Vulnerability archive: section 9, page 24
Open a report to review affected versions, available fixes and original sources. Each report covers a specific issue; its presence does not establish whether your website is affected.
- LearnPress <= 4.4.6 - Unauthenticated Information Exposure
- Pages Order <= 1.1.3 - Reflected Cross-Site Scripting
- Quick Contact Form <= 8.2.6 - Unauthenticated Open Mail Relay
- Aperitif <= 1.5 - Unauthenticated Local File Inclusion
- SSL Zen <= 4.7.42 - Authenticated (Administrator+) Path Traversal to Arbitrary File Read via 'file_name' Parameter
- OsTende <= 1.4.3 - Unauthenticated Local File Inclusion
- Apimo Connector <= 2.6.4 - Missing Authorization
- OttoKit: All-in-One Automation Platform <= 1.1.27 - Unauthenticated PHP Object Injection
- LMS by LifterLMS <= 3.35.0 - Stored Cross-Site Scripting via Import
- Interactive Geo Maps <= 1.5.8 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode
- Falang multilanguage <= 1.3.65 - Unauthenticated PHP Object Injection
- Everest Backup <= 2.2.4 - Authenticated (Admin+) Arbitrary File Upload
- WooTumblog <= 2.1.4 - Missing Authorization to Unauthenticated Content Injection
- WP Crowdfunding <= 2.1.9 - Authenticated (Admin+) Stored Cross-Site Scripting
- eRocket <= 1.2.4 - Authenticated (Administrator+) Stored Cross-Site Scripting
- Ultimate Form Builder Lite <= 1.3.6 - SQL Injection to PHP Object Injection
- Eventin <= 4.0.26 - Missing Authorization to Unauthenticated Privilege Escalation
- GutenBee <= 2.20.1 - Authenticated (Author+) Arbitrary File Upload via wp_check_filetype_and_ext Filter
- Frontend Admin by DynamiApps <= 3.29.2 - Unauthenticated Privilege Escalation via Form Configuration Injection
- Seo Free <= 1.4 - Cross-Site Request Forgery to Stored Cross-Site Scripting
- wpDiscuz <= 7.6.3 - Missing Authorization via AJAX actions
- WP Dark Mode <= 4.0.7 - Authenticated (Subscriber+) Local File Inclusion via 'style'
- BSK Forms Blacklist <= 3.6.3 - Authenticated (Admin+) Stored Cross-Site Scripting
- Manual - Documentation, Knowledge Base & Education WordPress <= 7.5.4 - Missing Authorization
- Shopire <= 1.0.57 - Missing Authorization to Authenticated (Subscriber+) Limited Plugin Install
- WowOptin <= 1.4.37 - Missing Authorization to Unauthenticated Opt-In Deactivation
- Paid Memberships Pro - Add Member From Admin <= 0.7.2 - Cross-Site Request Forgery
- WP Learn Manager <= 1.1.8 - Missing Authorization to Unauthenticated Arbitrary Plugin Installation and Activation via jslearnmanager_ajax AJAX Action
- Convert Pro <= 1.7.5 - Missing Authorization
- Smart Agenda <= 4.9 - Authenticated (Contributor+) Stored Cross-Site Scripting
- Support Genix <= 1.4.23 - Missing Authorization
- SEOPress 5.0.0 - 5.0.3 - Stored Cross-Site Scripting
- LIVE TV <= 1.2 - Reflected Cross-Site Scripting
- WPCasa <= 1.4.1 - Unauthenticated Code Injection
- Admin side data storage for Contact Form 7 <= 1.1.1 - Cross-Site Request Forgery
- CBX Bookmark & Favorite <= 1.6.8 - Reflected Cross-Site Scripting
- All in One SEO – Powerful SEO Plugin to Boost SEO Rankings & Increase Traffic <= 4.8.9 - Missing Authorization to Authenticated (Contributor+) Arbitrary Media Deletion
- Ninja Forms Contact Form <= 2.9.21 - Reflected Cross-Site Scripting
- Autoshare for Twitter <= 2.3.1 - Missing Authorization
- Jetpack < 7.0.1 - Cross-Site Scripting
- Learnify - Online Courses Education WordPress Theme <= 1.15.0 - Unauthenticated Local File Inclusion
- 워드프레스 결제 심플페이 – 우커머스 결제 플러그인 <= 5.5.17 - Missing Authorization to Unauthenticated Settings Update
- FCChat Widget < 2.2.13.7 - Arbitrary File Upload
- JS Help Desk <= 3.0.1 - Authenticated (Subscriber+) SQL Injection
- Ninja Forms <= 3.14.1 - Authenticated (Contributor+) Sensitive Information Disclosure via Block Editor Token
- WooCommerce Product Carousel, Slider & Grid Ultimate <= 1.8.6 - Authenticated (Contributor+) Stored Cross-Site Scripting
- Pretty Links – Link Management, Branding, Tracking & Sharing Plugin < 1.5.6 - Reflected Cross-Site Scripting
- The Pack Elementor addon <= 2.1.4 - Authenticated (Contributor+) Stored Cross-Site Scripting
- Live Composer – Free WordPress Website Builder <= 2.0.2 - Authenticated (Contributor+) PHP Object Injection via dslc_module_posts_output Shortcode
- OAuth Single Sign On – SSO (OAuth Client) <= 6.24.1- Cross-Site Request Forgery via 'discard' in mooauth_client_applist_page
- Hydra Booking — Appointment Scheduling & Booking Calendar <= 1.1.41 - Missing Authorization
- Accept Donations with PayPal & Stripe <= 1.4.4 - Reflected Cross-Site Scripting
- Fontsampler <= 0.4.12 - Cross-Site Request Forgery to Cross-Site Scripting
- Cooked – Recipe Management <= 1.7.15.4 - Authenticated (Contributor+) HTML Injection
- Photo Gallery by 10Web <= 1.6.2 - SQL Injection
- Addonify – Compare Products For WooCommerce <= 1.1.17 - Missing Authorization to Unauthenticated Settings Update
- WCFM Marketplace <= 3.4.11 - Missing Authorization
- BuddyBuilder - BuddyPress Builder for Elementor <= 1.7.3 - Cross-Site Request Forgery
- JoomSport <= 5.7.8 - Authenticated (Subscriber+) Missing Authorization to Arbitrary Group Creation/Modification via season_groupedit AJAX action
- WPS Telegram Chat <= 4.6.0 - Missing Authorization to Information Exposure
- Gravityforms <= 1.9.6 - Cross-Site Scripting
- custom-post-edit <= 1.0.4 - Reflected Cross-Site Scripting
- SMS OVH <= 0.1 - Reflected Cross-Site Scripting
- WP Bootstrap Tabs <= 1.0.4 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode
- Text Prompter – Unlimited chatgpt text prompts for openai tasks <= 1.0.7 - Authenticated (Contributor+) Stored Cross-Site Scripting
- Nuts <= 1.12 - Unauthenticated PHP Object Injection
- Copyright Safeguard Footer Notice <= 3.0 - Cross-Site Request Forgery to Stored Cross-Site Scripting
- Participants Database <= 2.4.9 - Cross-Site Request Forgery via _process_general
- Filter Everything — WordPress & WooCommerce Filters <= 1.9.6 - Reflected Cross-Site Scripting via Elementor Posts Widget Pagination URL
- WP User Frontend < 2.3.11 - Arbitrary File Upload
- WP-Cirrus <= 0.6.11 - Authenticated (Administrator+) Stored Cross-Site Scripting
- Prime Slider – Addons For Elementor <= 3.11.10 - Incorrect Authorization via bdt_duplicate_as_draft
- PDF File Browser <= 1.3 - Remote Code Execution
- Persuasion <= 2.4 - Arbitrary File Download
- Trail Manager <= 1.0.0 - Authenticated (Admin+) Stored Cross-Site Scripting
- Icegram <= 3.1.24 - Missing Authorization
- Quick Page/Post Redirect Plugin < 5.0.5 - Cross-Site Request Forgery to Stored Cross-Site Scripting
- Cloak Front End Email <= 1.9.5 - Missing Authorization
- RegLevel <= 1.2.1 - Authenticated (Administrator+) Stored Cross-Site Scripting
- Sky Addons for Elementor <= 2.4.0 - Authenticated(Contributor+) Stored Cross-site scripting via Wrapper Link URL
- Side Menu – add fixed side buttons <= 3.1.3 - SQL Injection
- Listivo Core <= 2.3.77 - Unauthenticated Local File Inclusion
- WP ULike <= 4.7.9.1 - Missing Authorization to Unauthenticated Content Spoofing
- Contest Gallery <= 23.1.2 - Unauthenticated Stored Cross-Site Scripting
- Car Repair Services <= 5.0 - Unauthenticated Server-Side Request Forgery
- Advanced Woo Search <= 1.68 - Cross-Site Scripting
- Gwolle Guestbook <= 2.1.0 - Cross-Site Request Forgery
- AppExperts <= 1.4.5 - Unauthenticated Sensitive Information Exposure
- Embed Twine <= 0.1.0 - Authenticated (Contributor+) Stored Cross-Site Scripting
- Rename Author Slug <= 1.2.0 - Cross-Site Request Forgery to Stored Cross-Site Scripting
- The Total Book Project <= 1.0 - Insecure Direct Object Reference to Authenticated (Contributor+) Book Manipulation
- NGG Smart Image Search < 4.0.0 - Unauthenticated SQL Injection
- WordPress GDPR & CCPA < 1.9.26 - Reflected Cross-Site Scripting
- uListing <= 2.2.0 - Authenticated (Subscriber+) PHP Object Injection
- Divi <= 4.27.6 - Authenticated (Contributor+) Stored Cross-Site Scripting via Contact Form 'redirect_url' Shortcode Parameter
- WPComplete <= 2.9.5.2 - Authenticated (Contributor+) Stored Cross-Site Scripting
- Biolife - Organic Food WordPress Theme ( RTL Supported ) <= 3.2.3 - Reflected Cross-Site Scripting
- Passbeemedia Web Push Notification <= 1.0.0 - Reflected Cross-Site Scripting
- Plezi < 1.0.3 - Unauthenticated Stored Cross-Site Scripting
- Tracking Code Manager <= 2.6.0 - Cross-Site Request Forgery