Vulnerability archive: section 10, page 21
Open a report to review affected versions, available fixes and original sources. Each report covers a specific issue; its presence does not establish whether your website is affected.
- WordPress Core <= 3.3.2 - Cross-Site Scripting
- VS Contact Form <= 13.9 - Missing Authorization
- Google Maps v3 Shortcode <= 1.2.1 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode
- Persian Admnin Fonts <= 4.1.03 - Missing Authorization
- Free counter <= 1.1 - Stored Cross-Site Scripting
- Shared Files <= 1.7.48 - Unauthenticated Stored Cross-Site Scripting via sanitize_file Function
- WP Tabs <= 2.1.16 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode
- Simple Calendar – Google Calendar Plugin < 2.0.4 - Reflected Cross-Site Scripting
- Timely All-in-One Events Calendar <= 2.5.38 - Cross-Site Scripting
- Events Manager <= 5.9.4 - Cross-Site Scripting
- WPZOOM Addons for Elementor (Templates, Widgets) <= 1.1.36 - Authenticated (Contributor+) Stored Cross-Site Scripting via Image Box Widget
- WpBookingly <= 1.3.1 - Unauthenticated PHP Object Injection
- Popup box <= 5.5.4 - Cross-Site Request Forgery
- Easy Digital Downloads (EDD) Twenty-Twelve < 1.1.1 - Cross-Site Scripting
- WordPress Events Calendar Registration & Tickets <= 2.6.0 - Reflected Cross-Site Scripting
- Brizy <= 2.7.23 - Missing Authorization
- POST SMTP Mailer – Email log, Delivery Failure Notifications and Best Mail SMTP for WordPress <= 2.8.7 - Unauthenticated Stored Cross-Site Scripting via device
- EO4WP <= 1.0.8.1 - Authenticated (Contributor+) Stored Cross-Site Scripting
- School Management <= 92.0.0 - Authenticated (Subscriber+) SQL Injection
- Post Grid, Slider & Carousel Ultimate – with Shortcode, Gutenberg Block & Elementor Widget <= 1.6.7 - Authenticated (Contributor+) PHP Object Injection in outpost_shortcode_metabox_markup
- Simple Like Page <= 1.5.3 - Missing Authorization
- illi Link Party! <= 1.0 - Cross-Site Request Forgery to Settings Update
- Quiz and Survey Master (QSM) <= 11.1.4 - Missing Authorization to Authenticated (Contributor+) Arbitrary Quiz Modification and Email Reroute via Leaked Nonce from /quiz/structure
- MW WP Form <= 5.1.3 - Unauthenticated Stored Cross-Site Scripting
- Block Spam By Math Reloaded <= 2.2.4 - Authenticated (Administrator+) Stored Cross-Site Scripting
- Mesmerize Companion <= 1.6.158 - Missing Authorization Authenticated (Subscriber+) Settings Update
- Easy Invoice – Invoice Generator, PDF Quotes & Payments <= 2.1.19 - Unauthenticated Remote Code Execution
- Easy Real Estate <= 2.2.9- Unauthenticated Privilege Escalation
- WhitePage <= 1.1.5 - Cross-Site Request Forgery via params_api_form.php
- DrawIt (draw.io) <= 1.1.3 - Authenticated (Contributor+) Stored Cross-Site Scripting
- Secure Copy Content Protection and Content Locking <= 4.2.3 - Reflected Cross-Site Scripting
- Bit File Manager – 100% Free & Open Source File Manager and Code Editor for WordPress <= 6.5.7 - Authenticated (Subscriber+) Limited JavaScript File Upload
- Unlimited Elements For Elementor <= 2.0.16 - Unauthenticated SQL Injection
- Ultimate Addons for Elementor <= 1.36.31 - Authenticated (Contributor+) Privilege Escalation
- Folders Pro <= 3.0.2 - Authenticated(Author+) Arbitrary File Upload via handle_folders_file_upload
- flexo-social-gallery <= 1.0006 - Cross-Site Request Forgery
- Vayu Blocks <= 1.3.1 - Missing Authorization to Authenticated (Subscriber+) Stored Cross-Site Scripting via containerWidth Parameter
- Advanced Angular Contact Form <= 1.1.0 - Reflected Cross-Site Scripting
- Popup builder with Gamification, Multi-Step Popups, Page-Level Targeting, and WooCommerce Triggers <= 2.1.4 - Unauthenticated Server-Side Request Forgery
- Realtyna Organic IDX plugin + WPL Real Estate <= 5.2.0 - Unauthenticated Arbitrary File Upload
- Ocean Extra <= 1.9.4 - Reflected Cross-Site Scripting
- WP Map Block <= 2.0.2 - Authenticated (Contributor+) Stored Cross-Site Scripting
- Responsive WordPress Slider <= 2.2.0 - Authenticated (Subscriber+) Stored Cross-Site Scripting
- Geo Controller <= 8.9.8 - Unauthenticated PHP Object Injection
- Filmix <= 1.1 - Reflected Cross-Site Scripting
- WooCommerce Product Filter <= 3.1.8 - Unauthenticated SQL Injection
- MgoSync 2.1.5 - 2.1.6 - Unauthenticated Information Exposure
- Ultra Addons for Contact Form 7 <= 3.5.43 - Authenticated (Contributor+) Stored Cross-Site Scripting via Slider Attributes
- Constant Contact Forms by MailMunch <= 2.1.2 - Reflected Cross-Site Scripting
- Social Sharing Toolkit <= 2.6 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode
- WP Event Manager – Events Calendar, Registrations, Sell Tickets with WooCommerce <= 3.4.1 - Missing Authorization
- Really Simple Under Construction Page <= 1.4.6 - Authenticated (Administrator+) Stored Cross-Site Scripting
- BFG Tools – Extension Zipper <= 1.0.7 - Authenticated (Administrator+) Path Traversal via 'first_file' Parameter
- KiviCare – Clinic & Patient Management System (EHR) <= 4.1.2 - Unauthenticated Authentication Bypass via Social Login Token
- WooCommerce Address Book < 1.6.0 - Cross-Site Request Forgery
- Sober <= 3.5.12 - Missing Authorization
- Spotlightr <= 0.1.11 - Authenticated (Contributor+) Stored Cross-Site Scripting
- WordPress Core <= 2.1.1 - Cross-Site Scripting
- Prisna GWT – Google Website Translator <= 1.4.13 - Authenticated (Admin+) Stored Cross-Site Scripting
- Order Tracking Pro <= 3.3.6 - Authenticated (Administrator+) Stored Cross-Site Scripting
- Hotel Listing <= 1.4.0 - Reflected Cross-Site Scripting
- Social Media Widget by Acurax < 2.2 - Stored Cross-Site Scripting
- Simple Job Board <= 2.11.0 - Unauthenticated PHP Object Injection via Job Application Fields
- No CAPTCHA reCAPTCHA for WooCommerce <= 1.2.6 - Missing Authorization to Notification Dismissal
- All push notification for WP <= 1.5.3 - Reflected Cross-Site Scripting
- Tutor LMS – eLearning and online course solution <= 3.9.13 - Unauthenticated Insecure Direct Object Reference
- Limb Gallery – Create Beautiful Image & Video Galleries <= 1.3.2 - Cross-Site Scripting
- Duplicator <= 1.2.41 - Sensitive Information Disclosure leading to Remote Code Execution
- WP Travel Engine <= 6.2.1 - Missing Authorization to Authenticated (Contributor+) Plugin Settings Update
- glomex oEmbed <= 0.9.1 - Authenticated (Contributor+) Stored Cross-Site Scripting
- MaxGalleria <= 6.4.4 - Authenticated (Contributor+) Stored Cross-Site Scripting via maxgallery_thumb Shortcode
- CP Contact Form with PayPal <= 1.3.56 - Missing Authorization to Unauthenticated Arbitrary Payment Confirmation
- WP Bannerize 2.0.0 - 4.0.2 - Authenticated SQL Injection via id Parameter
- Disqus Comment System < 2.79 - Multiple Cross-Site Request Forgery
- AffiEasy <= 1.1.4 - Cross-Site Request Forgery
- Runners Log <= 3.9.2 - Authenticated (Contributor+) Stored Cross-Site Scripting
- Bold Page Builder <= 5.6.1 - Authenticated (Contributor+) Stored Cross-Site Scripting via bt_bb_accordion_item Shortcode
- Tiempo.com <= 0.1.2 - Cross-Site Request Forgery to Shortcode Deletion
- Real3D Flipbook <= 1.0.0 - Directory Traversal
- Pressference Exporter <= 1.0.3 - Authenticated (Administrator+) SQL Injection
- Dokan: AI Powered WooCommerce Multivendor Marketplace Solution <= 5.2.1 - Insecure Direct Object Reference to Authenticated (Custom+) Limited Account Takeover via 'password' Parameter to /wp-json/dokan/v1/customers/{id}
- User Profile Builder <= 4.0.0 - Unauthenticated Stored Cross-Site Scripting via 'email' Parameter
- YouTube Playlist Player <= 4.6.4 - Cross-Site Request Forgery in ytpp_settings
- Bit Form – Contact Form Plugin <= 2.18.0 - Open Redirect
- Mark Posts <= 2.0.0 - Admin+ Stored Cross-Site Scripting
- Table Field Add-on for ACF and SCF <= 1.3.30 - Authenticated (Contributor+) Stored Cross-Site Scripting via Table Cell Content
- SS Font Awesome Icon <= 4.1.3 - Authenticated (Contributor+) Stored Cross-Site Scripting
- Backup and Staging by WP Time Capsule <= 1.22.21 - Unauthenticated Arbitrary File Upload
- Trendustry <= 1.1.4 - Unauthenticated Local File Inclusion
- QT KenthaRadio < 2.0.2 & OnAir2 < 3.9.9.2 - Server-Side Request Forgery & Remote File Inclusion
- Optima Express 8.6.0 - 8.7.5 - Authenticated (Author+) Stored Cross-Site Scripting
- Best Restaurant Menu by PriceListo <= 1.4.3 - Authenticated (Contributor+) Stored Cross-Site Scripting
- Stockists Manager for Woocommerce <= 1.0.2.1 - Cross-Site Request Forgery to Stored Cross-Site Scripting
- HREFLANG Tags Lite <= 2.0.0 - Missing Authorization to Data Reset
- Animation Addons for Elementor Pro <= 1.6 - Missing Authorization to Authenticated (Subscriber+) Arbitrary Plugin Installation/Activation
- Product Configurator for WooCommerce <= 1.7.5 - Authenticated (Shop Manager+) PHP Object Injection
- Ultimate WordPress Auction Plugin <= 4.2.9 - Missing Authorization to Arbitrary Post Deletion
- Invetex <= 2.18 - Unauthenticated PHP Object Injection
- Simple Revisions Delete <= 1.5.3 - Cross-Site Request Forgery
- Photonic Gallery & Lightbox for Flickr, SmugMug & Others <= 3.33 - Authenticated (Contributor+) Stored Cross-Site Scripting