Vulnerability archive: section 10, page 15
Open a report to review affected versions, available fixes and original sources. Each report covers a specific issue; its presence does not establish whether your website is affected.
- Telephone Number Linker <= 1.2 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode
- Shortcode Ninja <= 1.4 - Cross-Site Scripting
- EduMall - Professional LMS Education Center WordPress Theme <= 4.5.3 - Reflected Cross-Site Scripting
- ResAds <= 2.0.5 - Authenticated (Administrator+) SQL Injection
- PublishPress Capabilities <= 2.50.0 - Authenticated (Editor+) Privilege Escalation to Fresh-Install Default Capability Grant
- Imediapixel Themes (Various Versions) - Cross-Site Scripting
- menu shortcode <= 1.0 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode
- WCFM Marketplace – Multivendor Marketplace for WooCommerce < 3.8.2 - Insecure Direct Object Reference to Unauthenticated Arbitrary Order Refund Request
- Awesome Tool Tip <= 1.0 - Authenticated (Contributor+) Stored Cross-Site Scripting
- Ultimate Member <= 2.0.3 - Unauthorized Image File Upload
- WPvivid Backup for MainWP <= 0.9.32 - Reflected Cross-Site Scripting
- Feather Login Page 1.0.7 - 1.1.1 - Cross-Site Request Forgery to Privilege Escalation
- A Forms <= 1.4.2 - Reflected Cross-Site Scripting
- Zoho Flow <= 2.14.1 - Cross-Site Request Forgery
- Iona <= 1.0.8 - Unauthenticated Local File Inclusion
- BuddyBoss Platform <= 2.8.50 - Authenticated (Subscriber+) Stored Cross-Site Scripting via 'bbp_topic_title'
- Backup and Staging by WP Time Capsule <= 1.22.20 - Authentication Bypass to Account Takeover
- AIO Performance Profiler, Monitor, Optimize, Compress & Debug <= 1.2 - Unauthenticated Sensitive Information Exposure
- Responsive Tabs < 4.0.6 - Authenticated (Contributor+) Content Injection
- WordPress Single Sign-On (SSO) - Multiple Versions - Incorrect Authorization to Sensitive Information Exposure
- Master Addons for Elementor <= 2.0.5.4.1 - Authenticated (Contributor+) Stored Cross-Site Scripting
- WPComplete <= 2.9.4 - Reflected Cross-Site Scripting
- User Registration & Membership <= 5.1.5 - Authenticated (Subscriber+) Insecure Direct Object Reference to Arbitrary Media Deletion via 'profile-pic-url' Parameter
- UPC/EAN/GTIN Code Generator <= 2.0.2 - Missing Authorization to Authenticated (Subscriber+) Settings Update
- Quiz and Survey Master <= 7.0.0 - Unauthenticated Arbitrary File Deletion
- Product Configurator for WooCommerce <= 1.4.4 - Cross-Site Request Forgery
- Omni Secure Files <= 0.1.13 - Arbitrary File Upload
- F8 Lite <= 4.2.1 - Cross-Site Scripting
- Appointment Booking Calendar — Simply Schedule Appointments Booking Plugin <= 1.6.9.5 - Unauthenticated Sensitive Information Exposure
- Discounts Manager for Products <= 3.4.4 - Reflected Cross-Site Scripting
- Request a Quote for WooCommerce <= 2.9.2 - Unauthenticated Arbitrary File Upload via AJAX Popup Handler
- My Calendar – Accessible Event Manager <= 3.7.3 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode Attributes
- Activity Log <= 2.3.2 - Reflected Cross-Site Scripting
- Motors - Car Dealer, Rental & Listing WordPress theme <= 5.6.80 - Missing Authorization
- Happy Addons for Elementor <= 3.10.4 - Incorrect Authorization to Information Exposure
- AyeCode Connect <= 1.3.8 - Missing Authorization
- WordPress支付宝Alipay|财付通Tenpay|贝宝PayPal集成插件 < 3.7.0 - Cross-Site Scripting
- occupancyplan <= 1.0.3.0 - Cross-Site Request Forgery to Stored Cross-Site Scripting
- User Post Gallery - UPG <= 2.19 - Missing Authorization to Remote Command Execution
- Ninja Forms <= 3.8.6 - Cross-Site Request Forgery
- WP 2FA – Two-factor authentication for WordPress <= 4.1.0 - Cross-Site Request Forgery
- Element Pack Pro <= 7.19.2 - Authenticated (Contributor+) Arbitrary File Read and PHAR Deserialization
- Rey Core <= 3.1.8 - Authenticated (Contributor+) Stored Cross-Site Scripting
- Glofox Shortcodes <= 2.6 - Authenticated (Contributor+) Stored Cross-Site Scripting
- The Plus Addons for Elementor <= 5.4.0 - Authenticated (Contributor+) Stored Cross-Site Scripting Header Meta Content Widget
- AcyMailing SMTP Newsletter <= 10.11.1 - Missing Authorization
- Chat Bee <= 1.1.0 - Authenticated (Administrator+) Stored Cross-Site Scripting
- Cookie Notice & Compliance for GDPR / CCPA <= 2.4.6 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'cookies_policy_link' Shortcodes
- WP Data Access <= 5.5.63 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'wpda_app' Shortcode
- Eduma <= 5.7.6 - Authenticated (Contributor+) Stored Cross-Site Scripting
- Appointment Booking Calendar Plugin <= 1.0.2 - Missing Authorization to Unauthenticated Arbitrary Appointment Status Modification
- Aviana <= 2.1 - Unauthenticated Local File Inclusion
- Spam Byebye <= 2.2.4 - Cross-Site Request Forgery
- Simple Retail Menus <= 4.2.1 - Unauthenticated Local File Inclusion
- Popup Builder <= 4.3.6 - Sensitive Information Exposure via Imported Subscribers CSV File
- Form Maker by 10Web – Mobile-Friendly Drag & Drop Contact Form Builder <= 1.15.22 - Sensitive Information Exposure
- HT Slider For Elementor <= 1.3.9 - Cross-Site Request Forgery to Arbitrary Plugin Activation
- Houzez <= 4.1.1 - Reflected Cross-Site Scripting
- SociallyViral <= 1.0.10 - Cross-Site Request Forgery
- Simple Restaurant Menu <= 1.2 - Authenticated (Administrator+) Stored Cross-Site Scripting
- My auctions allegro <= 3.6.32 - Unauthenticated Local File Inclusion via controller
- My Account Page Editor <= 1.3.1 - Authenticated (Subscriber+) Arbitrary File Upload
- Kudos Donations – Easy donations and payments with Mollie < 3.1.2 - Cross-Site Request Forgery
- WP Quick Post Duplicator <= 2.1 - Missing Authorization
- SEOPress <= 8.1.1 - Missing Authorization
- IRivYou <= 2.2.1 - Cross-Site Request Forgery via saveOptionsReviewsPlugin
- GamiPress <= 2.5.6 - Cross-Site Request Forgery to User Earnings Deletion
- Stop Registration Spam <= 1.24 - Reflected Cross-Site Scripting
- WP Simple HTML Sitemap <= 3.5 - Missing Authorization
- Photo Gallery, Images, Slider in Rbs Image Gallery <= 3.2.21 - Authenticated (Contributor+) Stored Cross-Site Scripting
- Activity Log <= 2.8.7 - IP Address Spoofing
- Stout Google Calendar <= 1.2.3 - Cross-Site Request Forgery via sgc_plugin_options
- Hive Support <= 1.2.11 - Authenticated (Subscriber+) Stored Cross-Site Scripting
- Easy Form Builder <= 3.3.8 - Authenticated (Administrator+) Stored Cross-Site Scripting
- Wp advertising management <= 1.0.3 - Reflected Cross-Site Scripting
- Radio Player <= 2.0.73 - Missing Authorization to Settings Update
- Site Offline <= 1.5.6 - Authenticated (Administrator+) Stored Cross-Site Scripting
- tagDiv Composer <= 5.4.1 - Unauthenticated Stored Cross-Site Scripting
- Custom Query Blocks <= 5.3.1 - Authenticated (Contributor+) Stored Cross-Site Scripting
- Footer Putter <= 6.1.3 - Reflected Cross-Site Scripting
- WP Hallo Welt <= 1.4. - Cross-Site Request Forgery to Stored Cross-Site Scripting
- Paypal Shortcodes <= 0.3 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'amount' and 'name' Shortcode Attributes
- Tickera <= 3.4.9.9 - Cross-Site Request Forgery to Plugin Data Deletion & Settings Changes
- Srbtranslatin <= 3.2.0 - Unauthenticated Sensitive Information Exposure
- Premmerce <= 1.3.19 - Unauthenticated Local File Inclusion
- sync-basalam <= 3.0.2 - Authenticated (Administrator+) SQL Injection
- ShopLentor <= 2.8.8 - Missing Authorization to WordPress Option Modification
- TemplateSpare – 1000+ WordPress Starter Templates & Full Site Migration Tool | 1-Click Import/Export & No-Code Builder <= 4.2.0 - Authenticated (Admin+) Arbitrary File Upload
- Bitcoin and Altcoin Wallet <= 6.3.1 - Reflected Cross-Site Scripting
- Elementor Addon Elements <= 1.14.4 - Authenticated (Contributor+) Information Exposure
- Security & Malware scan by CleanTalk <= 2.145 - Authorization Bypass via Reverse DNS Spoofing to Unauthenticated SQL Injection
- BackupBuddy < 3.0 - Authentication Bypass
- VikBooking Hotel Booking Engine & PMS <= 1.5.7 - Cross-Site Request Forgery to Stored Cross-Site Scripting
- weMail <= 2.0.7 - Insufficient Authorization via x-wemail-user Header to Sensitive Information Disclosure
- Smart Slider 3 <= 3.5.1.28 - Authenticated (Administrator+) SQL Injection via `sliderid` Parameter
- RSS Filter <= 1.2 - Cross-Site Request Forgery to Stored Cross-Site Scripting
- MF Gig Calendar <= 1.2 - Authenticated (Contributor+) Stored Cross-Site Scripting via event_title and event_time
- Smart Online Order for Clover <= 1.5.4 - Cross-Site Request Forgery
- Slotti Ajanvaraus <= 1.3.1 - Authenticated (Contributor+) Stored Cross-Site Scripting
- WPMasterToolKit <= 1.13.1 - Authenticated (Admin+) Arbitrary File Download