Vulnerability archive: section 7, page 21
Open a report to review affected versions, available fixes and original sources. Each report covers a specific issue; its presence does not establish whether your website is affected.
- WooCommerce Ultimate Points And Rewards <= 2.10.2 - Authenticated (Subscriber+) Information Exposure
- Rhodos <= 1.3.3 - Unauthenticated Local File Inclusion
- Weblizar Pin Feeds < 1.1.2 - Cross-Site Scripting
- Weather Widget Pro <= 1.1.40 - Authenticated (Contributor+) Stored Cross-Site Scripting
- WP Latest Posts <= 5.0.7 - Authenticated (Subscriber+) Arbitrary Shortcode Execution
- WooCommerce Enhanced Ecommerce Analytics Integration with Conversion Tracking <= 3.7.1 - Cross-Site Request Forgery
- Advanced Page Visit Counter <= 8.0.6 - Authenticated (Administrator+) SQL Injection
- WC Sales Notification <= 1.2.2 - Cross-Site Request Forgery to Arbitrary Plugin Activation
- GetPaid <= 2.8.54 - Unauthenticated Payment Bypass
- Easy SVG Support <= 3.2.0 - Cross-Site Scripting via SVG Upload
- amazing neo icon font for elementor <= 2.0.1 - Authenticated (Contributor+) Stored Cross-Site Scripting
- Emma for WordPress <= 1.3.3 - Authenticated (Contributor+) Stored Cross-Site Scripting
- Gravity Forms Google Sheet Connector <= 1.3.4 - Cross-Site Request Forgery via verify_code_integation_new
- WP Service Payment Form With Authorize.net <= 2.6.3 - Reflected Cross-Site Scripting
- Rank Math SEO <= 1.0.252.1 - Missing Authorization
- SB Random Posts Widget <= 1.0 - Authenticated (Contributor+) Local File Inclusion
- Rich Showcase for Google Reviews <= 6.9.4.3 - Authenticated (Editor+) Stored Cross-Site Scripting
- BuildKit – Product Builder for WooCommerce – Custom PC Builder <= 1.0.28 - Unauthenticated Cart Data Manipulation
- Download Attachments <= 1.3.1 - Unauthenticated Insecure Direct Object Reference
- Premium Addons for Elementor <= 4.10.25 - Authenticated (Contributor+) Stored Cross-Site Scripting
- tagDiv Composer <= 5.4 - Authenticated (Contributor+) Stored Cross-Site Scripting via Multiple Shortcodes
- WMF Mobile Redirector <= 1.2 - Authenticated (Administrator+) Stored Cross-Site Scripting via Settings Parameters
- Estatik Real Estate Plugin < 4.3.4 - Unauthenticated Mail Relay
- Advanced Custom Fields <= 3.5.1 - Remote Code Execution via Remote File Inclusion
- Convex - Architecture & Interior Design WordPress Theme <= 1.16.0 - Unauthenticated PHP Object Injection
- Shopping Cart & eCommerce Store <= 5.1.0 - Cross-Site Request Forgery to Stored Cross-Site Scripting
- Cryptocurrency Widgets – Price Ticker & Coins List 2.0 - 2.6.5 - Unauthenticated SQL Injection
- Conference Scheduler <= 2.5.1 - Authenticated (Contributor+) Stored Cross-Site Scripting via className Parameter
- Daily Inspiration Generator <= 2.0 - Open Redirect
- Button Generator – easily Button Builder <= 2.3.9 - Cross-Site Request Forgery
- Delete Post Revisions In WordPress <= 4.6 - Cross-Site Request Forgery
- Media folder Addon <= 4.0.1 - Unauthenticated Arbitrary File Download
- Surveys 1.01.8 - Authenticated SQL Injection
- Cart Abandonment Recovery for WooCommerce – Recover Lost Sales with Automated Emails < 2.1.4 - Unauthenticated Insecure Direct Object Reference
- SP Project & Document Manager <= 4.56 - Cross-Site Request Forgery and Cross-Site Scripting
- Appointment Booking Calendar <= 1.6.10.6 - Unauthenticated Arbitrary Appointment View, Modification and Deletion
- Nokri – Job Board WordPress Theme <= 1.6.2 - Unauthenticated Arbitrary Password Change
- GREYD.SUITE <= 1.2.6 - Unauthenticated Arbitrary File Upload
- Mail Logging <= 1.16.0 - Cross-Site Scripting to Unauthenticated Arbitrary HTML Content Injection in Admin Log
- WP Hotel Booking <= 2.0.7 - Missing Authorization to (Subscriber+) Arbitrary Post Deletion
- ElementInvader Addons for Elementor <= 1.2.9 - Authenticated (Contributor+) Information Exposure
- WP Responsive header image slider <= 3.2.1 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode
- TS Poll – Survey, Versus Poll, Image Poll, Video Poll <= 2.4.0 - Authenticated (Administrator+) SQL Injection via orderby Parameter
- Ultimate Maps by Supsystic <= 1.5.5 - Unauthenticated Stored Cross-Site Scripting
- wpForo Forum 3.0.0 - 3.1.5 - Unauthenticated AI Credit Exhaustion
- YouTube Playlists with Schema <= 2.6.1 - Authenticated (Contributor+) Stored Cross-Site Scripting
- Content Views – Post Grid & Filter, Recent Posts, Category Posts, & More (Gutenberg Blocks and Shortcode) <= 3.7.1 - Authenticated (Contributor+) Stored Cross-Site Scripting via pagingType Parameter
- GS Filterable Portfolio <= 1.6.0 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode
- WP Cumulus < 1.22 - Cross-Site Scripting
- Discount Rules for WooCommerce <= 2.4.1 - Reflected Cross-Site Scripting
- LTL Freight Quotes – GlobalTranz Edition <= 2.3.12 - Missing Authorization to Unauthenticated Settings Update
- Wordfence <= 5.2.3 - Stored Cross-Site Scripting via REQUEST_URI
- Subscribe To Comments Reloaded < 150820 - Reflected Cross-Site Scripting
- SP Project & Document Manager <= 4.57 - Sensitive File Disclosure
- Redirect Redirection <= 1.1.3 - Cross-Site Request Forgery via 'addRedirect' function
- Short URL <= 1.6.8 - Authenticated (Subscriber+) SQL Injection
- Booster for WooCommerce (Free <= 5.6.6, Premium <= 5.6.4) - Cross-Site Request Forgery to File Deletion
- Avartan Slider Lite <= 1.5.3 - Reflected Cross-Site Scripting via 'asview-nouce'
- Greenshift <= 13.2.0 - Reflected Cross-Site Scripting via '{{GET:}}' Dynamic Placeholder
- SchedulePress <= 5.1.3 - Unauthenticated Full Path Disclosure
- Watu Quiz <= 3.3.8.2 - Authenticated (Admin+) Stored Cross-Site Scripting
- Shortcodes and extra features for Phlox theme <= 2.17.13 - Authenticated (Contributor+) Stored Cross-Site Scripting via Modern Heading Widget
- Builderall Builder for WordPress <= 3.0.1 - Authenticated (Contributor+) Stored Cross-Site Scripting
- Appmax <= 1.0.3 - Missing Authorization to Order Status Manipulation and Arbitrary Order Creation via Webhook Endpoint
- Blossom Recipe Maker <= 1.0.7 - Authenticated (Contributor+) Stored Cross-Site Scripting
- Social Connect <= 0.10.1 - Cross-Site Scripting
- WordPress Core < 4.9.2 - Authenticated Cross-Site Scripting
- Currency Converter Calculator <= 1.3.1 - Authenticated (Contributor+) Stored Cross-Site Scripting via shortcode
- JetEngine <= 3.8.10 - Unauthenticated Stored Cross-Site Scripting
- Event Tickets <= 4.10.7.1 - CSV Injection
- AI Tools <= 4.0.7 - Missing Authorization to Authenticated (Subscriber+) Arbitrary Content Deletion
- NS Product icon badge <= 1.2.4 - Reflected Cross-Site Scripting via PHP_SELF
- Web Stories <= 1.37.0 - Authenticated (Contributor+) Stored Cross-Site Scripting
- Drop Caps <= 2.1 - Cross-Site Request Forgery to Stored Cross-Site Scripting
- PostmarkApp Email Integrator <= 2.4 - Missing Authorization
- VR Calendar <= 2.4.4 - Unauthenticated Local File Inclusion
- Misiek Paypal <= 1.1.20090324 - Cross-Site Request Forgery to Stored Cross-Site Scripting
- Patreon WordPress <= 1.10.0 - Cross-Site Request Forgery
- Puca <= 2.6.33 - Unauthenticated Local File Inclusion
- Frontend File Manager <= 18.2 - Unauthenticated Stored Cross-Site Scripting
- BuddyPress Instant Chat <= 1.6 - Unauthenticated Stored Cross-Site Scripting
- Newsletter Manager <= 1.4 - Open Redirect
- Skitter Slideshow <= 2.5.2 - Unauthenticated Server-Side Request Forgery
- Email Subscribers & Newsletters <= 4.2.2 - Missing Authorization to Test Email
- WordPress Core < 4.9.5 - Security Misconfiguration with URL Hostnames
- Celeste <= 1.3.6 - Unauthenticated PHP Object Injection
- BuddyPress <= 14.4.0 - Insecure Direct Object Reference to Authenticated (Subscriber+) Private Messages Disclosure
- Wp EMember <= v10.2.2 - Unauthenticated Information Exposure
- RSVP and Event Management <= 2.7.16 - Missing Authorization
- Build App Online <= 1.0.18 - Unauthenticated SQL Injection
- Tito <= 2.3 - Authenticated (Contributor+) Stored Cross-Site Scripting
- User Domain Whitelist <= 1.4 - Cross-Site Request Forgery
- JSM Show Post Metadata <= 4.9.0 - Authenticated (Contributor+) Stored Cross-Site Scripting
- LMS <= 8.3 - Unauthenticated Stored Cross-Site Scripting
- Hunk Companion <= 1.8.4 - Missing Authorization to Unauthenticated Arbitrary Plugin Installation/Activation
- Contextual Related Posts <= 4.4.1 - Authenticated (Author+) Stored Cross-Site Scripting via 'other_attributes' Block Parameter
- Zingiri Web Shop Plugin <= 2.4.1 - Cross-Site Scripting
- Beaver Builder Addons by WPZOOM <= 1.3.4 - Authenticated (Contributor+) Stored Cross-Site Scripting via Testimonials Widget
- wpDataTables - Tables & Table Charts <= 2.1.65 - Authenticated(Administrator+) PHP Object Injection
- Traffic Monitor <= 3.2.2 - Missing Authorization to Unauthenticated Settings Update