Vulnerability archive: section 9, page 5
Open a report to review affected versions, available fixes and original sources. Each report covers a specific issue; its presence does not establish whether your website is affected.
- WordPress Contact Forms by Cimatti <= 1.5.7 - Cross-Site Request Forgery via _accua_forms_form_edit_action
- Elementor Contact Form DB <= 1.5 - Cross-Site Request Forgery
- Hyyan WooCommerce Polylang Integration <= 1.5.0 - Missing Authorization
- GDPR Cookie Compliance <= 4.15.8 - Authenticated (Admin+) Stored Cross-Site Scripting
- JKDEVKIT <= 1.9.4 - Authenticated (Subscriber+) Arbitrary File Deletion
- Import CSV Files <= 1.0 - Reflected Cross-Site Scripting
- DesignSetGo <= 2.8.0 - Authenticated (Contributor+) PHP Object Injection
- WP Crontrol - 1.17.0 - 1.19.1 - Authenticated (Administrator+) Blind Server-Side Request Forgery
- Modular <= 2.4 - Arbitrary File Download
- Mihdan: No External Links <= 4.7.4 - Cross-Site Scripting
- Custom Widget Area <= 1.2.5 - Missing Authorization to Authenticated (Subscriber+) Menu Alteration
- Gallery Images Ape <= 1.6.14 - Stored Cross-Site Scripting
- Custom Field Manager <= 1.0 - Reflected Cross-Site Scripting
- WP-Polls <= 2.75.6 - IP Validation Bypass
- Instant CSS <= 1.2.1 - Cross-Site Request Forgery
- VikBooking Hotel Booking Engine & PMS <= 1.8.8 - Unauthenticated Stored Cross-Site Scripting
- Woobox <= 1.6 - Authenticated (Contributor+) Stored Cross-Site Scripting
- Smart SEO Tool <= 3.0.5 - Reflected Cross-Site Scripting
- e2pdf <= 1.28.15 - Missing Authorization
- Automatic Domain Changer <= 2.0.2 - Reflected Cross-Site Scripting
- WP Online Users Stats <= 1.0.0 - Cross-Site Request Forgery to Stored Cross-Site Scripting via hk_dataset_results Function
- WP Content Copy Protection <= 3.4.4 - Cross-Site Request Forgery to Setting Update
- Essential Addons for Elementor – Popular Elementor Templates & Widgets < 6.6.10 - Authenticated (Contributor+) Stored Cross-Site Scripting
- OS DataHub Maps <= 1.8.3 - Authenticated (Author+) Arbitrary File Upload
- Compact WP Audio Player <= 1.9.7 - Authenticated (Contributor+) Stored Cross-Site Scripting
- MultiLoca - WooCommerce Multi Locations Inventory Management <= 4.1.11 - Authenticated (Subscriber+) SQL Injection
- Theater for WordPress <= 0.19 - Authenticated (Subscriber+) Stored Cross-Site Scripting
- PixelYourSite – Your smart PIXEL (TAG) & API Manager <= 9.7.1 and PixelYourSite PRO <= 10.4.2 - Unauthenticated Information Exposure and Log Deletion
- Digital Newspaper <= 1.1.5 - Cross-Site Request Forgery to Notice Dismissal
- TillKit <= 1.0.4 - Unauthenticated Privileged POS Session Hijacking
- Staff Directory Plugin <= 3.6 - Cross-Site Request Forgery Bypass
- Swifty Page Manager <= 3.0.1 - Cross-Site Request Forgery
- User Profile Builder – Beautiful User Registration Forms, User Profiles & User Role Editor <= 3.11.7 - Missing Authorization to Unauthenticated Media Upload
- Image Sizes Controller, Create Custom Image Sizes, Disable Image Sizes <= 1.0.10 - Missing Authorization
- Blog Floating Button <= 1.4.20 - Unauthenticated Stored Cross-Site Scripting
- WP Table Manager <= 4.1.3 - Missing Authorization to Authenticated (Subscriber+) Directory Traversal to Folder/File Name Disclosure
- Stockholm <= 9.14.1 - Authenticated (Contributor+) Local File Inclusion
- Solace Extra <= 1.3.1 - Authenticated (Subscriber+) Server-Side Request Forgery
- Movies Bulk Importer <= 1.0 - Cross-Site Request Forgery
- Shoppable Images Lite <= 1.2.3 - Missing Authorization
- BackupGuard <= 1.1.46 - Reflected Cross-Site Scripting
- Custom Team Manager <= 2.4.2 - Authenticated (Contributor+) Stored Cross-Site Scripting
- Participants Database <= 2.7.8.4 - Missing Authorization
- WP Hotel Booking <= 1.10.3 - Remote Code Execution
- BuddyPress - 1.5-1.5.4 - SQL Injection
- Popup box < 2.3.4 - Authenticated SQL Injection
- User Registration Stripe <= 1.3.14 - Missing Authorization
- Contact Form 7 – PayPal & Stripe Add-on <= 2.3.4 - Authenticated (Administrator+) Stored Cross-Site Scripting
- AcyMailing <= 10.10.2 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'alignment' Attribute
- WP Intercom Slack <= 1.2.1 - Sensitive Information Disclosure
- GiveWP – Donation Plugin and Fundraising Platform < 4.16.6 - Missing Authorization
- WP Compress <= 6.30.30 - Unauthenticated Broken Authentication
- Conditional Payment Methods for WooCommerce <= 1.0 - Authenticated (Admin+) SQL Injection
- Competition Form <= 2.0 - Cross-Site Request Forgery to Competition Deletion
- Element Pack Pro <= 9.0.6 - Authenticated (Contributor+) Local File Inclusion
- URL Shortener | Conversion Tracking | AB Testing | WooCommerce <= 9.0.2 - Authenticated (Admin+) Stored Cross-Site Scripting
- ShipWorks Connector for Woocommerce <= 5.2.5 - Cross-Site Request Forgery to Service Password/Username Update
- Adminimize < 1.7.22 - Cross-Site Scripting
- Pin Generator <= 2.0.0 - Missing Authorization
- Cross-RSS <= 1.7 - Path Traversal
- Esselink.nu Settings <= 4.6 - Cross-Site Request Forgery
- Libsyn Publisher Hub <= 1.4.4 - Authenticated (Contributor+) Stored Cross-Site Scripting
- Essential Addons for Elementor – Best Elementor Templates, Widgets, Kits & WooCommerce Builders <= 5.9.15 - Authenticated (Contributor+) Stored Cross-Site Scripting
- Crowdsignal Dashboard – Polls, Surveys & more <= 3.0.11 - Reflected Cross-Site Scripting
- WP Cookie Consent ( for GDPR, CCPA & ePrivacy ) <= 3.0.2 - Missing Authorization to Unauthenticated Arbitrary Post Deletion
- Calendar <= 1.3.14 - Authenticated (Contributor+) SQL Injection via Shortcode
- WP Google Map <= 1.7.6 - Admin+ Stored Cross-Site Scripting
- Pure Chat – Live Chat & More! <= 2.4 - Reflected Cross-Site Scripting via purechatWidgetName Parameter
- Rank Math SEO PRO <= 3.0.96 - Missing Authorization
- LIQUID BLOCKS <= 1.2.0 - Authenticated (Contributor+) Stored Cross-Site Scripting
- Advance Portfolio Grid <= 1.07.6 - Authenticated (Administrator+) Stored Cross-Site Scripting
- Ultimate Reviews <= 3.0.15 - Authenticated Stored Cross-Site Scripting
- 140+ Widgets | Best Addons For Elementor – FREE <= 1.4.3 - Authenticated (Contributor+) Stored Cross-Site Scripting via Multiple Widgets
- WP Prayer II <= 2.4.7 - Cross-Site Request Forgery to Email Settings Update
- Responsify WP <= 1.9.11 - Authenticated (Administrator+) Stored Cross-Site Scripting
- Booking and Rental Manager for Bike | Car | Resort | Appointment | Dress | Equipment <= 2.7.6 - Missing Authorization
- Simple Map No Api <= 1.9 - Authenticated (Contributor+) Stored Cross-Site Scripting via width Parameter
- CSS & JavaScript Toolbox <= 11.8 - Authenticated (Contributor+) Stored Cross-Site Scripting via shortcode
- Carter for Elementor <= 1.0.2 - Missing Authorization
- Enable Accessibility <= 1.4 - Cross-Site Request Forgery
- Site Offline Or Coming Soon Or Maintenance Mode <= 1.4.2 - Cross-Site Request Forgery and Cross-Site Scripting
- PDQ CSV <= 1.0.0 - Authenticated (Administrator+) Stored Cross-Site Scripting via plugin settings
- Advanced Ads – Ad Manager & AdSense <= 2.0.22 - Authenticated (Contributor+) Stored Cross-Site Scripting
- BookingPress Pro <= 5.7.2 - Missing Authorization Unauthenticated Information Exposure
- H5P <= 1.16.1 - Missing Authorization
- Sniplets < 1.2.3 - Remote File Inclusion
- Chartify – WordPress Chart Plugin <= 2.9.5 - Unauthenticated Local File Inclusion via source
- Hostinger Reach 1.0.6 - 1.8.2 - Authenticated (Contributor+) Stored Cross-Site Scripting
- Business Roy <= 1.1.4 - Missing Authorization
- Jupiter X Core <= 4.14.1 - Missing Authorization
- Floating Action Button <= <=1.2.1 - Cross-Site Request Forgery to Settings Modification
- Thumbnail For Excerpts <= 2.1 - Cross-Site Request Forgery
- Booking calendar, Appointment Booking System <= 3.2.17 - Unauthenticated Time-Based SQL Injection via 'wpdevart_id'
- E2Pdf <= 1.20.23 - Authenticated(Administrator+) SQL Injection
- Simple Shopping Cart <= 5.2.5 - Authenticated (Administrator+) Stored Cross-Site Scripting
- Prolisting - Directory Listing <= 1.2 - Reflected Cross-Site Scripting
- E2Pdf – Export Pdf Tool for WordPress <= 1.32.14 - Reflected Cross-Site Scripting
- MF Gig Calendar <= 1.2.1 - Cross-Site Request Forgery to Event Deletion
- eExamhall <= 4.0 - Cross Site Request Forgery
- Video.js – HTML5 Video Player for WordPress <= 4.5.0 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode