Vulnerability archive: section 7, page 3
Open a report to review affected versions, available fixes and original sources. Each report covers a specific issue; its presence does not establish whether your website is affected.
- Thrive Theme Builder < 3.24.2 - Cross-Site Request Forgery
- Custom Query Blocks <= 5.2.0 - Missing Authorization via REST Routes
- Motors – Car Dealership & Classified Listings <= 1.4.123 - Missing Authorization
- Photo Reviews for WooCommerce <= 1.2.30 - Unauthenticated Stored DOM-Based Cross-Site Scripting via 'wcpr_image_upload_id' Parameter
- Soundslides <= 1.4.2 - Authenticated (Contributor+) Stored Cross-Site Scripting via soundslides Shortcode
- MasterStudy LMS WordPress Plugin – for Online Courses and Education <= 3.3.23 - Unauthenticated Limited Privilege Escalation to Instructor
- Responsive CSS EDITOR <= 1.0 - Authenticated(Administrator+) SQL Injection
- Verify API <= 1.0.0 - Unauthenticated SQL Injection
- Post-Plugin Library <= 2.6.2.1 - Reflected Cross-Site Scripting
- Color Palette <= 4.3.2 - Authenticated (Contributor+) Stored Cross-Site Scripting via hex Parameter
- Testimonials Widget <= 4.0.4 - Missing Authorization
- VW Education Lite <= 2.2.0 - Missing Authorization
- InstaWP Connect – 1-click WP Staging & Migration <= 0.1.0.22 - Unauthenticated Arbitrary File Upload
- Simple CAPTCHA with Cloudflare Turnstile <= 1.41.0 - Unauthenticated CAPTCHA Bypass
- WP Social Bookmarking Light < 1.7.10 - Cross-Site Scripting
- Royal Elementor Kit <= 1.0.116 - Cross-Site Request Forgery to Notice Dismissal
- WordPress Countdown Widget <= 3.1.9.1 - Authenticated (Administrator+) Stored Cross-Site Scripting
- Tickera <= 3.6.0.1 - Authenticated (Staff+) SQL Injection via 'tc_event_filter' Parameter
- NEX-Forms – Ultimate Forms Plugin for WordPress <= 9.1.6 - Authenticated (Admin+) SQL Injection
- ElementsKit Elementor Addons – Advanced Widgets & Templates Addons for Elementor <= 4.0.5 - Authenticated (Contributor+) Stored Cross-Site Scripting
- WooMS <= 9.12 - Missing Authorization
- Quiz Maker <= 6.5.2.4 - Missing Authorization to Authenticated (Subscriber+) Arbitrary Quiz Creation & Modification
- Mojoomla Hospital Management System for WordPress Theme < 22-05-2018 - SQL Injection
- NEX-Forms – Ultimate Form Builder – Contact forms and much more <= 8.5.6 - Missing Authorization via set_starred()
- Grand Restaurant < 7.0.9 - Reflected Cross-Site Scripting
- Geolocator <= 1.1 - Unauthenticated PHP Object Injection
- VikBooking Hotel Booking Engine & PMS <= 1.8.13 - Reflected Cross-Site Scripting via 'category_id' Parameter
- WooCommerce Product Add-ons <= 6.1.3 - Cross-Site Request Forgery
- WordPress Job Board and Recruitment Plugin – JobWP <= 2.1 - Sensitive Information Exposure
- Core Web Vitals & PageSpeed Booster <= 1.0.27 - Missing Authorization
- Rise Blocks – A Complete Gutenberg Page Builder <= 3.1 - Cross-Site Request Forgery
- HealthFirst <= 1.0.1 - Unauthenticated Local File Inclusion
- MultiSite Clone Duplicator <= 1.5.3 - Reflected Cross-Site Scripting
- bbPress Move Topics <= 1.1.4 - PHP Object Injection
- Miniorange OTP Verification with Firebase <= 3.6.0 - Privilege Escalation via Registration due to Administrator Default User Role Value
- Arlo <= 6.0.3 - Unauthenticated Stored Cross-Site Scripting
- 新淘客WordPress插件 <= 1.1.2 - Reflected Cross-Site Scripting
- Post in page for Elementor <= 1.0.1 - Authenticated (Contributor+) Stored Cross-Site Scripting
- EventON <= 2.1.7 - Authenticated (Admin+) Stored Cross-Site Scripting
- Sassy Social Share <= 3.3.62 - Authenticated (Administrator+) Stored Cross-Site Scripting
- Gift Hunt <= 2.0.2 - Authenticated (Administrator+) Stored Cross-Site Scripting
- Ultimate Member <= 2.0.3 - Cross-Site Scripting
- ApplyOnline – Application Form Builder and Manager <= 2.6.2 - Missing Authorization to Sensitive Information Exposure
- reCAPTCHA for Asgaros Forum <= 1.1.0 - Authenticated (Subscriber+) Stored Cross-Site Scripting
- Ebook Store <= 5.8001 - Reflected Cross-Site Scripting
- Online Scheduling and Appointment Booking System – Bookly <= 27.7 - Unauthenticated Stored Cross-Site Scripting
- WP Recipe Maker <= 9.2.1 - Authenticated Stored Cross-Site Scripting via Video Embed
- Block, Suspend, Report for BuddyPress <= 3.6.4 - Authenticated (Subscriber+) Stored Cross-Site Scripting via 'link' Parameter
- JobCareer | Job Board Responsive WordPress Theme <= 2.5.1 - Stored Cross-Site Scripting
- WP Copy Protection & No Right Click <= 3.1.4 - Missing Authorization to Arbitrary Plugin Installation/Activation
- Icon List Block – Add Icon-Based Lists with Custom Styles <= 1.2.1 - Authenticated (Subscriber+) Server-Side Request Forgery
- JobBoard Job listing <= 1.2.8 - Unauthenticated Information Exposure
- PlainInventory – Inventory Management Plugin <= 3.1.5 - Reflected Cross-Site Scripting
- Happy Addons for Elementor <= 3.10.3 - Authenticated (Contributor+) Stored Cross-Site Scripting via Photo Stack Widget
- User Registration & Membership – Free & Paid Memberships, Subscriptions, Content Restriction, User Profile, Custom User Registration & Login Builder < 5.2.8 - Authenticated (Author+) Privilege Escalation
- NPS computy <= 2.8.2 - Unauthenticated Stored Cross-Site Scripting
- bbPress <= 2.5.9 - Cross-Site Scripting
- Flo Forms <= 1.0.41 - Missing Authorization via flo_send_test_email
- AppBanners <= 1.5.14 - Authenticated (Administrator+) Stored Cross-Site Scripting
- Feedweb <= 3.0.10 - Missing Authorization
- CitiLights < 3.7.2 - Missing Authorization
- Global Gateway e4 | Payeezy Gateway | <= 2.0 - Unauthenticated Arbitrary File Deletion
- JetTricks <= 1.5.1 - Missing Authorization
- WP Database Backup <= 7.11 - Authenticated (Administrator+) OS Command Injection via 'wp_db_exclude_table' Parameter
- Post Shortcode <= 2.0.9 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode
- Smooth Scroll Links <= 1.1.0 - Cross-Site Request Forgery
- Notivo Notification for WooCommerce <= 1.4.2 - Unauthenticated Information Exposure
- ElementsKit Lite <= 3.5.2 - Authenticated (Contributor+) Stored Cross-Site Scripting via Image Comparison Widget
- Devexhub Gallery <= 2.0.1 - Unauthenticated Arbitrary File Upload
- Mailgun Subscriptions <= 1.3.1 - Authenticated (Contributor+) Stored Cross-Site Scripting
- Typer Core <= 1.9.6 - Authenticated (Contributor+) Post Disclosure
- OneSignal – Web Push Notifications <= 3.6.1 - Missing Authorization to Unauthenticated Plugin Settings Update
- SportsPress Pro <= 2.7.29 - Authenticated (Contributor+) Local File Inclusion
- BEAR <= 1.1.3.3 - Missing Authorization to Product Manipulation
- FrieChat - WordPress Chat Plugin < 1.0.3 - SQL Injection
- SpeedyCache <= 1.1.2 - Missing Authorization via speedycache_create_test_cache
- RapidLoad Power-Up for Autoptimize <= 1.7.1 - Missing Authorization in 'clear_page_cache'
- Cforms <= 10.1 - Cross-Site Scripting
- Easy Elements for Elementor <= 1.4.4 - Unauthenticated Privilege Escalation via easyel_handle_register
- ACF Galerie 4 <= 1.4.2 - Missing Authorization
- Spa and Salon <= 1.2.7 - Cross-Site Request Forgery to Notice Dismissal
- Simple Behance Portfolio <= 0.2 - Reflected Cross-Site Scripting
- Countdown Block <= 1.1.1 - Missing Authorization
- Essential Addons for Elementor <= 6.5.9 - Authenticated (Contributor+) Stored Cross-Site Scripting via Info Box Widget
- AnyVar <= 0.1.1 - Cross-Site Scripting
- EleForms – All In One Form Integration including DB for Elementor <= 2.9.9.9 - Missing Authorization
- Filter Gallery <= 1.1.4 - Missing Authorization
- WP ViewSTL <= 1.0 - Authenticated (Contributor+) Stored Cross-Site Scripting
- Easy Digital Downloads <= 2.11.2 - Reflected Cross-Site Scripting
- Photos, Files, YouTube, Twitter, Instagram, TikTok, Ecommerce Contest Gallery – Upload, Vote, Sell via PayPal, Social Share Buttons <= 24.0.3 - Unauthenticated SQL Injection
- Frontis Blocks <= 1.1.5 - Unauthenticated Server-Side Request Forgery
- BuddyPress <= 5.1.0 - Denial of Service
- POST SMTP Mailer – Email log, Delivery Failure Notifications and Best Mail SMTP for WordPress <= 2.9.3 - Authenticated (Administrator+) SQL Injection
- Grid <= 2.3.1 - Cross-Site Request Forgery
- Vuukle Comments, Reactions, Share Bar, Revenue <= 3.4.31 - Cross-Site Request Forgery Bypass
- click5 CRM add-on to Contact Form 7 <= 1.0.4 - Unauthenticated Stored Cross-Site Scripting
- Newsletter Email Subscribe <= 2.4 - Cross-Site Request Forgery to Plugin Settings Update
- YaySMTP <= 2.6.4 - Authenticated (Administrator+) SQL Injection
- WP Hotel Booking <= 2.3.1 - Unauthenticated Insufficient Verification of Data Authenticity to Payment Bypass via PayPal IPN Handler
- Youtube Feeder <= 2.0.1 - Cross-Site Request Forgery