Vulnerability archive: section 9, page 10
Open a report to review affected versions, available fixes and original sources. Each report covers a specific issue; its presence does not establish whether your website is affected.
- Easy Textillate <= 2.02 - Authenticated(Contributor+) Stored Cross-Site Scripting
- Sensei LMS <= 4.4.3 - Information Disclosure
- Elementor Addons by Livemesh <= 8.3.4 - Authenticated (Contributor+) Stored Cross-Site Scripting via Posts Slider Widget
- WooPayments <= 10.5.1 - Missing Authorization to Unauthenticated Plugin Settings Update via save_upe_appearance_ajax
- Site Reviews <= 6.2.0 - Unauthenticated CSV Injection
- Import and export users and customers <= 1.29.7 - Privilege Escalation to Administrator via save_extra_user_profile_fields
- Back Button Widget <= 1.6.3 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode
- Verge3D 4.1.0 - 4.13.0 - Missing Authorization
- WC1C <= 0.23.0 - Reflected Cross-Site Scripting
- Rencontre – Dating Site <= 3.1.2 - Cross-Site Scripting
- Books Gallery – Book Showcase, Library & Affiliate Plugin <= 4.8.4 - Authenticated (Contributor+) Stored Cross-Site Scripting
- Smaily for WP <= 3.1.5 - Authenticated (Contributor+) Stored Cross-Site Scripting
- Automation By Autonami <= 2.6.1 - Authenticated(Administrator+) SQL Injection
- Software Issue Manager <= 5.0.0 - Unauthenticated SQL Injection
- The Ultimate WordPress Toolkit – WP Extended <= 3.0.8 - Directory Traversal to Authenticated (Subscriber+) Arbitrary File Download
- 10Web Booster <= 2.34.8 - Unauthenticated Stored Cross-Site Scripting via Comment Author Name
- Payment Button for PayPal <= 1.2.3.41 - Missing Authorization to Unauthenticated Arbitrary Order Creation
- Business Directory <= 6.4.19 - Cross-Site Request Forgery
- TrueBooker <= 1.2.6 - Unauthenticated Authorization Bypass Through User-Controlled Key to Account Takeover to 'truebooker_wp_user_id' Parameter
- Post Thumbs <= 1.5 - Cross-Site Request Forgery to Stored Cross-Site Scripting
- Media Library Assistant <= 3.39 - Authenticated (Contributor+) Stored Cross-Site Scripting
- Online Booking & Scheduling Calendar for WordPress by vcita <= 4.4.2 - Missing Authorization on REST-API
- WooCommerce Products Vendor <= 2.1.65 - Insecure Direct Object Reference to Note Creation
- WP Construction Mode <= 1.91 - Reflected Cross-Site Scripting
- Schedule Post Changes With PublishPress Future: Unpublish, Delete, Change Status, Trash, Change Categories <= 4.10.0 - Authenticated (Administrator+) Stored Cross-Site Scripting via 'wrapper' Shortcode Attribute
- Smush – Lazy Load Images, Optimize & Compress Images <= 2.9.1 - Cross-Site Scripting
- Tutor LMS <= 2.7.4 - Cross-Site Request Forgery via 'addon_enable_disable'
- Paid Videochat Turnkey Site <= 7.3.11 - Authentication Bypass
- Houzez Theme - Functionality <= 4.1.2 - Authenticated (Subscriber+) Arbitrary File Download
- BP Group Documents <= 1.2.1 - Stored Cross-Site Scripting
- Ultimate YouTube Video & Shorts Player With Vimeo <= 3.3 - Missing Authorization to Authenticated (Subscriber+) Arbitrary Playlist/Video Deletion
- WPC Smart Quick View for WooCommerce <= 4.4.0 - Reflected Cross-Site Scripting via 'woosq-redirect' Parameter
- rtMedia for WordPress, BuddyPress and bbPress <= 4.7.8 - Unauthenticated Information Exposure
- WP Mailster <= 1.8.17.0 - Cross-Site Request Forgery
- WP Masquerade <= 1.1.0 - Authenticated (Subscriber+) Account Takeover
- Simple Bike Rental <= 1.0.6 - Missing Authorization to Authenticated (Subscriber+) Sensitive Booking Data Exposure
- Markup <= 4.8.1 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode
- Autoptimize <= 3.1.14 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'ao_post_preload' Meta Value
- Online Payments – Get Paid with PayPal, Square & Stripe <= 3.20.0 - Authenticated (Contributor+) Stored Cross-Site Scripting
- Header Footer Script Adder – Insert Code in Header, Body & Footer <= 2.0.5 - Authenticated (Contributor+) Stored Cross-Site Scripting
- Quicksand Post Filter jQuery Plugin <= 3.1.1 - Cross-Site Request Forgery via renderAdmin
- Airin Blog <= 1.6.2 - Unauthenticated PHP Object Injection
- Download Manager <= 3.2.82 - Unauthenticated Password Leak
- Eject <= 2.17 - Unauthenticated Local File Inclusion
- Wishlist and Save for later for Woocommerce <= 1.1.22 - Insecure Direct Object Reference to Authenticated (Subscriber+) Wishlist Item Deletion
- Simple Link Directory Pro <= 15.0.6 - Unauthenticated Server-Side Request Forgery
- XLTab – Accordions and Tabs for Elementor Page Builder <= 1.3 - Authenticated (Contributor+) Stored Cross-Site Scripting
- Stylish Internal Links <= 1.9 - Authenticated (Contributor+) Stored Cross-Site Scripting
- ThirstyAffiliates Affiliate Link Manager <= 3.10.4 - Subscriber+ Arbitrary Affiliate Links Creation
- AGCA – Custom Dashboard & Login Page <= 7.2.1 - Authenticated (Admin+) Stored Cross-Site Scripting
- Rich Text Editor <= 1.0.1 - Cross-Site Request Forgery to Stored Cross-Site Scripting
- WP 2FA – Two-factor authentication for WordPress <= 2.9.3 - 2-Factor Authentication Bypass
- Download Counter Button <= 1.8.6.7 - Unauthenticated Arbitrary File Download
- Accept Stripe Payments <= 2.0.39 - Authenticated (Admin+) Stored Cross-Site Scripting
- Enable Media Replace <= 4.1.7 - Improper Authorization to Authenticated (Author+) Arbitrary Attachment Change via Background Replace
- ElementsKit Pro <= 4.10.1 - Unauthenticated Stored Cross-Site Scripting via 's' Parameter
- Pago por Redsys <= 1.0.12 - Reflected Cross-Site Scripting
- Groundhogg — CRM, Newsletters, and Marketing Automation <= 4.4 - Authenticated (Sales Representative+) Arbitrary File Deletion
- JobSearch < 3.0.8 - Authenticated (Subscriber+) Local File Inclusion
- CITS Support svg, webp Media and TTF,OTF File Upload <= 2.1.0 - Authenticated(Author+) Stored Cross-Site Scripting via SVG Upload
- bSecure – Your Universal Checkout <= 1.7.9 - Unauthenticated SQL Injection
- Job Board Manager <= 2.1.60 - Missing Authorization
- Clever Fox – One Click Website Importer by Nayra Themes <= 25.2.0 - Missing Authorization to arbitrary theme activation via clever-fox-activate-theme
- WPSID Shortcode <= 1.0.9.2 - Open Redirect
- Map Multi Marker <= 3.2.1 - Reflected Cross-Site Scripting
- Boostify Header Footer Builder for Elementor <= 1.3.5 - Missing Authorization to Page/Post Creation
- ELEX WordPress HelpDesk & Customer Ticketing System <= 3.3.1 - Missing Authorization to Authenticated (Subscriber+) Trash Restore
- SEOWP <= 3.12.2 - Cross-Site Request Forgery
- Tawk.To Live Chat <= 0.5.4 - Missing Authorization to Visitor Monitoring & Chat Removal
- WP Travel <= 4.4.6 - Cross-Site Request Forgery Bypass
- Booking Package <= 1.7.29 - Missing Authorization to Unauthenticated Sensitive Information Disclosure via 'mode=sendBooking' with nonexistent 'timeKey' and 'public=0'
- Simple Colorbox <= 1.6.1 - Authenticated (Contributor+) Stored Cross-Site Scripting
- Shariff Wrapper <= 4.6.9 - Authenticated (Contributor+) Stored Cross-Site Scripting
- Cakifo 1.0 - 1.6.1 - Cross-Site Scripting
- CRM and Lead Management by vcita <= 2.7.4 - Authenticated (Contributor+) Stored Cross-Site Scripting
- Skippy WP-DB Backup (Legacy Plugin) <= 1.7 - Authenticated (Admin+) Directory Traversal
- Front End Users <= 3.2.32 - Authenticated (Admin+) SQL injection
- LTL Freight Quotes – Day & Ross Edition <= 2.1.11 - Authenticated (Administrator+) PHP Object Injection
- WP Media Category Management <= 2.2 - Reflected Cross-Site Scripting
- Mimetic Books <= 0.2.13 - Authenticated (Admin+) Stored Cross-Site Scripting
- Login/Signup Popup ( Inline Form + Woocommerce ) 2.7.1 - 2.7.2 - Missing Authorization to Arbitrary Options Exposure
- sIFR <= 0.6.8.1 - Cross-Site Request Forgery
- Builder for WooCommerce reviews shortcodes – ReviewShort <= 1.01.3 - Cross-Site Request Forgery
- Photo Gallery by 10Web <= 1.8.44 - Authenticated (Author+) SQL Injection via 'album_id' Shortcode Attribute
- Fastest Cache <= 1.5.0 - Unauthenticated Stored Cross-Site Scripting
- rtMedia for WordPress, BuddyPress and bbPress <= 4.7.11 - Unauthenticated SQL Injection via 'compare' Parameter
- PDF Builder for WooCommerce. Create invoices,packing slips and more <= 2.0.11 - Missing Authorization to Authenticated (Subscriber+) Sensitive Invoice Data Disclosure via GetInvoiceDetail AJAX Handler
- Simple:Press – WordPress Forum Plugin <= 6.6.0 - Arbitrary File Upload
- CMP – Coming Soon & Maintenance <= 4.1.13 - Authenticated (Admin+) Arbitrary File Upload
- Online Booking & Scheduling Calendar for WordPress by vcita <= 4.4.2 - Reflected Cross-Site Scripting
- 10WebSocial <= 1.1.26 - Authenticated (Admin+) SQL Injection
- MemberPress Discord Addon <= 1.1.1 - Reflected Cross-Site Scripting
- School Management System – WPSchoolPress <= 2.2.23 - Authenticated (Administrator+) SQL Injection
- mybb Last Topics <= 1.0 - Cross-Site Request Forgery to Stored Cross-Site Scripting
- Launchpad – Coming Soon & Maintenance Mode Plugin <= 1.0.13 - Authenticated (Administrator+) Cross-Site Scripting
- EventPrime <= 4.0.4.5 - Open Redirect
- Permalink Manager for WooCommerce <= 1.0.8.3 - Cross-Site Request Forgery
- Ai Auto Tool Content Writing Assistant (Gemini Writer, ChatGPT ) All in One <= 2.2.7 - Authenticated (Subscriber+) SQL Injection
- Visual Composer Premium <= 45.6.0 - Authenticated (Contributor+) Stored Cross-Site Scripting
- Zephyr Project Manager <= 3.3.202 - Authenticated (Admin+) Stored Cross-Site Scripting