Vulnerability archive: section 7, page 2
Open a report to review affected versions, available fixes and original sources. Each report covers a specific issue; its presence does not establish whether your website is affected.
- WP Symposium <= 12.11 - SQL Injections
- SchemaEngine AI – AI Schema Markup, Reviews & Rich Snippets for SEO <= 3.1.0 - Unauthenticated Insecure Direct Object Reference
- OpenBook Book Data <= 3.5.2 - Cross-Site Request Forgery
- Contact Bank <= 2.0.225 - Reflected Cross-Site Scripting
- Leaflet Maps Marker (Google Maps, OpenStreetMap, Bing Maps) <= 3.12.4 - Authenticated (Admin+) SQL Injection
- SMSmaster – Multipurpose SMS Gateway for Wordpress (All Versions) - Authenticated SQL Injection
- WordPress Core <= 7.0.2 - Authenticated (Contributor+) Stored Cross-Site Scripting via Quick Edit
- WP krpano <= 1.2.1 - Authenticated (Contributor+) Stored Cross-Site Scripting
- Ajax Rating with Custom Login <= 1.1 - Unauthenticated SQL Injection
- Ebook Store <= 6.19 - Missing Authorization
- Sugar Calendar (Lite) <= 3.3.0 - Reflected Cross-Site Scripting
- Media Library Assistant <= 3.34 - Authenticated (Contributor+) SQL Injection
- Advanced AJAX Page Loader < 2.7.7 - Arbitrary File Upload
- Wolmart | Multi-Vendor Marketplace WooCommerce Theme <= 1.9.6 - Unauthenticated Local File Inclusion
- Yet Another WebClap for WordPress <= 0.2 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode Attributes
- Getaway < 1.8 - Unauthenticated Local File Inclusion
- Quick Post Duplicator <= 2.0 - Authenticated (Contributor+) SQL Injection via post_id
- JS Help Desk – Best Help Desk & Support Plugin <= 2.8.7 - Authenticated (Administrator+) Stored Cross-Site Scripting
- Otter - Gutenberg Block <= 3.0.3 - Missing Authorization
- CatchThemes Plugins (Various Versions) - Missing Authorization
- User Profile Builder <= 4.0.3 - Unauthenticated Stored Cross-Site Scripting via First Name Field
- WPGYM <= 67.1.0 - Unauthenticated Arbitrary File Upload
- Jigoshop Swipe plugin <= 3.1.0 - Cross-Site Scripting
- Pie Forms for WP <= 1.6 - Unauthenticated Arbitrary File Upload
- WooCommerce < 5.5 - Authenticated Blind SQL Injection
- JetPopup <= 2.0.20.2 - Missing Authorization
- Masteriyo LMS <= 3.4.1 - Authenticated (Subscriber+) Insecure Direct Object Reference
- Two Way Chat <= 3.1.4 - Authenticated (Admin+) Local File Inclusion
- Depicter — Popup & Slider Builder < 4.8.0 - Authenticated (Editor+) Arbitrary File Upload
- Context Blog <= 1.3.5 - Unauthenticated Sensitive Information Exposure via 'postID' Parameter
- Phlox Portfolio <= 2.3.1 - Unauthenticated Local File Inclusion
- WP-Revive Adserver <= 2.2.1 - Authenticated (Contributor+) Stored Cross-Site Scripting
- TWB Woocommerce Reviews <= 1.7.7 - Cross-Site Request Forgery
- Royal Elementor Addons <= 1.3.55 - Cross-Site Request Forgery
- WP Feature Box <= 0.1.3 - Authenticated (Contributor+) Stored Cross-Site Scripting
- Category Specific RSS feed Subscription <= 2.2 - Authenticated (Administrator+) Stored Cross-Site Scripting via plugin settings
- MStore API <= 3.9.6 - Cross-Site Request Forgery to Firebase Server Key Update
- Essential Real Estate <= 4.3.5 - Missing Authorization to Denial of Service
- Checkbox <= 2.8.10 - Missing Authorization to Unauthenticated Log Clearing
- Plan My Day <= 1.1.13 - Unauthenticated Local File Inclusion
- Lisfinity Core - Lisfinity Core plugin used for pebas® Lisfinity WordPress theme <= 1.5.0 - Unauthenticated SQL Injection
- Avada | Website Builder For WordPress & WooCommerce <= 7.11.4 - Authenticated (Contributor+) Arbitrary File Upload
- Posts Navigation Links for Sections and Headings - Free by WP Masters <= 1.0.1 - Cross-Site Request Forgery to Settings Update
- Team Members <= 5.2.0 - Authenticated (Editor+) Stored Cross-Site Scripting
- Coming Soon Page – Responsive Coming Soon & Maintenance Mode <= 1.1.18 - Cross-Site Scripting via counter_title parameter
- MotoPress Hotel Booking <= 6.0.3 - Authenticated (Subscriber+) Information Exposure
- Slider by Supsystic <= 1.8.10 - Authenticated (Admin+) SQL Injection
- Kubio AI Page Builder <= 2.5.1 - Unauthenticated Local File Inclusion
- YaySMTP – Simple WP SMTP Mail <= 2.2 - Stored Cross-Site Scripting
- Slick Popup <= 1.7.1 - Privilege Escalation
- WPDash Notes <= 1.3.5 - Missing Authorization to Authenticated (Subscriber+) Sensitive Information Exposure
- Page Builder by SiteOrigin <= 2.31.4 - Authenticated (Contributor+) Stored Cross-Site Scripting
- WP Mailster <= 1.8.17.0 - Authenticated (Contributor+) Stored Cross-Site Scripting
- Advanced Page Visit Counter <= 6.1.5 - Subscriber+ Blind SQL injection
- Ping List Pro <= 1.1 - Cross-Site Request Forgery to Stored Cross-Site Scripting
- Ultimate Addons for WPBakery <= 3.16.11 - Stored Cross-Site Scripting
- Perfect Brands for WooCommerce <= 2.0.4 - Server Information Disclosure
- SecuPress Free <= 2.2.5.3 - Authenticated (Contributor+) Stored Cross-Site Scripting
- WP RSS Aggregator <= 4.19.2 - Subscriber+ Stored Cross-Site Scripting
- Scheduled <= 1.0 - Cross-Site Request Forgery to Stored Cross-Site Scripting
- MPG <= 4.2.2 - Authenticated (Editor+) Arbitrary File Read
- Mindstien Quick Login <= 1.0 - Unauthenticated Privilege Escalation via Account Takeover
- Fast Flow <= 1.2.10 - Cross-Site Scripting
- Modula Image Gallery – Photo Grid & Video Gallery <= 2.13.6 - Missing Authorization to Authenticated (Contributor+) Arbitrary Post/Page Editing
- Bot Block – Stop Spam Referrals in Google Analytics <= 2.6 - Authenticated (Administrator+) Stored Cross-Site Scripting
- RSVP ME <= 1.9.9 - Authenticated (Contributor+) SQL Injection
- Naver Blog <= 1.0 - Cross-Site Request Forgery to Stored Cross-Site Scripting
- Visitor Traffic Real Time Statistics pro <= 11.9.1 - Reflected Cross-Site Scripting
- Sitekit <= 1.8 - Authenticated (Contributor+) Stored Cross-Site Scripting
- Digital Publications by Supsystic <= 1.7.7 - Cross-Site Request Forgery
- AI CoPilot <= 1.2.7 - Authenticated (Contributor+) Sensitive Information Exposure
- WP Print Friendly <= 0.6 - Cross-Site Scripting
- Woocommerce Addon by Greenshift< 1.9.8 - Authenticated (Subscriber+) SQL Injection
- Event Timeline <= 1.1.6 - Authenticated (Admin+) Stored Cross-Site Scripting
- Maintenance Mode by helderk <= 3.0.1 - Unauthenticated IP Spoofing
- WP-Basics <= 2.0 - Reflected Cross-Site Scripting
- Ninja Forms - File Uploads <= 3.3.29 - Unauthenticated Arbitrary File Read via File Upload Field 'files[].data.file_path' Parameter
- Absolute Reviews <= 1.1.3 - Authenticated (Contributor+) Stored DOM-Based Cross-Site Scripting via Criteria Name
- Sogrid <= 1.5.6 - Unauthenticated Local File Inclusion
- Atarim - Client Interface <= 3.9.1 - Missing Authorization via AJAX actions
- WPLMS <= 1.9.9 - Unauthenticated Arbitrary File Upload
- SMS Alert <= 3.9.7 - Unauthenticated Authentication Bypass to Account Takeover via 'billing_phone' Parameter
- Neon - Bootstrap Admin Theme <= 2.0 - Cross-Site Scripting
- Coupon Zen <= 1.0.5 - Cross-Site Request Forgery to Plugin Activation
- Simple Download Monitor <= 3.9.4 - Reflected Cross-Site Scripting
- MagOne <= 8.8 - Reflected Cross-Site Scripting
- WooCommerce Box Office <= 1.1.51 - Missing Authorization
- WPJobBoard < 5.11.1 - Authenticated (Subscriber+) Path Traversal
- 10Web Booster <= 2.34.5 - Unauthenticated Limited File Write / Cache Poisoning via Query-string Parameter Traversal in Page-Cache Path
- s2Member <= 240315 - Limited Privilege Escalation
- WP About Author <= 1.5 - Authenticated (Contributor+) Stored Cross-Site Scripting
- ElementsKit Elementor Addons <= 3.8.2 - Missing Authorization to Unauthenticated Widget Content Overwrite
- Fitness calculators plugin <= 2.0.8 - Authenticated (Administrator+) Stored Cross-Site Scripting via admin settings
- CampTix Event Ticketing < 1.5 - Cross-Site Scripting
- Responsive Blocks – WordPress Gutenberg Blocks <= 1.9.9 - Authenticated (Contributor+) Stored Cross-Site Scripting via section_tag Parameter
- Shortcodes and extra features for Phlox theme <= 2.17.22 - Unauthenticated Information Exposure
- Internal Link Juicer: SEO Auto Linker for WordPress <= 2.24.3 - Cross-Site Request Forgery
- Elegant Pink <= 1.3.0 - Cross-Site Request Forgery to Notice Dismissal
- iCafe Library <= 1.8.3 - Authenticated (Editor+) SQL Injection
- Universal Analytics <= 1.3.0 - Cross-Site Scripting