Vulnerability archive: section 10, page 26
Open a report to review affected versions, available fixes and original sources. Each report covers a specific issue; its presence does not establish whether your website is affected.
- Geo Mashup < 1.8.3 - Cross-Site Scripting
- ARMember <= 4.0.5 - Cross-Site Request Forgery
- Pinpoint Booking System – #1 WordPress Booking Plugin < 1.3 - SQL Injection
- LIQUID SPEECH BALLOON <= 1.1.8 - Cross-Site Request Forgery to Settings Update
- BulletProof Security <= .53.2 - Cross-Site Scripting
- Lewe Bootstrap Visuals <= 2.2.2 - Authenticated (Contributor+) Stored Cross-Site Scripting
- reCAPTCHA Jetpack <= 0.2.2 - Cross-Site Request Forgery
- Melody <= 1.6.3 - Unauthenticated PHP Object Injection
- Al Pack <= 1.1.1 - Missing Authorization to Unauthenticated Premium Feature Activation via check_activate_permission Function
- BZScore – Live Score <= 1.03 - Authenticated (Contributor+) Stored Cross-Site Scripting via shortcode
- Api2Cart Bridge Connector <= 1.1.0 - Arbitrary File Upload
- Top 10 – Popular posts plugin - <= 3.2.4 - Authenticated(Admin+) Stored Cross-Site Scripting
- myStickymenu <= 2.5.1 - Authenticated Stored Cross-Site Scripting
- Bluestreet <= 1.7.3 - Cross-Site Request Forgery
- Coming Soon Page – Responsive Coming Soon & Maintenance Mode <= 1.1.18 - Cross-Site Scripting via button_text_link parameter
- All in One Time Clock Lite <= 1.3.325 - Cross-Site Request Forgery
- MihanPanel <= 12.4 - Cross-Site Request Forgery
- Sensei LMS <= 4.5.1 - Missing Authorization
- Real3D Flipbook <= 1.0 - Reflected Cross-Site Scripting
- MarketKing — Ultimate WooCommerce Multivendor Marketplace Solution <= 2.1.71 - Missing Authorization to Authenticated (Subscriber+) Refund Requests
- Age Gate <= 2.17.0 - Cross-Site Scripting via Data Import
- WordPress Shortcodes Plugin — Shortcodes Ultimate < 4.10.0 - Directory Traversal
- JetTabs <= 2.3.3.1 - Authenticated (Contributor+) Stored Cross-Site Scripting
- Video Embedder <= 1.7.1 - Cross-Site Request Forgery to Stored Cross-Site Scripting
- Custom Login Page Customizer <= 2.5.3 - Unauthenticated Privilege Escalation via Password Reset
- Woffice Core <= 5.4.8 - Reflected Cross-Site Scripting
- User Registration & Membership – Free & Paid Memberships, Subscriptions, Content Restriction, User Profile, Custom User Registration & Login Builder <= 5.2.7 - Missing Authorization
- Simple Owl Carousel <= 1.1.1 - Authenticated (Contributor+) Stored Cross-Site Scripting
- Post Grid Master <= 3.4.14 - Missing Authorization
- Quiz Maker Business, Developer, and Agency <= (Multiple Versions) - Missing Authorization to Google Sheets Integration Credentials Modification and Stored Cross-Site Scripting
- Overworld <= 1.3 - Unauthenticated Local File Inclusion
- Ultimate Store Kit – Addon For WooCommerce, EDD and Elementor <= 3.0.5 - Authenticated (Contributor+) Stored Cross-Site Scripting
- Network-Favorites <= 1.1 - Reflected Cross-Site Scripting
- AWP Classifieds <= 4.4.6 - Unauthenticated SQL Injection via 'regions'
- Qi Blocks <= 1.4.9 - Insecure Direct Object Reference to Authenticated (Author+) Arbitrary Style Modification via 'page_id' Parameter
- Link Log – external link click monitor <= 1.4 - HTTP Response Splitting
- Simple Local Avatars <= 2.7.10 - Cross-Site Request Forgery via save_default_avatar_file_id()
- Essential Blocks <= 5.7.2 - Missing Authorization To Authenticated (Author+) Information Disclosure
- Email marketing for WordPress by GetResponse Official <= 1.5.3 - Authenticated (Subscriber+) Information Exposure
- Survey Maker <= 3.2.0 - Missing Authorization
- Flexible Quantity – Measurement Price Calculator for WooCommerce <= 2.3.22 - Missing Authorization
- Amelia <= 1.0.95 - Cross-Site Request Forgery
- Easy Forms for MailChimp <= 6.8.6 - Authenticated (Contributor+) Stored Cross-Site Scripting
- Smart Auto Upload Images – Import External Images <= 1.2.2 - Authenticated (Contributor+) Server-Side Request Forgery
- Email Subscribers & Newsletters <= 3.4.12 - Cross-Site Scripting
- Email Users < 4.8.4 - Cross-Site Request Forgery
- Jetpack <= 3.7.1 - Stored Cross-Site Scripting
- WooCommerce Blocks < 5.5 - Authenticated Blind SQL Injection
- Freshdesk (official) <= 2.3.6 - Open Redirect
- Vik Rent Car <= 1.1.6 - Cross-Site Request Forgery to Stored Cross-Site Scripting
- Popup Builder <= 3.63 - Authenticated Settings Modification, Configuration Disclosure, and User Data Export
- Kirki <= 6.0.11 - Unauthenticated HTML Injection
- Custom Post Type <= 1.0 - Cross-Site Request Forgery to Custom Post Type Deletion
- Download Alt Text AI <= 1.3.4 - Authenticated (Administrator+) Stored Cross-Site Scripting
- BookingPress <= 1.0.82 - Missing Authorization to Appointment Time Alteration
- Goodlayers Hostel <= 3.1.2 - Reflected Cross-Site Scripting
- Blog, Posts and Category Filter for Elementor <= 2.0.1 - Authenticated (Contributor+) Stored Cross-Site Scripting
- ChildHope <= 1.1.8 - Unauthenticated Local File Inclusion
- WP Fastest Cache <= 1.1.2 - Cross-Site Request Forgery via 'wpfc_preload_single_save_settings_callback'
- Simple Payment <= 2.4.6 - Unauthenticated Local File Inclusion
- WPBook <= 2.7 - Unauthenticated Cross-Site Request Forgery
- Falang multilanguage for WordPress < 1.3.18 - Reflected Cross-Site Scripting
- Optinly <= 1.0.15 - Cross-Site Request Forgery
- Phee's LinkPreview <= 1.6.7 - Cross-Site Request Forgery
- Mediabay - WordPress Media Library Folders <= 1.4 - Authenticated (Subscriber+) SQL Injection
- WPRealty <= 2.9.1 - Time-Based Blind SQL Injection
- Bard <= 1.6 - Cross-Site Request Forgery
- Getwid – Gutenberg Blocks <= 1.8.3 - Improper Authorization via get_remote_templates REST endpoint
- Store Locator <= 3.98.10 - Unauthenticated Local File Inclusion
- EduMall <= 4.4.7 - Authenticated (Contributor+) Local File Inclusion
- Hello Elementor <= 3.0.0 - Cross-Site Request Forgery to Notice Dismissal
- Premium Addons for Elementor <= 4.10.31 - Authenticated (Contributor+) Stored Cross-Site Scripting via Fancy Text Widget
- Integration for Contact Form 7 and Zoho CRM, Bigin <= 1.2.3 - Authenticated (Admin+) SQL Injection
- Asgaros Forums <= 1.15.13 - Authenticated Stored Cross-Site Scripting
- AI WP Writer <= 3.6.5 - Missing Authorization
- Classified Listing – AI-Powered Classified ads & Business Directory <= 5.4.2 - Missing Authorization
- SEO Metrics <= 1.0.15 - Missing Authorization to Authenticated (Subscriber+) Privilege Escalation
- Testimonials Widget <= 4.0.4 - Authenticated (Author+) Stored Cross-Site Scripting via testimonials Shortcode
- Event Countdown Timer Plugin by TechMix <= 1.4 - Reflected Cross-Site Scripting
- Easy PayPal Events <= 1.2.2 - Cross-Site Request Forgery
- Unbounce Landing Pages <= 1.1.4 - Missing Authorization
- Blogmine <= 1.1.7 - Unauthenticated Local File Inclusion
- Blog Designer For Elementor – Post Slider, Post Carousel, Post Grid <= 1.1.7 - Cross-Site Request Forgery
- Modern Polls <= 1.0.10 - Cross-Site Request Forgery
- Filmax <= 1.1.11 - Unauthenticated Local File Inclusion
- ElementInvader Addons for Elementor <= 1.2.8 - Authenticated (Contributor+) Stored Cross-Site Scripting
- Geo Controller <= 8.6.9 - Missing Authorization to Unauthenticated Shortcode Execution
- Smallerik File Browser <= 1.1 - Authenticated (Subscriber+) Arbitrary File Upload
- WP Popup Builder <= 1.3.8 - Unauthenticated Information Exposure
- Simple Page Specific Sidebars <= 2.14.1 - Cross-Site Request Forgery to Stored Cross-Site Scripting
- Monolit <= 2.0.6 - Unauthenticated Stored Cross-Site Scripting
- Robo Gallery <= 5.2.5 - Authenticated (Contributor+) Stored Cross-Site Scripting
- Everest Backup – WordPress Cloud Backup, Migration, Restore & Cloning Plugin <= 2.2.13 - Sensitive Invormation Disclosure via procstat Log
- Credits Shortcode <= 1.2 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'link' Shortcode Attribute
- Create with Code <= 1.4 - Authenticated (Contributor+) Stored Cross-Site Scripting
- YITH WooCommerce Account Funds Premium <= 1.33.0 - Missing Authorization
- My WP Translate <= 1.1 - Missing Authorization to Authenticated (Subscriber+) Arbitrary Options Update
- Contact Form builder with drag & drop - Kali Forms <= 2.3.28 - Missing Authorization via get_log
- Penci Soledad Data Migrator <= 1.3.0 - Unauthenticated Local File Inclusion
- Link Library <= 7.2.8 - Reflected Cross-Site Scripting