Vulnerability archive: section 8, page 10
Open a report to review affected versions, available fixes and original sources. Each report covers a specific issue; its presence does not establish whether your website is affected.
- WooCommerce Designer Pro <= 1.9.24 - Unauthenticated Arbitrary File Upload
- WP Ride Booking <= 2.4 - Cross-Site Request Forgery
- Ultimate SMS Notifications for WooCommerce <= 1.4.1 - CSV Injection
- Docus <= 1.0.6 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode Attributes
- WordPress Page Builder – Zion Builder <= 3.6.16 - Authenticated (Contributor+) Stored Cross-Site Scripting
- Minterpress <= 1.0.5 - Missing Authorization to Authenticated (Subscriber+) Arbitrary Options Update
- mcjh button shortcode <= 1.6.4 - Authenticated (Contributor+) Stored Cross-Site Scripting
- Church Admin <= 5.0.18 - Unauthenticated SQL Injection
- AI Copilot – Content Generator <= 1.5.4 - Unauthenticated SQL Injection
- Scoreboard for HTML5 Games Lite <= 1.2 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode Attributes
- Enable Media Replace <= 3.6.3 - Authenticated (Administrator+) Path Traversal
- Minify HTML <= 2.1.7 - Cross-Site Request Forgery in minify_html_menu_options
- Profile Builder – User Profile & User Registration Forms <= 2.2.4 - Reflected Cross-Site Scripting
- Quick Paypal Payments < 5.7.51 - Unauthenticated Payment Bypass
- Advanced Booking Calendar <= 1.6.6 - Reflected Cross-Site Scripting via calId Parameter
- Integration for WooCommerce and Salesforce <= 1.7.5 - Open Redirect
- WordPress Core < 4.7.2 - Arbitrary Page Modification
- Besa <= 2.3.15 - Unauthenticated Local File Inclusion
- MapSVG – Vector maps, Image maps, Google Maps <= 8.14.0 - Authenticated (Admin+) Arbitrary File Upload
- Slotti Ajanvaraus <= 1.3.0 - Authenticated (Contributor+) Stored Cross-Site Scripting
- YouTube Channel < 3.0.12.1 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode
- elink – Embed Content <= 1.1.0 - Authenticated (Contributor+) Insufficient Input Validation
- WP Rocket 3.23.1 - 3.23.3.2 - Unauthenticated Information Exposure
- WishSuite <= 1.5.1 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'button_text' Shortcode Attribute
- CopySafe Web Protection <= 5.1 - Missing Authorization
- Simple File List <= 4.2.7 - Arbitrary File Deletion
- HelloAsso <= 1.1.10 - Missing Authorization
- Top 10 – Popular posts plugin for WordPress <= 2.4.3 - SQL Injection
- WooCommerce Basic Ordernumbers <= 1.4.4 - Missing Authorization
- Intuitive Custom Post Order <= 3.1.3 - Missing Authorization to Authenticated Settings Change
- WP Inventory Manager <= 2.5.3 - Authenticated (Contributor+) SQL Injection
- Element Pack Elementor Addons (Header Footer, Template Library, Dynamic Grid & Carousel, Remote Arrows) <= 5.10.1 - Authenticated (Contributor+) Stored Cross-Site Scripting via Age Gate
- PJW Mime Config <= 1.0 - Authenticated (Author+) Stored Cross-Site Scripting via SVG File Upload
- WP Job Portal <= 2.2.2 - Authenticated (Admin+) SQL Injection
- Post Views <= 2.6.1.2 - Cross-Site Scripting
- HTML5 Video Player <= 5.3.5 - Reflected Cross-Site Scripting
- MW WP Form <= 5.1.2 - Insecure Direct Object Reference to Unauthenticated Sensitive Information Disclosure via 'post_id' Query Parameter
- Get Custom Field Values <= 4.0.1 - Authenticated(Contributor+) Stored Cross-Site Scripting via Custom Meta Widget
- ANAC XML Bandi di Gara <= 7.5 - Authenticated (Editor+) Stored Cross-Site Scripting
- Copymatic – AI Content Writer & Generator <= 1.6 - Unauthenticated Arbitrary File Upload
- WC Fields Factory <= 4.1.5 - Authenticated(Subscriber+) SQL Injection
- Broadcast Live Video – Live Streaming : WebRTC, HLS, RTSP, RTMP <= 7.3.6 - Missing Authorization
- SEO Friendly Images <= 3.0.4 - Cross-Site Request Forgery to Cross-Site Scripting
- Ivory Search <= 5.5.13 - Authenticated (Administrator+) Stored Cross-Site Scripting via 'menu_gcse' and 'nothing_found_text' Parameters
- Blocksy Companion <= 2.1.19 - Authenticated (Author+) Arbitrary File Upload via SVG Upload Bypass
- Page-list <= 5.2 - Authenticated (Contributor+) Stored Cross-Site Scripting
- Kids Gift Shop <= 0.5.4 - Authenticated (Subscriber+) Arbitrary File Upload
- ElementsKit Elementor Addons – Advanced Widgets & Templates Addons for Elementor <= 4.0.6 - Authenticated (Contributor+) Stored Cross-Site Scripting
- Cost Calculator <= 1.8 - Authenticated (Contributor+) Stored Cross Site Scripting via Shortcode
- Essential Real Estate <= 5.2.1 - Unauthenticated Local File Inclusion
- WooCommerce Dropshipping Premium <= 4.3 - Unauthenticated SQL Injection
- WP-Members Membership Plugin <= 2.8.9 - Reflected Cross-Site Scripting
- Brizy – Page Builder <= 2.6.8 - Authenticated (Author+) Stored Cross-Site Scripting via SVG File Upload
- Dailydeal by Templatic < = 3.0.10 - Cross-Site Request Forgery to Arbitrary File Upload
- Nelio AB Testing <= 8.1.8 - Authenticated (Editor+) Remote Code Execution
- Semantic Shortcode <= 1.0.1 - Authenticated (Contributor+) Stored Cross-Site Scripting
- Nexter Blocks <= 4.0.4 - Authenticated (Contributor+) Stored Cross-Site Scripting
- Contact Form and Calls To Action by vcita <= 4.10.5 - Cross-Site Request Forgery to Stored Cross-Site Scripting
- WP Compress <= 7.25.00 - Unauthenticated Privilege Escalation to 'group'/'setting'/'value' Parameters on comms Endpoint
- Ziggeo <= 3.1.1 - Missing Authorization to Authenticated (Subscriber+) Arbitrary Modification via 'ziggeo_ajax' AJAX Action
- Fattura24 <= 6.2.7 - Reflected Cross-Site Scripting via 'id'
- UpdraftPlus WordPress Backup Plugin < 1.6.59 - Stored Cross-Site Scripting
- FunnelKit <= 3.15.0.5 - Authenticated (Admin+) Arbitrary File Deletion
- Borderless – Widgets, Elements, Templates and Toolkit for Elementor & Gutenberg <= 1.6.0 - Authenticated (Administrator+) Remote Code Execution
- Appointment Booking Calendar <= 1.2.24 - SQL Injection
- JNews <= 11.6.5 - Missing Authorization
- North <= 5.7.5 - Unauthenticated Local File Inclusion
- Taskbot <= 6.6 - Unauthenticated Privilege Escalation
- Simple Price Calculator <= 1.3 - Missing Authorization
- ShortPixel Image Optimizer <= 6.4.2 - Authenticated (Editor+) Arbitrary File Read via 'loadFile' Parameter
- Fluent Booking <= 1.9.11 - Missing Authorization
- SiteVault – Backup, Restore, Migration & Cloning <= 1.5.19 - Unauthenticated Remote Code Execution
- JAY Login & Register <= 2.4.01 - Authentication Bypass via Cookie
- myCred – Points, Rewards, Gamification, Ranks, Badges & Loyalty Plugin <= 2.4.3 - Missing Authorization
- Doctreat - Hospitals and Doctors Directory WordPress Listing Theme <= 1.7.0 - Unauthenticated Arbitrary File Upload
- Booking for Appointments and Events Calendar – Amelia <= 2.4.10 - Missing Authorization
- DirectoryPress <= 3.6.26 - Unauthenticated Information Exposure
- reCAPTCHA Jetpack <= 0.2.2 - Cross-Site Request Forgery to Stored Cross-Site Scripting
- MetForm <= 4.3.0 - Unauthenticated Information Exposure
- Gallery and Lightbox <= 1.0.14 - Authenticated (Contributor+) Stored Cross-Site Scripting
- WP Maps – Display Google Maps Perfectly with Ease <= 4.7.1 - Authenticated (Admin+) Stored Cross-Site Scripting
- RapidLoad Power-Up for Autoptimize <= 1.7.1 - Cross-Site Request Forgery via 'clear_uucss_logs'
- Strong Testimonials <= 3.2.3 - Missing Authorization
- Solace Extra < 1.7.0 - Missing Authorization to Unauthenticated Unpublished Site Builder Content Disclosure
- Bottom Bar <= 0.1.7 - Cross-Site Request Forgery to Settings Update
- MonsterInsights Pro <= 8.14.1 - Authenticated (Contributor+) Stored Cross-Site Scripting
- WPS Hide Login <= 1.5.2.2 - Login Page Disclosure via 'adminhash'
- Login with Vipps and MobilePay <= 1.3.3 - Authenticated (Contributor+) Stored Cross-Site Scripting
- WC Vendors – WooCommerce Multivendor, WooCommerce Marketplace, Product Vendors <= 2.6.8 - Authenticated (Subscriber+) SQL Injection
- Easy Google Maps <= 1.11.11 - Cross-Site Request Forgery
- Dessau < 1.9 - Unauthenticated Local File Inclusion
- Saphali Woocommerce Lite <= 1.8.13 - Cross-Site Request Forgery via 'woocommerce_saphali_page_s_l'
- Business Directory <= 6.4.18 - Missing Authorization
- VikBooking Hotel Booking Engine & PMS <= 1.8.14 - Unauthenticated Stored Cross-Site Scripting
- Chained Quiz <= 1.3.5 - Unauthenticated Insecure Direct Object Reference via Cookie
- PopupKit <= 2.1.5 - Authenticated (Subscriber+) Information Exposure
- Automated Editor <= 1.3 - Cross-Site Request Forgery via admin menu pages
- WPGraphQL <= 1.14.5 - Authenticated (Editor+) Server-Side Request Forgery
- Montezuma < 1.1.8 - Cross-Site Scripting
- DethemeKit For Elementor <= 2.1.8 - Authenticated (Contributor+) Protected Post Disclosure