Vulnerability archive: section 10, page 16
Open a report to review affected versions, available fixes and original sources. Each report covers a specific issue; its presence does not establish whether your website is affected.
- MemberPress <= 1.11.29 - Authenticated (Contributor+) Blind Server-Side Request Forgery via mepr-user-file Shortcode
- Simple Project Manager <= 1.2.2 - Cross-Site Request Forgery to Stored Cross-Site Scripting
- HTTP Headers <= 1.18.11 - Authenticated (Administrator+) Stored Cross-Site Scripting
- Essential Addons for Elementor – Best Elementor Templates, Widgets, Kits & WooCommerce Builders <= 6.1.12 - Authenticated(Contributor+) Stored Cross-Site Scripting via Event Calendar Widget
- Countdown Timer - Widget Countdown <= 2.7.7 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode
- Business Directory Plugin < 5.11 - Cross-Site Request Forgery
- Cost of Goods Sold (COGS): Cost & Profit Calculator for WooCommerce <= 3.2.8 - Reflected Cross-Site Scripting
- 5 Stars Rating Funnel <= 1.2.53 - Unauthenticated SQL Injection
- TableOn – WordPress Posts Table Filterable <= 1.0.4.1 - Authenticated (Contributor+) Stored Cross-Site Scripting via tableon_popup_iframe_button Shortcode
- WPeMatico RSS Feed Fetcher <= 2.9 - Unauthenticated Stored Cross-Site Scripting via RSS Feed Content Import
- Drag and Drop Multiple File Upload – Contact Form 7 <= 1.3.7.7 - Sensitive Information Exposure
- FundEngine <= 1.8.1 - Authenticated (Subscriber+) Stored Cross-Site Scripting via 'wfp_featured_video_url' Parameter
- Livemesh Addons by Elementor <= 9.0 - Authenticated (Contributor+) Local File Inclusion via Widget Template Parameter
- Login With OTP <= 1.4.2 - Authentication Bypass via Weak OTP
- Anti-Malware Security and Brute-Force Firewall <= 4.20.95 - Reflected Cross-Site Scripting
- Twitter real time search scrolling <= 7.0 - Reflected Cross-Site Scripting
- Custom Style <= 1.0 - Cross-Site Request Forgery
- NebulaX < 5.0 - Unauthenticated SQL Injection
- Fluent Forms <= 6.2.11 - Unauthenticated Stored Cross-Site Scripting via Notification Smartcode Values
- No External Links <= 5.2.0 - Unauthenticated Stored Cross-Site Scripting via Log URL via /goto/{base64} Redirect
- scratchblocks for WP <= 1.0.1 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'element' Shortcode Attribute
- Users Ultra Membership, Users Community and Member Profiles With PayPal Integration Plugin <= 3.1.0 - Unauthenticated SQL Injection
- Forms by CaptainForm <= 2.5.3 - Reflected Cross-Site Scripting via REQUEST_URI
- videowall (All Versions) - Reflected Cross-Site Scripting
- WP Review Slider Pro <= 12.6.8 - Authenticated (Subscriber+) SQL Injection via 'stypes' Parameter
- iThemes Security <= 5.6.1 - Sensitive Information Exposure via Diff Response
- Blog2Social <= 8.4.4 - Authenticated (Subscriber+) SQL Injection via `prgSortPostType` Parameter
- Mistape 1.4.0 - Backdoor
- Behance Portfolio Manager <= 1.7.5 - Missing Authorization
- WP AutoKeyword <= 1.0 - Reflected Cross-Site Scripting
- WP Affiliate Platform < 6.5.1 - Cross-Site Request Forgery to Stored Cross-Site Scripting
- Arkhe <= 3.11.0 - Cross-Site Request Forgery to Local File Inclusion
- Advanced Online Ordering and Delivery Platform <= 2.0.0 - Unauthenticated Local File Inclusion
- ProfileGrid <= 5.9.8.4 - Authenticated (Subscriber+) SQL Injection via 'rid' Parameter
- Easy Flash Embed <= 1.0 - Authenticated (Contributor+) Stored Cross-Site Scripting
- Product Filter by WBW <= 2.7.9 - Unauthenticated SQL Injection via filtersDataBackend Parameter
- Email Subscribers & Newsletters <= 4.2.2 - Unauthenticated File Download w/ Information Disclosure
- Pre* Party Resource Hints <= 1.8.20 - Authenticated (Subscriber+) SQL Injection via 'hint_ids' Parameter
- Sender – Newsletter, SMS and Email Marketing Automation for WooCommerce <= 2.6.15 - Reflected Cross-Site Scripting
- TextMe SMS <= 1.9.1 - Missing Authorization
- WP Meta SEO <= 4.5.13 - Authenticated (Contributor+) Stored Cross-Site Scripting
- SiteGuard WP Plugin <= 1.7.9 - Missing Authorization
- Hybrid Composer <= 1.4.6 - Missing Authorization to Arbitrary Options Update
- Disable and Remove Google Fonts | GDPR & DSGVO friendly <= 2.0.2 - Reflected Cross-Site Scripting
- HTTP Headers <= 1.19.2 - Authenticated (Administrator+) External Control of File Name or Path to RCE via 'hh_htpasswd_path' and 'hh_www_authenticate_user' Parameters
- MSync <= 1.0.0 - Authenticated (Administrator+) SQL Injection
- Product Catalog Mode For Woocommerce <= 5.0.2 - Missing Authorization
- Top Position Google Finance <= 0.1.0 - Reflected Cross-Site Scripting
- Shortcodes by United Themes < 5.0.5 - Reflected Cross-Site Scripting
- UltraAddons Elementor Lite <= 2.0.2 - Authenticated (Contributor+) Stored Cross-Site Scripting
- RSS Feed Widget <= 2.8.0 - Reflected Cross-Site Scripting
- User Registration & Membership – Custom Registration Form, Login Form, and User Profile <= 4.2.1 - Insecure Direct Object Reference to Unauthenticated Limited User Deletion
- WP Popup Window Maker <= 2.0 - Cross-Site Request Forgery to Stored Cross-Site Scripting
- WP Dark Mode – Improve Accessibility with AI Powered Dark Theme <= 5.3.17 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'icon_light' Shortcode Attribute
- SEO Slider <= 1.1.0 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode
- Navian <= 1.5.4 - Unauthenticated Local File Inclusion
- Super Store Finder <= 6.4, Super Interactive Maps <= 2.1 - SQL Injection
- Putler Connector for WooCommerce <= 2.12.0 - Missing Authorization via 'send_resync_request'
- Image Optimizer WD <= 1.0.26 - Authenticated (Administrator+) Stored Cross-Site Scripting
- Media Library Categories <= 1.9.9 - Authenticated (Admin+) Stored Cross-Site Scripting
- Mantenimiento web <= 0.13 - Authenticated (Administrator+) Stored Cross-Site Scripting
- Zegen Core <= 2.0.1 - Cross-Site Request Forgery to Arbitrary File Upload
- Video Conferencing with Zoom <= 4.2.1 - Sensitive Information Exposure
- Filter & Grids <= 3.2.0 - Unauthenticated SQL Injection
- RegistrationMagic – Custom Registration Forms and User Login <= 4.6.0.3 - Authenticated Privilege Escalation
- Smart Recent Posts Widget <= 1.0.4 - Authenticated (Admin+) Stored Cross-Site Scripting
- Image Gallery – Lightbox Gallery, Responsive Photo Gallery, Masonry Gallery <= 1.6.0 - Authenticated (Contributor+) PHP Object Injection
- WP-EMail <= 2.68.2 - Cross-Site Request Forgery to Log Deletion
- Simple Calendar <= 3.2.4 - Cross-Site Request Forgery via duplicate_feed
- Spreadsheet Price Changer for WooCommerce and WP E-commerce – Light <= 2.4.37 - Missing Authorization to Unauthenticated Privilege Escalation via Admin Account Creation
- Media Library Assistant <= 3.33 - Missing Authorization to Authenticated (Subscriber+) Arbitrary Attachment Taxonomy Modification
- Accept Donations with PayPal <= 1.4.5 - Cross-Site Request Forgery to Stored Cross-Site Scripting
- Raygun4WP <= 1.8.0 - Reflected Cross-Site Scripting
- Omnify <= 2.0.3 - Reflected Cross-Site Scripting
- LearnPress – WordPress LMS Plugin <= 4.2.7.3 - Course Material Sensitive Information Exposure via REST API
- HivePress Claim Listings <= 1.1.3 - Missing Authorization
- Inspirational Quote Rotator <= 1.0.0 - Stored Cross-Site Scripting
- Truefy Embed <= 1.1.0 - Cross-Site Request Forgery to 'truefy_embed_options_update' Settings Update
- 워드프레스 결제 심플페이 <= 5.2.0 - Authenticated (Contributor+) Local File Inclusion
- Product Catalog Simple <= 1.7.6 - Sensitive Information Exposure via Product CSV
- Cryptocurrency Widgets – Price Ticker & Coins List <= 2.6.2 - Missing Authorization
- AI Engine: ChatGPT Chatbot <= 2.2.63 - Authenticated (Editor+) Arbitrary File Upload
- Waymark <= 1.4.1 - Reflected Cross-Site Scripting via 'content'
- SoftMarket <= 1.0.0 - Unauthenticated Privilege Escalation via Account Takeover
- P3 (Plugin Performance Profiler) < 1.5.3.9 - Cross-Site Scripting
- Applay - Shortcodes <= 3.7 - Authenticated (Contributor+) PHP Object Injection
- Memberful – Membership Plugin <= 1.81.2 - Authenticated (Contributor+) Protected Post Content Disclosure
- Hyperlink Group Block <= 2.0.1 - Authenticated (Contributor+) Stored Cross-Site Scripting
- WP Image Uploader <= 1.0.1 - Reflected Cross-Site Scripting
- Zakra <= 4.2.0 - Authenticated (Contributor+) Stored Cross-Site Scripting via Post Meta REST API
- BOX NOW Delivery <= 3.0.2 - Missing Authorization
- WPForms Google Sheet Connector <= 4.0.1 - Authenticated (Subscriber+) Remote Code Execution
- Click To Tweet <= 2.0.14 - Missing Authorization
- Privacy Policy Generator, Terms & Conditions Generator - WPLegalPages <= 2.7.0 - Arbitrary Settings Update to Stored Cross-Site Scripting
- Job Portal <= 2.5.4 - Authenticated (Subscriber+) SQL Injection
- Learts Addons < 1.7.5 - Unauthenticated SQL Injection
- Ashe <= 2.267 - Missing Authorization
- User Profile Builder – Beautiful User Registration Forms, User Profiles & User Role Editor <= 3.14.3 - Authenticated (Subscriber+) Stored Cross-Site Scripting
- Visual Text Editor <= 1.2.1 - Authenticated (Contributor+) Remote Code Execution
- FleekDash V2 <= 2.6.2.2 - Missing Authorization to Authenticated (Subscriber+) Administrator Account Takeover via /users/{id} REST Endpoint