Vulnerability archive: section 9, page 11
Open a report to review affected versions, available fixes and original sources. Each report covers a specific issue; its presence does not establish whether your website is affected.
- Parallax Scroll <= 2.0.1 - Cross-Site Scripting
- Sirv <= 7.1.2 - Missing Authorization via sirv_disconnect
- Elementor Addon Elements <= 1.12.12 - Authenticated(Contributor+) Stored Cross-Site Scripting via Modal Popup effet
- Shoutbox (Unknown Versions) - Cross-Site Scripting
- KBucket <= 4.1.6 - Cross-Site Request Forgery to Stored Cross-Site Scripting
- Custom Product Tabs for WooCommerce <= 1.8.5 - Authenticated (Shop Manager+) PHP Object Injection
- Forminator <= 1.24.1 - Reflected Cross-Site Scripting
- mTouch Quiz <= 3.1.2 - Stored Cross-Site Scripting
- Reviews Plus < 1.2.14 - Denial of Service
- Live Chat Unlimited <= 2.8.3 - Stored Cross-Site Scripting
- Support Plus Responsive Ticket System <= 4.1 - SQL Injection
- Multisite Content Copier/Updater Pro < 2.1.2 - Reflected Cross-Site Scripting
- bbp style pack <= 5.5.5 - Reflected Cross-Site Scripting
- Membership For WooCommerce <= 2.8.0 - Authenticated (Contributor+) Stored Cross-Site Scripting
- Essential Blocks <= 4.0.6 - Missing Authorization via get
- PayPal Pro Add-on for iThemes Exchange < 1.1.0 - Cross-Site Scripting
- PPWP: Password Protect Pages, Posts & Full or Partial Content <= 1.9.15 - Improper Authorization To Authenticated (Contributor+) Master Password Exposure
- Event Booking Manager for WooCommerce – Sell Tickets, Event Registration, RSVP & Event Calendar < 5.3.7 - Missing Authorization
- Contact Form Entries <= 1.3.0 - Authenticated (Contributor+) Stored Cross-Site Scripting via vx-entries shortcode
- Local Magic <= 2.6.0 - Unauthenticated SQL Injection
- WP FullCalendar <= 1.4.1 - Missing Authorization to Information Disclosure
- MStore API – Create Native Android & iOS Apps On The Cloud <= 4.17.4 - Unauthenticated Limited Privilege Escalation
- WooCommerce Price Alert <= 1.0.4 - Reflected Cross-Site Scripting
- InfiniteWP Client <= 1.12.3 - Unauthenticated Sensitive Information Exposure
- Multiple Plugins and Themes by inkthemes <= 1.1.8 - Unauthenticated Information Exposure
- BackupBuddy < 3.0 - Authentication Bypass
- MailerPress <= 1.5.0 - Missing Authorization to Unauthenticated Arbitrary Modification via REST API Endpoint
- LifterLMS <= 7.5.0 - Cross-Site Request Forgery
- vipdrv <= 1.0.3 - Authenticated (Administrator+) Stored Cross-Site Scripting
- WebinarPress <= 1.33.9 - Reflected Cross-Site Scripting
- WP Photo Album Plus <= 5.4.7 - Stored Cross-Site Scripting
- Enqueue Anything <= 1.0.1 - Missing Authorization
- PowerPack Lite for Elementor <= 2.9.4 - Authenticated (Contributor+) Stored Cross-Site Scripting Via 'cursor_url'
- WP Optin Wheel <= 1.4.2 - Sensitive Information Exposure via Log File
- Contact Form Plugin by Fluent Forms for Quiz, Survey, and Drag & Drop WP Form Builder <= 5.1.19 - Authenticated (Form Manager+) Stored Cross-Site Scripting
- JetBlocks For Elementor <= 1.3.18 - Authenticated (Contributor+) Stored Cross-Site Scripting
- Elements kit Elementor addons <= 2.9.1 - Missing Authorization
- Twitter @Anywhere Plus <= 2.0 - Cross-Site Request Forgery to Stored Cross-Site Scripting
- Iptanus File Upload <= 5.1.7 - Unauthenticated SQL Injection
- JetBackup <= 3.1.19.8 - Authenticated (Administrator+) Arbitrary Directory Deletion via Path Traversal in 'fileName' Parameter
- Accessibility <= 1.0.2 - Authenticated (Administrator+) Stored Cross-Site Scritping
- Option Editor <= 1.0 - Cross-Site Request Forgery to Arbitrary Options Update
- dsSearchAgent: WordPress Edition <= 1.0-beta10 - Reflected Cross-Site Scripting
- Sync WooCommerce Product feed to Google Shopping <= 1.2.4 - Authenticated (Admin+) SQL Injection
- WooCommerce Multilingual & Multicurrency <= 5.3.8 - Missing Authorization
- Category Order and Taxonomy Terms Order <1.4.6.0 - Cross-Site Scripting
- JSON REST API <= 1.1 - Potential Cross-Site Request Forgery Bypass
- Donations Made Easy – Smart Donations <= 4.0.12 - Authenticated (Administrator+) SQL Injection
- Admin Custom Login <= 2.4.7 - Cross-Site Request Forgery to Stored Cross-Site Scripting
- WOLF – WordPress Posts Bulk Editor and Manager Professional <= 1.0.8.1 - Missing Authorization
- WPMU DEV Dashboard <= 5.0.1 - Authentication Bypass to Administrator via SSO HMAC Canonicalization Confusion
- WP Mail Logging <= 1.11.2 - Missing Authorization to Notice Dismissal
- ShrinkTheWeb (STW) Website Previews <= 2.8.5 - Cross-Site Request Forgery
- Design for Contact Form 7 Style WordPress Plugin – CF7 WOW Styler <= 1.7.1 - Unauthenticated Arbitrary Shortcode Execution and Reflected Cross-Site Scripting
- Enfold <= 6.0.9 - Authenticated (Subscriber+) Server-Side Request Forgery via attachment_id
- WooCommerce Loyal Customers <= 2.6 - Missing Authorization
- MicroPayments <= 2.9.29 - Authenticated (Contributor+) Stored Cross-Site Scripting
- Music Player for WooCommerce <= 1.8.9 - Unauthenticated Stored Cross-Site Scripting
- WP EasyPay <= 4.0.4 - Cross-Site Request Forgery
- Product Specifications for Woocommerce <= 0.6.0 - Reflected Cross-Site Scripting via Arbitrary Query String Parameter
- Happy Addons for Elementor <= 3.10.6 - Authenticated (Contributor+) Stored Cross-Site Scripting via Calendly Widget
- OneLogin SAML SSO < 2.2.0 - Authentication Bypass
- UpdraftPlus 1.22.14 to 1.23.2 and UpdraftPlus (Premium) 2.22.14 to 2.23.2 - Privilege Escalation via updraft_central_ajax_handler
- Cardoza AJAX Search < 1.3 - Unauthenticated SQL Injection
- WP Like Button <= 1.7.0 - Missing Authorization via crublabFBLBAjax
- App Builder – Create Native Android & iOS Apps On The Flight <= 5.5.10 - Unauthenticated Privilege Escalation via 'role' Parameter
- CLP Varnish Cache <= 1.0.2 - Missing Authorization
- WooCommerce Chained Products < 2.12.0 - Missing Authorization to Arbitrary Options Update
- Blog Summary <= 0.1.2 β - Authenticated (Contributor+) Stored Cross-Site Scripting
- AGIL(Automatic Grid Image Listing) <= 1.0 - Arbitrary File Upload
- Material Design Icons for Page Builders <= 1.4.2 - Cross-Site Request Forgery
- SAML Single Sign On – SAML SSO Login <= 4.8.83 - Cross-Site Scripting
- Currency Switcher <= 1.1.6 - Cross-site request forgery
- Form Maker by 10Web <= 1.15.44 - Authenticated (Subscriber+) SQL Injection
- Mooberry Book Manager 4.16.2 - Authenticated (Subscriber+) SQL Injection
- Cooked Pro < 1.8.0 - Cross-Site Request Forgery
- Spam protection, Anti-Spam, FireWall by CleanTalk <= 6.44 - Authorization Bypass due to Missing Empty Value Check to Unauthenticated Arbitrary Plugin Installation
- Cost Calculator Builder <= 4.0.11 - Unauthenticated Sensitive Information Exposure of Payment Gateway Secret Keys
- VS Contact Form <= 11.5 - Reflected Cross-Site Scripting
- Events Manager <= 5.5.1 - Multiple Cross-Site Scripting
- SVGMagic <= 1.1 - Authenticated (Author+) Stored Cross-Site Scripting via SVG Upload
- Jobify - Job Board WordPress Theme < 4.3.0 - Missing Authorization
- Instant Images <= 5.1.0.1 - Authenticated (Author+) Server-Side Request Forgery via instant_images_download
- AWP Classifieds < 4.4.9 - Missing Authorization
- Business Directory Plugin – Easy Listing & Member Directories for WordPress <= 6.4.27 - Authenticated (Contributor+) Insecure Direct Object Reference
- miniOrange Discord Integration <= 2.2.4 - Missing Authorization
- WCFM Marketplace <= 3.6.2 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode
- WPAdverts <= 2.2.4 - Authenticated (Contributor+) Stored Cross-Site Scripting
- Simple Wp Sitemap <= 1.2.1 - Cross-Site Request Forgery
- Pricing Table WordPress Plugin – Easy Pricing Tables <= 4.1.2 - Authenticated (Contributor+) SQL Injection
- Users manager – PN <= 1.1.15 - Unauthenticated Privilege Escalation via Account Takeover via 'userspn_form_save' AJAX Action
- Checkout with Zelle on Woocommerce <= 3.1 - Missing Authorization
- MDJM Event Management <= 1.7.6 - Authenticated (Subscriber+) Privilege Escalation
- All-in-One WP Migration <= 6.45 - Reflected Cross-Site Scripting
- Ricky < 2.31 - Unauthenticated PHP Object Injection
- Tooltip <= 1.0.1 - Authenticated (Contributor+) Stored Cross-Site Scripting
- Jeg Elementor Kit <= 2.6.3 - Authenticated (Contributor+) Stored Cross-Site Scripting via Testimonial
- Include Me <= 1.2.1 - Local File Inclusion leading to Authenticated Remote Code Execution
- MegaMenu <= 2.3.12 - Unauthenticated Local File Inclusion
- RVM - Responsive Vector Maps <= 6.4.1 - Subscriber+ Arbitrary File Read