Vulnerability archive: section 10, page 23
Open a report to review affected versions, available fixes and original sources. Each report covers a specific issue; its presence does not establish whether your website is affected.
- ArtPlacer Widget <= 2.21.1 - Cross-Site Request Forgery
- Paid Membership Plugin, Ecommerce, User Registration Form, Login Form, User Profile & Restrict Content – ProfilePress <= 4.14.3 - Authenticated (Contributor+) Stored Cross-Site Scripting
- Cleverwise Daily Quotes <= 3.2 - Reflected Cross-Site Scripting
- Global Gallery - WordPress Responsive Gallery <= 11.1.2 - Unauthenticated Stored Cross-Site Scripting
- Evergreen Content Poster <= 1.4.5 - Missing Authorization
- Beaver Builder <= 2.8.3.7 - Authenticated (Contributor+) Stored Cross-Site Scripting
- QA Assistants – Driven by data <= 5.2.0.0 - Unauthenticated Remote Code Execution
- WP Easy Gallery <= 2.7 - SQL Injection
- Stylish Google Sheet Reader <= 4.0 - Reflected Cross-Site Scripting
- SAMO Forms <= 1.0.0 - Unauthenticated SQL Injection
- LeadConnector <= 3.0.2 - Authenticated (Contributor+) Stored Cross-Site Scripting
- WP Photo Album Plus <= 9.2.04.002 - Authenticated (Administrator+) SQL Injection via 'table' Parameter
- Leadpages <= 1.1.3 - Missing Authorization
- Frontend File Manager <= 18.2 - Unauthenticated Content Injection
- JobSearch WP Job Board <= 1.8.1 - Missing Authorization to Arbitrary Options Update
- flickr-slideshow-wrapper <= 5.4.6 - Reflected Cross-Site Scripting
- Microsoft Clarity <= 0.3 - Authenticated Stored Cross-Site Scripting
- Accordion and Accordion Slider <= 1.2.4 - Missing Authorization via 'wp_aas_get_attachment_edit_form' and 'wp_aas_save_attachment_data'
- Pinterest Site Verification plugin using Meta Tag <= 1.8 - Authenticated (Subscriber+) Stored Cross-Site Scripting via 'post_var'
- KP Agent Ready <= 1.1.99 - Unauthenticated Information Exposure
- WP Radio – Worldwide Online Radio Stations Directory for WordPress <= 3.1.9 - Missing Authorization via multiple AJAX actions
- Layer Slider <= 1.1.9.7 - Authenticated (Contributor+) Stored Cross-Site Scripting
- Access Category Password <= 1.5.1 - Reflected Cross-Site Scripting
- Stars Rating <= 3.5.0 - Denial of Service
- Cost Calculator Builder <= 3.2.65 - Authenticated (Contributor+) Stored Cross-Site Scripting
- Football Live Scores <= 1.5 - Missing Authorization
- Form Maker by 10Web < 1.13.40 - Reflected Cross-Site Scripting
- Directorist: AI-Powered Business Directory, Listings & Classified Ads <= 8.8.2 - Authenticated (Subscriber+) PHP Object Injection
- NAVER Analytics <= 0.9 - Cross-Site Request Forgery to Stored Cross-Site Scripting
- e-shops <= 1.0.3 - Cross-Site Request Forgery to Reflected Cross-Site Scripting
- Recipe Card Blocks for Gutenberg & Elementor <= 3.4.3 - Insecure Direct Object Reference to Authenticated (Contributor+) Post Disclosure
- Newsmag < 5.0 - Reflected Cross-Site Scripting
- Ambience (Unspecified Versions) - Cross-Site Scripting
- Vanguard - Marketplace Digital Products PHP7 <= 2.1 - Cross-Site Scripting
- WordPress Infinite Scroll – Ajax Load More <= 7.1.1 - Authenticated (Contributor+) Cross-Site Scripting
- WP Meta SEO <= 4.5.3 - Cross-Site Request Forgery via 'regenerateSitemaps'
- WP Zendesk for Contact Form 7, WPForms, Elementor, Formidable and Ninja Forms <= 1.1.3 - Cross-Site Request Forgery
- MC4WP: Mailchimp for WordPress <= 4.11.1 - Missing Authorization to Unauthenticated Arbitrary Subscription Deletion
- AdminOnline (Unspecified Version) - Directly Traversal/Arbitrary File Read
- DejaVu <= 2.4 - Arbitrary File Download
- SupportCandy – AI Customer Support Ticket System & Live Chatbot Agent 3.3.6 - 3.5.2 - Unauthenticated Information Exposure
- SEO Redirection <= 8.1 - Subscriber+ SQL Injection
- Surbma | Booking.com <= 2.1 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode
- wpDataTables (Premium) <= 3.4.1 - Improper Access Control leading to Table Data Deletion
- Custom List Table Example <= 1.4.1 - Cross-Site Request Forgery to Reflected Cross-Site Scripting
- PDF Invoices & Packing Slips for WooCommerce <= 5.6.0 - Missing Authorization to Authenticated (Subscriber+) Peppol Identifier Modification
- Backup Guard <= 1.1.46 - Cross-Site Scripting
- WordPress Core < 3.6.1 - HTML File Upload
- Legrand <= 2.17 - Unauthenticated Local File Inclusion
- wpDiscuz <= 7.6.12 - Authenticated (Administrator+) Stored Cross-Site Scripting
- WC Place Order Without Payment <= 2.6.7 - Unauthenticated Local File Inclusion
- ZenLite <= 4.3 - Cross-Site Scripting
- Funnel Builder by FunnelKit <= 3.11.1 - Unauthenticated Local File Inclusion
- Simple Sticky Add To Cart For WooCommerce <= 1.4.6 - Missing Authorization
- Post Timeline <= 2.3.9 - Reflected Cross-Site Scripting
- Colormix (All Versions) - Multiple Vulnerabilities
- Nested Pages <= 3.2.14 - Authenticated (Editor+) Stored Cross-Site Scripting
- WordPress Core <= 1.5 - Stored Cross-Site Scripting
- JetFormBuilder <= 3.5.3 - Missing Authorization to Unauthenticated Form Generation
- Thumbnail carousel slider < 1.0.1 - Stored Cross-Site Scripting and Cross-Site Request Forgery
- FormLayer <= 1.0.6 - Unauthenticated Information Exposure
- Restaurant & Cafe Addon for Elementor <= 1.5.5 - Authenticated (Contributor+) Stored Cross-Site Scripting
- Mopinion Feedback Form <= 1.1.1 - Reflected Cross-Site Scripting
- Import and export users and customers <= 1.26.5 - Missing Authorization
- CozyStay <= 1.7.0 - Missing Authorization to Arbitrary Action Execution in ajax_handler
- WooCommerce Amazon Affiliates - Wordpress Plugin <= 14.0.31 - Authenticated (Subscriber+) SQL Injection
- Form Maker by 10Web <= 1.15.18 - Reflected Cross-Site Scripting
- WP Bannerize Pro <= 1.10.0 - Authenticated (Editor+) Server-Side Request Forgery
- WP Nice Loader <= 0.1.0.4 - Cross-Site Request Forgery to Stored Cross-Site Scripting
- User Referral <= 8.0 - Reflected Cross-Site Scripting
- Olevmedia Shortcodes <= 1.1.8 - Reflected Cross-Site Scripting
- Shelf Planner <= 2.8.1 - Unauthenticated Information Exposure via Log Files
- QuestionPro Surveys <= 1.0 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode Attributes
- ELEX WordPress HelpDesk & Customer Ticketing System <= 3.3.1 - Missing Authorization to Authenticated (Subscriber+) Role Removal
- WPZOOM Social Feed Widget & Block <= 2.1.13 - Missing Authorization to Authenticated (Subscriber+) Instagram Image Deletion
- MainWP UpdraftPlus Extension <= 4.0.6 - Missing Authorization to Arbitrary Plugin Activation
- Spiffy Calendar <= 4.9.0 - Edit/Delete event via IDOR
- Recent Posts Widget Extended <= 2.0.2 - Authenticated (Contributor+) Stored Cross-Site Scripting via rpwe Shortcode
- GiveWP – Donation Plugin and Fundraising Platform <= 3.13.0 - Missing Authorization to Unauthenticated Event Settings Update
- About Rentals <= 1.5 - Missing Authorization
- Debug Bar ElasticPress <= 2.1.0 - Cross-Site Scripting
- Connect Contact Form 7, WooCommerce To Google Sheets & Other Platforms – Advanced Form Integration <= 1.62.0 - Authenticated (Admin+) Cross Site Scripting
- Tidy Up <= 1.3 - Cross-Site Request Forgery
- WP Fusion Lite <= 3.37.18 – Cross-Site Request Forgery to Data Deletion
- Userlike <= 2.2 - Authenticated (Administrator+) Stored Cross-Site Scripting
- Greek Namedays Widget From Eortologio.Net <= 20191113 - Authenticated (Contributor+) Stored Cross-Site Scripting
- Embed and Integrate Etsy Shop <= 1.0.4 - Missing Authorization
- Similarity <= 3.0 - Cross-Site Request Forgery to Stored Cross-Site Scripting
- Vision Interactive <= 1.7.1 - Missing Authorization
- Shouty <= 0.2.1 - Authenticated (Contributor+) Stored Cross-Site Scripting via shouty Shortcode Attributes
- Wishlist Member <= 3.32.0 - Authenticated (Subscriber+) PHP Object Injection
- WP eMember <= 10.6.6 - Reflected Cross-Site Scripting via Member Edit
- Collapsing Categories <= 3.0.8 - Unauthenticated SQL Injection
- GetSocial <= 2.0.1 - Reflected Cross-Site Scripting
- Easy Social Share Buttons <= 1.4.5 - Reflected Cross-Site Scripting
- Sign In With Google <= 1.8.0 - Authentication Bypass in authenticate_user
- YayCurrency – WooCommerce Multi-Currency Switcher < 3.3.5 - Unauthenticated Information Exposure
- WP Recipe Maker < 10.1.0 - Unauthenticated Arbitrary Shortcode Execution
- Don Peppe <= 1.3 - Missing Authorization
- Slimstat Analytics <= 5.0.5.1 - Missing Authorization via delete_pageview