Vulnerability archive: section 10, page 24
Open a report to review affected versions, available fixes and original sources. Each report covers a specific issue; its presence does not establish whether your website is affected.
- Quiz and Survey Master (QSM) – Quiz Maker & Survey Maker < 11.2.4 - Authenticated (Contributor+) Insecure Direct Object Reference
- Tantyyellow <= 1.0.0.5 - Reflected Cross-Site Scripting
- Appius Theme <= 1.0 - Full Path Disclosure
- Yoast SEO <= 26.8 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'yoast-schema' Block Attribute
- Nomupay Payment Processing Gateway <= 7.1.6 - Reflected Cross-Site Scripting
- Black Widgets For Elementor <= 1.3.6 - Authenticated (Contributor+) Stored Cross-Site Scripting
- XStore < 9.6.1 - Authenticated (Subscriber+) Local File Inclusion
- Quiz and Survey Master <= 8.1.4 - Unauthenticated SQL Injection
- Elated Listing <= 1.4 - Missing Authorization
- Plugins Last Updated Column <= 0.1.3 - Cross-Site Request Forgery
- CRM 2go <= 1.0 - Authenticated (Contributor+) Stored Cross-Site Scripting
- WooCommerce <= 8.1.1 & WooCommerce Blocks <= 11.1.1 - Authenticated (Contributor+) Stored Cross-Site Scripting via Featured Image alt Attribute
- SiteOrigin Widgets Bundle <= 1.60.0 - - Authenticated (Contributor+) Stored Cross-Site Scripting via 'siteorigin_widget' Shortcode
- ChatBot <= 5.1.0 - Unauthenticated PHP Object Injection
- Vrm 360 3D Model Viewer <= 1.2.1 - Authenticated (Contributor+) Arbitrary File Upload
- Link Whisper Free <= 0.6.3 - Missing Authorization via init()
- JH 404 Logger <= 1.1 - Unauthenticated Stored Cross-Site Scripting
- Pz-LinkCard <= 2.5.2 - Cross-Site Request Forgery via page_cacheman
- ProfilePress <= 3.2.2 - Reflected Cross-Site Scripting
- Order Delivery Date Pro for WooCommerce < 12.6.0 - Unauthenticated Arbitrary Post Title Disclosure
- The Ultimate Video Player For WordPress – by Presto Player <= 4.1.3 - Missing Authorization
- iGMS Direct Booking <= 1.0 - Unauthenticated Stored Cross-Site Scripting
- WP Crowdfunding <= 2.1.15 - Authenticated (Contributor+) Stored Cross-Site Scripting
- Dynamics 365 Integration <= 1.3.17 - Unauthenticated Sensitive Information Exposure
- Coupon Referral Program <= 1.8.4 - Sensitive Information Disclosure
- Orderable <= 1.20.0 - Missing Authorization to Authenticated (Subscriber+) Arbitrary Plugin Installation
- WP Restaurant Listings <= 1.0.2 - Authenticated (Contributor+) Stored Cross-Site Scripting
- WordPress Importer <= 0.8.3 - Authenticated (Administrator+) PHP Object Injection
- Hydra Booking <= 1.1.32 - Authenticated (Custom role+) SQL Injection
- Error Monitoring by Bugsnag <= 1.6.3 - Cross-Site Request Forgery
- Pixabay Images <= 3.4 - Authenticated (Author+) Arbitrary File Upload
- Amazon Scraper <= 1.1 - Cross-Site Request Forgery to Stored Cross-Site Scripting via Settings Update
- WP Accessibility Helper (WAH) <= 0.6.6 - Cross-Site Request Forgery
- Affiliates Manager <= 2.8.9 - Unauthenticated Stored Cross-Site Scripting
- Fast Tube <= 2.3.1 - Reflected Cross-Site Scripting
- FileBird – WordPress Media Library Folders & File Manager <= 6.5.1 - Missing Authorization to Authenticated (Author+) Global Folders Tampering
- Quttera Web Malware Scanner <= 3.4.1.48 - Authenticated (Administrator+) Directory Traversal via ShowFile
- WP-WebAuthn <= 1.3.4 - Unauthenticated Stored Cross-Site Scripting
- Magnitudo (All Versions) - Arbitrary File Upload
- Booking Calendar <= 8.4.3 - SQL injection
- Oracle Cards Lite <= 1.2.1 - Reflected Cross-Site Scripting
- Manual - Documentation, Knowledge Base & Education WordPress <= 7.5.4 - Authenticated (Contributor+) Stored Cross-Site Scripting
- Remove Add to Cart WooCommerce <= 1.4.4 - Cross-Site Request Forgery to Settings Modification
- Post Grid Gutenberg Blocks <= 5.1.0 - Unauthenticated Stored Cross-Site Scripting via display_name User Field
- Stars Testimonials <= 3.3.1 - Authenticated (Contributor+) Stored Cross-Site Scripting via stars_testimonials Shortcode
- Page Link Manager <= 1.0b - Cross-Site Request Forgery to Settings Update
- SlingBlocks – Gutenberg Blocks by FunnelKit (Formerly WooFunnels) <= 1.5.0 - Authenticated (Contributor+) Stored Cross-Site Scripting
- Quentn WP <= 1.2.14 - Authenticated (Administrator+) SQL Injection
- Welcart e-Commerce <= 2.8.4 - Authenticated (Subscriber+) Arbitrary File Read
- SmartMag <= 10.3.1 - Authenticated (Contributor+) Stored Cross-Site Scripting
- Library Management System <= 3.1 - Authenticated (Admin+) SQL Injection
- Custom Twitter Feeds <= 2.8.0 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'buttoncolor' Shortcode Attribute
- Icegram Mailer <= 1.0.12 - Authenticated (Administrator+) SQL Injection via 'fields' Parameter
- ZenphotoPress <= 1.8 - Reflected Cross-Site Scripting
- Photo Gallery by 10Web – Mobile-Friendly Image Gallery <= 1.8.30 - Authenticated (Admin+) Stored Cross-Site Scripting
- YayExtra <= 1.5.2 - Missing Authorization
- Subscribe to Unlock Lite <= 1.3.0 - Authenticated (Subscriber+) Local File Inclusion
- Colissimo Officiel : Méthodes de livraison pour WooCommerce <= 2.9.0 - Missing Authorization to Authenticated (Subscriber+) Arbitrary Order Shipment Modification via lpc_order_affect AJAX action
- Patreon WordPress <= 1.7.0 - Reflected Cross-Site Scripting
- Bricksforge <= 3.1.8.6 - Unauthenticated Privilege Escalation via Pro Forms fieldIds Parameter
- WooCommerce PDF Invoices, Packing Slips, Delivery Notes and Shipping Labels <= 4.7.1 - Authenticated (Shop Manager+) Stored Cross-Site Scripting
- Onclick Show Popup <= 8.1 - Authenticated (Administrator+) Stored Cross-Site Scripting
- Download Plugins and Themes from Dashboard <= 1.9.6 - Cross-Site Request Forgery to Bulk Plugin/Theme Archival
- Profile Builder – User Profile & User Registration Forms <= 3.9.0 - Sensitive Information Disclosure via Shortcode
- SKT Blocks – Gutenberg based Page Builder <= 1.6 - Authenticated (Contributor+) Stored Cross-Site Scripting
- AdsPlace'r – Ad Manager, Inserter, AdSense Ads <= 1.1.5 - Reflected Cross-Site Scripting
- Total Upkeep by BoldGrid <= 1.14.9 - Unauthenticated Backup Download
- YouTube Embed <= 3.3.2 - Cross-Site Scripting
- Affiliates <= 7.0.1 - Unauthenticated PHP Object Injection
- Spiffy Calendar <= 4.9.12 - Authenticated (Admin+) SQL Injection
- WP Google Review Slider <= 15.5 - Authenticated (Admin+) Stored Cross-Site Scripting
- Spiderpowa Embed PDF <= 1.0 - Authenticated (Contributor+) Stored Cross-Site Scripting
- Majestic Support – The Leading-Edge Help Desk & Customer Support Plugin <= 1.2.0 - Missing Authorization
- Cozy Blocks <= 2.2.11 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'layoutCircle.alignment' Block Attribute
- YellowPencil Visual CSS Style Editor <= 7.5.8 - Reflected Cross-Site Scripting liveLink
- Autoptimize <= 3.1.15.1 - Unauthenticated Stored Cross-Site Scripting via Comment Author Name
- Zoho CRM Lead Magnet <= 1.7.9.7 - Authenticated (Contributor+) SQL Injection
- Video Conferencing with Zoom <= 4.6.7 - Missing Authorization to Unauthenticated Zoom SDK Credential Exposure via 'get_auth' AJAX Action
- Kormosala <= 1.0.22 - Reflected Cross-Site Scripting
- Albo Pretorio Online <= 4.6.3 - Reflected Cross-Site Scripting
- HTTP Requests Manager <= 1.3.11 - Unauthenticated Stored Cross-Site Scripting
- Aurum - WordPress & WooCommerce Shopping Theme <= 4.0.2 - Missing Authorization to Authenticated (Subscriber+) Demo Content Import
- WP Enabled SVG <= 0.7 - Authenticated (Author+) Stored Cross-Site Scripting via SVG
- Slick Slider <= 0.5.2 - Authenticated (Contributor+) Stored Cross-Site Scripting
- Conditional cart fee / Extra charge rule for WooCommerce extra fees <= 1.0.96 - Authenticated (Administrator+) Stored Cross-Site Scripting
- Blog Designer PRO for WordPress <= 3.4.7 - Reflected Cross-Site Scripting
- SVG Captcha <= 1.0.11 - Reflected Cross-Site Scripting
- Rocket Maintenance Mode & Coming Soon Page <= 4.3 - Authenticated (Administrator+) Stored Cross-Site Scripting
- LinkedIn Lite <= 1.0 - Unauthenticated Local File Inclusion
- WP Post Author – Enhance Your Posts with the Author Bio, Co-Authors, Guest Authors, and Post Rating System, including User Registration Form Builder <= 3.7.4 - Missing Authorization
- HDW WordPress Video Gallery <= 1.2 - Reflected Cross-Site Scripting via channel parameter
- Hashtags <= 0.3.2 - Cross-Site Request Forgery to Stored Cross-Site Scripting
- User Activity Log <= 1.6.5 - Unauthenticated Data Export to Sensitive Information Disclosure
- AffiliateWP < 2.0.9.1 - Reflected Cross-Site Scripting
- Charitable <= 1.8.1.7 - Missing Authorization via ajax_license_check()
- PopupAlly <= 2.1.0 - Cross-Site Request Forgery via optin_submit_callback
- Woodmart <= 8.3.8 - Unauthenticated PHP Object Injection
- Modern Events Calendar Lite <= 5.16.5 - Authenticated SQL Injection
- Coming Soon Maintenance Mode <= 1.0.5 - Information Exposure
- Fluent Forms <= 6.1.7 - Unauthenticated Insecure Direct Object Reference to Payment Status Tampering via submission_id