart Logo Showcase Lite <= 1.1.9 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode
- Kognetiks Chatbot <= 2.4.9 - Unauthenticated Arbitrary File Upload
- Gmedia Photo Gallery <= 1.25.1 - Unauthenticated SQL Injection via 'gmedia__in' Parameter
- Target Video Easy Publish <= 3.8.5 - Authenticated (Contributor+) Stored Cross-Site Scripting via width Parameter
- ListingPro - WordPress Directory & Listing Theme < 2.0.14.5 - Stored Cross-Site Scripting
- Responsive Plus <= 3.2.0 - Missing Authorization
- Bookly <= 28.1 - Unauthenticated Insecure Direct Object Reference
- BlogMarks < 1.1.2 - Unauthenticated Local File Inclusion
- MailerLite – WooCommerce integration <= 2.0.8 - Cross-Site Request Forgery via Multiple AJAX Functions
- WPZOOM Connect: AI Chat, Click to Chat, Social Icons & Share Buttons <= 4.7.3 - Unauthenticated Sensitive Information Disclosure via HMAC Signature Collision (Missing Domain Separation) in HMAC Signature Domain-Separation Flaw in `/yamidoo/v1/customer`…
- GDPR Cookie Consent by Supsystic <= 2.1.2 - Authenticated (Administrator+) Stored Cross-Site Scripting
- Plugin Manager <= 1.4.7 - Cross-Site Request Forgery
- SimpleModal Contact Form (SMCF) <= 1.2.9 - Authenticated (Administrator+) Stored Cross-Site Scripting
- Ibtana - Ecommerce Product Addons <= 0.2.3 - Reflected Cross-Site Scripting
- Calendar.online / Kalender.digital <= 1.0.13 - Authenticated (Contributor+) Stored Cross-Site Scripting
- Appointment Hour Booking – Booking Calendar <= 1.5.94 - Missing Authorization
- Saasplate Core <= 1.2.8 - Unauthenticated SQL Injection
- ReDi Restaurant Reservation <= 24.0422 - Missing Authorization
- افزونه پیامک ووکامرس Persian WooCommerce SMS <= 7.2.2 - Authenticated (Shop manager+) SQL Injection
- Crypto Payment Gateway with Payeer for WooCommerce <= 1.0.3 - Unauthenticated Payment Bypass
- Groundhogg <= 3.7.4.1 - Authenticated (Administrator+) Stored Cross-Site Scripting via label Parameter
- Colibri Page Builder <= 1.0.276 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode
- Backup Migration <= 1.3.9 - Unauthenticated Path Traversal to Arbitrary File Deletion
- Interactive Geo Maps <= 1.5.9 - Authenticated (Editor+) Stored Cross-Site Scripting
- Most Popular Posts Widget <= 0.8 - Authenticated (Admin+) SQL Injection
- User Registration <= 2.3.0 - Authenticated (Administrator+) Stored Cross Site Scripting
- WP Express Checkout <= 2.2.8 - Authenticated (Admin+) Stored Cross-Site Scripting via pec_coupon[code]
- affiliate-toolkit – WordPress Affiliate Plugin <= 3.5.4 - Missing Authorization via atkp_import_product
- 3CX Free Live Chat <= 6.2.03 - Unauthenticated Stored Cross-Site Scripting
- YARPP - Yet Another Related Posts Plugin <= 5.30.2 - Authenticated (Subscriber+) SQL Injection via Shortcode
- Simple Responsive Menu <= 2.1 - Cross-Site Request Forgery to Stored Cross-Site Scripting
- Language Field <= 0.9 - Cross-Site Request Forgery to Stored Cross-Site Scripting
- Wiki Embed <= 1.4.6 - Cross-Site Request Forgery
- Advanced WP Columns <= 2.0.6 - Authenticated (Admin+) Stored Cross-Site Scripting
- The Events Calendar < 4.1.1.1 - Open Redirect
- Social Media Share Buttons | MashShare <= 4.0.47 - Missing Authorization
- WordPress Core < 5.2.3 - Open Redirect
- Custom Menu Wizard Widget <= 3.3.1 - Authenticated (Contributor+) Stored Cross-Site Scripting
- Theme Changer <= 1.4 - Cross-Site Request Forgery
- WP SMS <= 6.5 - Cross-Site Request Forgery to Subscriber Deletion
- VikBooking Hotel Booking Engine & PMS <= 1.7.2 - Cross-Site Request Forgery to Settings Update
- Easy Property Listings <= 3.5.3 - Authenticated (Admin+) Stored Cross-Site Scripting
- Exclusive Addons for Elementor <= 2.6.9.6 - Authenticated (Contributor+) Stored Cross-Site Scripting via Team Member Widget
- HomeFix Elementor Portfolio <= 1.0.1 - Missing Authorization
- Short URL <= 1.6.7 - Missing Authorization via multiple AJAX functions
- Featured Image from URL (FIFU) <= 6.0.7 - Cross-Site Request Forgery
- Mang Board WP <= 2.3.4 - Unauthenticated Stored Cross-Site Scripting
- CRM Perks Forms <= 1.1.2 - Authenticated (Administrator+) Stored Cross-Site Scripting
- BitForm <= 1.1.0 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode Attributes
- EmojiNation <= 1.0.12 - Unauthenticated PHP Object Injection
- MySliderGallery <= 1.2.1 - Remote File Inclusion
- LaTeX2HTML <= 2.5.4 - Reflected Cross-Site Scripting
- Felan Framework <= 1.1.4 - Missing Authorization to Authenticated (Subscriber+) Arbitrary Plugin Activation/Deactivation via process_plugin_actions
- Ultimate Member <= 2.11.4 - Authenticated (Contributor+) Account Takeover via Password Reset Link Disclosure
- ThemeREX Addons <= 2.46.0 - Authenticated (Contributor+) Stored Cross-Site Scripting
- DrawBlog <= 0.90 - Authenticated (Admin+) Stored Cross-Site Scripting
- Neon Channel Product Customizer Free <= 2.0 - Missing Authorization to Unauthenticated Arbitrary Content Deletion
- W3 Total Cache <= 2.9.1 - Unauthenticated Arbitrary Code Execution
- Easy Appointments < 3.12.28 - Authenticated (Subscriber+) Insecure Direct Object Reference
- VForm <= 3.1.9 - Reflected Cross-Site Scripting
- Wux Blog Editor <= 3.0.0 - Unauthenticated Arbitrary File Upload
- All-in-One WP Migration <= 7.40 - Authenticated (Admin+) Arbitrary File Upload
- Debt Calculator <= 1.0.1 - Cross-Site Request Forgery to Stored Cross-Site Scripting
- Members List Plugin <= 4.3.6 - Reflected Cross-Site Scripting
- Responsive Starter Templates – Elementor & WordPress Templates <= 2.6.8 - Authenticated (Admin+) Stored Cross-Site Scripting
- WP-Matomo Integration (WP-Piwik) < 1.0.11 - Unauthenticated Stored Cross-Site Scripting
- Brizy Page Builder <= 2.4.1 - Authenticated Stored Cross-Site Scripting via Element URL
- DejaVu <= 2.4 - Arbitrary File Deletion
- Better Notifications for WP <= 1.8.6 - Email Address Disclosure
- Switch CTA Box <= 1.1 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode
- rtMedia for WordPress, BuddyPress and bbPress <= 4.7.10 - Authenticated (Subscriber+) SQL Injection