Vulnerability archive: section 7, page 4
Open a report to review affected versions, available fixes and original sources. Each report covers a specific issue; its presence does not establish whether your website is affected.
- Rencontre <= 3.13.7 - Cross-Site Request Forgery
- Happy Addons for Elementor <= 3.12.0 - Authenticated (Contributor+) Stored Cross-Site Scripting
- UiCore Elements <= 1.3.13 - Authenticated (Contributor+) Stored Cross-Site Scripting
- Ultimate Member <= 2.11.2 - Authenticated (Contributor+) Sensitive Information Exposure to Account Takeover via Shortcode Template Tag
- WP Hotel Booking <= 2.0.9.2 - Missing Authorization
- Addonify – WooCommerce Wishlist <= 2.0.15 - Missing Authorization to Unauthenticated Settings Update
- HTML5 Radio Player - WPBakery Page Builder Addon <= 2.5 - Reflected Cross-Site Scripting
- Participants Database <= 2.4.9 - Authenticated(Administrator+) Stored Cross-Site Scripting via plugin settings
- Oxygen <= 6.0.8 - Unauthenticated Server-Side Request Forgery
- Crisp <= 0.44 - Authenticated (Subscriber+) Stored Cross-Site Scripting
- Pixel Manager for WooCommerce – Conversion Tracking, Google Ads, GA4, TikTok, Dynamic Remarketing <= 1.69.0 - Authenticated (Contributor+) Stored Cross-Site Scripting
- GeoDirectory – WP Business Directory Plugin and Classified Listings Directory <= 2.8.97 - Unauthenticated SQL Injection
- PDF Generator for Wordpress <= 1.1.1 - Reflected Cross-Site Scripting
- Social Auto Poster <= 5.3.15 - Cross-Site Request Forgery
- WooCommerce PDF Invoice Builder <= 1.2.103 - Reflected Cross-Site Scripting
- Advanced PDF <= 1.1.7 - Missing Authorization
- Configurable Tag Cloud <= 5.2 - Cross-Site Request Forgery via ctc_options_page()
- WordPress Download Manager <= 2.9.45 - Cross-Site Request Forgery
- Banner Cycler <= 1.4 - Cross-Site Request Forgery to Cross-Site Scripting
- Wholesale Market <= 2.2.0 - Information Disclosure via Unauthenticated Arbitrary File Download
- Database Backup for WordPress <= 2.3.3 - Authenticated Stored Cross-Site Scripting via backup_receipient Parameter
- Quiz and Survey Master (QSM) <= 11.2.1 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'question_title' Parameter
- Permalink Manager Lite <= 2.5.1.3 - Unauthenticated Sensitive Information Exposure
- All In One WP Security <= 5.2.6 - Cross-Site Request Forgery to IP Blocking
- WCFM Marketplace <= 3.7.0 - Insecure Direct Object Reference to Unauthenticated Arbitrary Refund Request Creation
- EventON <= 2.4.1 - Authenticated (Contributor+) Local File Inclusion
- Wordapp <= 1.7.0 - Missing Authorization
- Media Library Categories <= 1.1.1 - Unauthenticated Multiple Cross-Site Scripting
- Phox Hosting <= 2.0.8 - Reflected Cross-Site Scripting
- Featured Image via URL <= 0.1 - Authenticated (Contributor+) Arbitrary FIle Upload
- Search Atlas SEO – OTTO AI SEO Automation for WordPress < 2.6.24 - Missing Authorization
- Advanced iFrame <= 2025.2 - Authenticated (Contributor+) Stored Cross-Site Scripting
- Big Store <= 2.0.8 - Missing Authorization
- Top 10 – Popular posts plugin for WordPress <= 3.2.3 - Cross-Site Request Forgery via tptn_ajax_clearcache
- Login Block IPs <= 1.0.0 - Cross-Site Request Forgery to Plugin Settings Update
- Printeers Print & Ship <= 1.17.0 - Cross-Site Request Forgery
- wpForo Forum <= 2.3.3 - Authenticated (Contributor+) SQL Injection
- SimpleForm Contact Form Submissions <= 2.1.0 - Reflected Cross-Site Scripting
- iNET Webkit <= 1.2.4 - Missing Authorization
- WordPress Tables <= 1.3.9 - Reflected Cross-Site Scripting via error_msg
- All-in-One WP Migration and Backup <= 7.97 - Authenticated (Administrator+) Stored Cross-Site Scripting via Import
- ShopMagic <= 4.7.2 - Missing Authorization
- Keep Backup Daily <= 2.0.3 - Reflected Cross-Site Scripting
- Jetapo | Jobboard WordPress Theme and Jetapo | Jobboard WordPress Theme with WooCommerce < 1.1 - Cross-Site Scripting
- Royal Elementor Addons and Templates <= 1.3.975 - Authenticated (Contributor+) Stored Cross-Site Scripting
- IdeaPush <= 8.52 - Authenticated (Administrator+) Stored Cross-Site Scripting
- BadgeOS <= 3.7.1.2 - Authenticated (Subscriber+) SQL Injection
- UserPlus <= 2.0 - Privilege Escalation
- Editor Custom Color Palette <= 3.4.8 - Missing Authorization
- Academy LMS Pro < 3.5.2 - Authenticated (Custom+) Arbitrary File Upload
- HandL UTM Grabber / Tracker <= 2.8.0 - Reflected Cross-Site Scripting
- GamePress – The Game Database Plugin <= 1.1.0 - Reflected Cross-Site Scripting
- Structured Content (JSON-LD) #wpsc <= 1.7.0 - Authenticated (Contributor+) Stored Cross-Site Scripting
- Debug Bar <= 0.8 - Reflected Cross-Site Scripting
- Adifier System < 3.1.4 - Unauthenticated SQL Injection
- WP Mailster <= 1.8.17.0 - Reflected Cross-Site Scripting
- Clink <= 1.2.2 - Authenticated (Contributor+) Stored Cross-Site Scripting
- Reviews Feed <= 2.6.4 - Unauthenticated Arbitrary Shortcode Execution
- Tutor LMS <= 3.9.11 - Authenticated (Administrator+) SQL Injection via 'data' Parameter
- Team Section Block – Showcase Team Members with Layout Options <= 2.0.4 - Unauthenticated Stored Cross-Site Scripting
- WP 2FA <= 2.6.3 - Unauthenticated Information Exposure via Log File
- Calendar Event Multi View < 1.0.2 - SQL Injection
- VillaTheme Core <= 1.0.5 - Missing Authorization
- Plugin A/B Image Optimizer <= 3.3 - Authenticated (Subscriber+) Arbitrary File Download
- Slick Popup: Contact Form 7 Popup Plugin <= 1.7.14 - Authenticated (Admin+) Stored Cross-Site Scripting
- FileOrganizer <= 1.1.4 - Authenticated (Administrator+) Local JavaScript File Inclusion
- Popup Box <= 3.8.6 - Authenticated (Administrator+) Stored Cross-Site Scripting
- Simple Optimizer <= 1.2.7 - Cross-Site Request Forgery
- Polls CP <= 1.0.8 - Cross-Site Request Forgery
- Ultimate Dashboard <= 3.8.14 - Cross-Site Request Forgery to Module Activation/Deactivation
- Advanced WC Analytics <= 3.19.0 - Missing Authorization to Unauthenticated Settings Update
- Affiliate Booster – Pros & Cons, Notice, and CTA Blocks for Affiliates <= 3.0.5 - Cross-Site Request Forgery via process_bulk_action
- Ultra Addons Lite for Elementor <= 1.1.8 - Authenticated (Contributor+) Stored Cross-Site Scripting
- Propovoice Pro <= 1.7.0.3 - Unauthenticated SQL Injection
- Shortcode Addons <= 3.2.5 - Authenticated (Administrator+) Stored Cross-Site Scripting
- Track, Analyze & Optimize by WP Tao <= 1.3 - Reflected Cross-Site Scripting
- WP Tabs – Responsive Tabs Plugin for WordPress <= 1.8.0 - Stored Cross-Site Scripting
- Ninja Forms Contact Form <= 3.4.24.1 - Cross-Site Request Forgery leading to Stored Cross-Site Scripting
- Ninja Forms – The Contact Form Builder That Grows With You <= 3.8.0 - Authenticated (Admin+) Stored Cross-Site Scripting
- Wicked Folders <= 2.18.16 - Cross-Site Request Forgery via ajax_save_sort_order
- SEO Help <= 6.8.5 - Missing Authorization
- Hotel + Bed and Breakfast Booking Calendar Theme | Bellevue <= 4.2.2 - Missing Authorization
- gee Search Plus, improved WordPress search <= 1.4.4 - Authenticated (Admin+) Stored Cross-Site Scripting
- WP eCommerce <= 3.15.1 - Missing Authorization to Unauthenticated Arbitrary Post Creation
- Web Application Firewall <= 2.1.2 - IP Address Spoofing to Protection Mechanism Bypass
- Wanderland <= 1.7.1 - Unauthenticated Local File Inclusion
- WPLegalPages <= 3.5.4 - Missing Authorization
- Allow SVG Files <= 1.1 - Authenticated (Author+) Stored Cross-Site Scripting
- Login Logout Shortcode <= 1.1.0 - Authenticated (Contributor+) Stored Cross-Site Scripting via class Parameter
- Zoho Forms <= 3.0.0 - Authenticated (Contributor+) Stored Cross-Site Scripting
- Magazine Companion <= 1.2.3 - Authenticated (Contributor+) Stored Cross-Site Scripting
- SMTP by BestWebSoft <= 1.0.9 - Multiple Cross-Site Scripting
- Multiple Plugins <= Multiple Versions - Authenticated Remote Code Execution
- Mail Masta Plugin <= 1.0 - SQL Injection via filter_list
- Deeper Comments <= 2.1.1 - Missing Authorization to Authenticated(Subscriber+) Arbitrary Options Update
- Majestic Support – The Leading-Edge Help Desk & Customer Support Plugin <= 1.0.5 - Unauthenticated Sensitive Information Exposure Through Unprotected Directory
- Frontend Dashboard <= 2.2.2 - Sensitive Information Exposure
- GiveWP <= 2.25.1 - Cross-Site Request Forgery via give_cache_flush
- Houzez Login Register <= 3.2.5 - Authenticated (Subscriber+) Privilege Escalation via Account Takeover
- Business Directory Plugin <= 6.4.20 - Missing Authorization to Unauthenticated Arbitrary Listing Modification