Vulnerability archive: section 9, page 6
Open a report to review affected versions, available fixes and original sources. Each report covers a specific issue; its presence does not establish whether your website is affected.
- Advanced AJAX Product Filters <= 3.1.9.6 - Authenticated (Author+) PHP Object Injection via Live Composer Compatibility
- Filter Portfolio Gallery <= 1.5 - Cross-Site Request Forgery
- Hurrakify <= 2.4 - Unauthenticated Server-Side Request Forgery
- UsersWP <= 1.2.53 - Cross-Site Request Forgery
- VW Automobile Lite <= 2.1.2 - Missing Authorization
- Eros <= 1.3 - Unauthenticated Local File Inclusion
- Custom Field For WP Job Manager <= 1.2 - Insecure Direct Object Reference to Sensitive Information Exposure via Shortcode
- Bei Fen – WordPress Backup Plugin <= 1.4.2 - Authenticated (Subscriber+) Local File Inclusion
- All in One WP Migration <= 7.89 - Unauthenticated PHP Object Injection
- Yoast SEO Premium <= 26.6 - Missing Authorization
- flashy <= 1.2.1 - Reflected Cross-Site Scripting
- AdFoxly – Ad Manager, AdSense Ads & Ads.txt <= 1.8.4 - Reflected Cross-Site Scripting
- Skimlinks Affiliate Marketing Tool <= 1.3 - Authenticated (Administrator+) Server-Side Request Forgery
- WP Review Slider Pro <= 12.6.8 - Authenticated (Subscriber+) SQL Injection via 'curselrevs' Parameter
- BEAR <= 1.1.3.3 - Cross-Site Request Forgery to Stored Cross-Site Scripting
- WP Project Manager <= 2.6.17 - Authenticated (Subscriber+) SQL Injection via orderby Parameter
- WP Quick Contact Us <= 1.0 - Cross-Site Request Forgery to Settings Update
- Royal Elementor Addons and Templates <= 1.3.980 - Authenticated (Contributor+) DOM-Based Stored Cross-Site Scripting via Magazine Grid/Slider Widget
- Health Check & Troubleshooting <= 1.7.1 - Authenticated (Admin+) Path Traversal
- WordPress Plugin for Google Maps – WP MAPS <= 4.6.1 - Authenticated (Contributor+) SQL Injection
- BP Better Messages <= 2.4.0 - Authenticated (Contributor+) Stored Cross-Site Scripting via shortcode
- GamesTheme <= 1.0.3 - Sensitive Information Disclosure
- Cleanup – Directory Listing & Classifieds WordPress Plugin <= 1.0.4 - Reflected Cross-Site Scripting
- Giphypress <= 1.6.2 - Authenticated (Contributor+) Stored Cross-Site Scripting
- WPHRM - Human Resource Management System < 1.1 - SQL Injection
- TablePress – Tables in WordPress made easy <= 3.0.4 - Authenticated (Author+) Stored Cross-Site Scripting
- Video Embeds <= 0.1.1 - Authenticated (Contributor+) Stored Cross-Site Scripting
- Wishlist Member <= 3.32.0 - Authenticated (Subscriber+) Arbitrary File Upload
- TH Advance Product Search <= 1.1.4 - Missing Authorization to Plugin Settings Change
- Tutor LMS <= 3.9.8 - Authenticated (Admin+) SQL Injection via 'date' Parameter
- HTML5 Maps <= 1.6.5.6 - Cross-Site Request Forgery
- Simple Image Manipulator <= 1.0 - Remote File Download
- OG Tags <= 2.0.1 - Cross-Site Request Forgery
- WP Super Cache <= 1.8 - Unauthenticated Cache Poisoning
- reCAPTCHA for all <= 2.22 - Cross-Site Request Forgery
- REHub Framework < 19.9.9.4 - Authenticated (Subscriber+) Information Exposure
- LocalGrid <= 1.0.1 - Reflected Cross-Site Scripting
- XStore Core <= 5.3.8 - Missing Authorization
- EnvíaloSimple: Email Marketing y Newsletters <= 2.2 - Reflected Cross-Site Scripting
- Membership For WooCommerce <= 3.1.0 - Unauthenticated Arbitrary File Deletion
- Critical Site Intel <= 1.0 - Unauthenticated SQL Injection
- WooCommerce Green Wallet Gateway <= 1.0.1 - Reflected Cross-Site Scripting
- External image replace <= 1.0.8 - Authenticated (Contributor+) Arbitrary File Upload
- Qi Addons For Elementor <= 1.8.7 - Authenticated (Contributor+) Stored Cross-Site Scripting
- Shopping Cart & eCommerce Store <= 5.2.4 - Cross-Site Request Forgery to Settings Update
- Woocommerce OpenPos <= 6.4.4 - Unauthenticated SQL Injection
- RSS Aggregator by Feedzy – Feed to Post, Autoblogging, News & YouTube Video Feeds Aggregator <= 4.3.2 - Authenticated (Author+) Stored Cross-Site Scripting
- Elementor Pro <= 4.2.1 - Unauthenticated Arbitrary File Upload via Upload Field Array Validation Bypass
- Extensions for Leaflet Map <= 3.4.1 - Reflected Cross-Site Scripting
- Quiz Organizer <= 2.9.1 - Authenticated (Administrator+) Stored Cross-Site Scripting
- SpecFit-Virtual Try On Woocommerce <= 10.0.21 - Reflected Cross-Site Scripting
- Events Made Easy <= 2.3.16 - Missing Authorization
- Nested Pages <= 3.2.3 - Missing Authorization to Authenticated (Editor+) Plugin Settings Reset
- Archive Page <= 1.0.2 - Authenticated (Contributor+) Stored Cross-Site Scripting
- Booking Calendar – Event Calendar <= 1.0.2 - Missing Authorization
- SEO Redirection Plugin – 301 Redirect Manager <= 7.3 - Reflected Cross-Site Scripting
- WP Go Maps (formerly WP Google Maps) <= 9.0.38 - Authenticated (Contributor+) Stored Cross-Site Scripting
- Multi Step for Contact Form <= 2.7.7 - Unauthenticated SQL Injection
- Wp EMember <= 10.6.5 - Authenticated (Admin+) Arbitrary File Upload
- Import any XML or CSV File to WordPress <= 3.2.4 - Missing Authorization and Cross-Site Request Forgery Checks
- Textboxes <= 0.1.3.1 - Authenticated (Contributor+) Stored Cross-Site Scripting
- WordPress Responsive Preview <= 1.1 - Reflected Cross-Site Scripting
- Local Syndication <= 1.5a - Authenticated (Contributor+) Server-Side Request Forgery via Shortcode
- Rich Table of Contents <= 1.4.0 - Missing Authorization
- UpsellWP – WooCommerce Upsell and Related Products Offers <= 2.2.4 - Authenticated (Shop manager+) SQL Injection
- IMGspider <= 2.3.12 - Authenticated (Contributor+) Server-Side Request Forgery
- Scalable Vector Graphics (SVG) <= 3.4 - Authenticated (Author+) Stored Cross-Site Scripting via SVG
- Custom Field Template <= 2.5.1 - Cross-Site Request Forgery Bypass
- Live Chat – Live support <= 3.1.0 - Cross-Site Request Forgery
- Tabs <= 4.0.6 - Authenticated (Administrator+) Stored Cross-Site Scripting
- WooCommerce Pre-Orders <= 2.0.1 - Reflected Cross-Site Scripting
- FunnelKit – Funnel Builder for WooCommerce Checkout <= 3.15.0.5 - Authenticated (Administrator+) SQL Injection
- Social Media Share Buttons & Social Sharing Icons < 3.0.1 - Authenticated (Contributor+) Stored Cross-Site Scripting
- Wishful Blog <= 2.0.1 & Raise Mag <= 1.0.7 - Unauthenticated Cross-Site Scripting
- MapPress Maps for WordPress <= 2.96.6 - Unauthenticated Insecure Direct Object Reference via REST API Endpoints
- Podlove Subscribe button <= 1.3.10 - Authenticated (Contributor+) SQL Injection
- VaultRE Contact Form 7 <= 1.0 - Authenticated (Administrator+) Stored Cross-Site Scripting
- Democracy Poll < 5.4 - Cross-Site Scripting
- XLSXviewer <= 2.1.1 - Authenticated (Subscriber+) Arbitrary File Deletion
- Travelpayouts <= 1.1.12 - Cross-Site Request Forgery to Settings Import
- Benevolent <= 1.3.4 - Cross-Site Request Forgery to Notice Dismissal
- Integro <= 1.8.0 - Unauthenticated Local File Inclusion
- Royal Elementor Addons and Templates <= 1.3.80 - Missing Authorization to Private/Password Protected Post Read
- Prime Slider – Addons For Elementor <= 3.13.2 - Missing Authorization
- Hospital Management System <= 47.0(20-11-2023) - Authenticated (Subscriber+) SQL Injection
- 워드프레스 결제 심플페이 – 우커머스 결제 플러그인 <= 5.5.6 - Unauthenticated SQL Injection
- ARPrice <= 4.1.3 - Authenticated (Contributor+) Stored Cross-Site Scripting
- RSS Includes Pages <= 3.6 - Cross-Site Scripting
- Flatty <= 2.0.0 - Authenticated (Administrator+) Stored Cross-Site Scripting
- RT-Theme 18 Responsive WordPress Theme <= 2.5 - Unauthenticated Local File Inclusion
- Ultimate Store Kit – Addon For WooCommerce, EDD and Elementor <= 3.0.5 - Unauthenticated Information Exposure
- GreenMart – Organic & Food WooCommerce WordPress Theme < 2.4.3 - Reflected Cross-Site Scripting
- Recip.ly <= 1.1.7 - Unauthenticated Arbitrary File Upload in uploadImage.php
- WordPress WP-Advanced-Search <= 3.3.9 - Unauthenticated SQL Injection
- Kv TinyMCE Editor Add Fonts <= 1.1 - Cross-Site Request Forgery
- Roisin <= 1.2.1 - Unauthenticated Local File Inclusion
- Eonet Manual User Approve <= 2.1.3 - Authenticated (Administrator+) Stored Cross-Site Scripting
- PublishPress Authors <= 4.7.5 - Authenticated (Contributor+) Local File Inclusion
- Photo Gallery – GT3 Image Gallery & Gutenberg Block Gallery <= 2.7.7.29 - Authenticated (Author+) Stored Cross-Site Scripting
- Better Messages – Live Chat for WordPress, BuddyPress, PeepSo, Ultimate Member, BuddyBoss <= 2.6.9 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode