Vulnerability archive: section 11, page 13
Open a report to review affected versions, available fixes and original sources. Each report covers a specific issue; its presence does not establish whether your website is affected.
- UsersWP <= 1.2.3 - Subscriber+ User Avatar Override
- Total Upkeep – WordPress Backup Plugin plus Restore & Migrate by BoldGrid < 1.17.3 - Unauthenticated Information Exposure
- Ultimate Noindex Nofollow Tool II <= 1.3.3 - Cross-Site Request Forgery
- Appointment Booking Calendar <= 1.6.11.11 - Incorrect Authorization to Unauthenticated Sensitive Field Modification via Appointment Public Token
- Accordion and Accordion Slider <= 1.4.5 - Missing Authorization to Authenticated (Contributor+) Attachment Metadata Modification
- Slider by 10Web <= 1.2.55 - Authenticated (Editor+) Stored Cross-Site Scripting
- Defender Security – Malware Scanner, Login Security & Firewall < 6.2.0 - Authenticated (Administrator+) Remote Code Execution
- RepairBuddy – Repair Shop CRM & Booking Plugin for WordPress <= 4.1223 - Missing Authorization
- WP Visitor Statistics (Real Time Traffic) <= 6.9.4 - Sensitive Information Exposure via Log File
- Uncanny Automator Pro <= 5.3 - Reflected Cross-Site Scripting
- Enjoy Social Feed <= 6.2.2 - Missing Authorization
- SSU <= 1.5.0 - Missing Authorization
- Wheel of Life: Coaching and Assessment Tool for Life Coach <= 1.1.7 - Missing Authorization on Several AJAX Endpoints
- Directory Pro <= 2.5.5 - Reflected Cross-Site Scripting
- Colibri Page Builder <= 1.0.335 - Authenticated (Contributor+) Stored Cross-Site Scripting
- Import Export Lite <= 3.9.33 - Authenticated (Admin+) Remote Code Execution
- Gyan Elements <= 2.2.1 - Authenticated (Contributor+) Local File Inclusion
- Ai Auto Tool Content Writing Assistant (Gemini Writer, ChatGPT ) All in One 2.0.7 - 2.3.4 - Missing Authorization to Authenticated (Subscriber+) Post Creation
- WooCommerce Ninja Forms Product Add-ons <= 1.7.0 - Unauthenticated Arbitrary File Upload
- 10Web Booster – Website speed optimization, Cache & Page Speed optimizer <= 2.8.34 - Missing Authorization to Plugin Deactivation
- Dashing Memberships <= 1.1 - Reflected Cross-Site Scripting
- Simple File List <= 6.1.13 - Missing Authorization to Unauthenticated Minor Settings Update
- Backup, Restore and Migrate your sites with XCloner <= 4.8.6 - Authenticated (Subscriber+) Information Exposure
- Video Gallery <= 4.0.3 - Authenticated (Subscriber+) Arbitrary Function Call via 'path' Parameter
- Media Library Assistant <= 3.28 - Authenticated (Author+) Stored Cross-Site Scripting
- Category Icon <= 1.0.1 - Authenticated (Author+) Arbitrary File Download
- Wiremo <= 1.4.99 - Missing Authorization
- Accessibility Suite <= 4.19 - Missing Authorization
- WooCommerce Google Sheet Connector < 1.3.6 - Cross-Site Request Forgery
- WooCommerce Checkout Field Manager <= 17.3 - Unauthenticated Arbitrary File Upload
- WP LMS – Best WordPress LMS Plugin <= 1.1.5 - Cross-Site Scripting
- Hygia - Cleaning Services WordPress Theme <= 1.21.0 - Unauthenticated PHP Object Injection
- The Aisle < 2.9.1 - Unauthenticated Local File Inclusion
- 012 PS Multi Languages <= 1.6 - Authenticated (Contributor+) Stored Cross-Site Scripting
- Link Library <= 7.6.11 - Authenticated (Contributor+) Stored Cross-Site Scripting via link-library Shortcode
- Fatal Error Notify <= 1.5.2 - Cross-Site Request Forgery to Test Error Email Sending
- Domain Theme <= 1.3 - Cross-Site Request Forgery
- Blix 0.9.1 and Blix 0.9.1 Rus - Cross-Site Scripting
- Contact Form Clean and Simple < 4.4.1 - Cross-Site Scripting
- Kalium <= 3.25 - Unauthenticated Arbitrary Code Execution
- Min Max Step Quantity Limits Manager for WooCommerce <= 5.2.2 - Reflected Cross-Site Scripting
- Appsero <= 1.2.0 - Cross-Site Request Forgery
- Opening Hours <= 2.3.0 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode
- Workreap < 2.6.3 - Insecure Direct Objection Reference to Private Message Disclosure
- Woocommerce Wholesale Lead Capture <= 2.0.3.1 - Unauthenticated Privilege Escalation
- Co-Authors Plus 3.5 - 3.5.1 - Sensitive Information Disclosure
- NextMove Lite <= 2.23.0 - Missing Authorization
- WPBakery Page Builder Addons by Livemesh <= 3.9.4 - Missing Authorization to Authenticated (Subscriber+) Stored Cross-Site Scripting
- Logtik <= 2.3 - Reflected Cross-Site Scripting
- WCFM – Frontend Manager for WooCommerce along with Bookings Subscription Listings Compatible <= 6.7.12 - Insecure Direct Object Reference to Account Takeover/Privilege Escalation
- Maps by BestWebSoft <= 1.3.5 - Reflected Cross-Site Scripting
- WPeMatico RSS Feed Fetcher <= 2.6.11 - Admin+ Stored Cross-Site Scripting
- Royal Elementor Addons <= 1.7.1066 - Unauthenticated Arbitrary HTML Injection in Notification Emails
- Appointments <= 2.2.1 - Unauthenticated PHP Object Injection
- Referrer Detector <= 4.2.1.0 - PHP Object Injection
- Campus Explorer Widget <= 1.4 - Reflected Cross-Site Scripting
- Recent Posts Slider <= 1.1 - Cross-Site Request Forgery
- SnapWidget Social Photo Feed Widget <= 1.1.0 - Authenticated (Contributor+) Stored Cross-Site Scripting
- Testimonials <= 3.0.8 - Reflected Cross-Site Scripting
- Live Dashboard <= 0.3.3 - Reflected Cross-Site Scripting
- Simple WP Events <= 1.8.17 - Authenticated (Contributor+) Stored Cross-Site Scripting
- AR For WordPress <= 7.7 - Authenticated (Contributor+) Stored Cross-Site Scripting
- BulkGate SMS Plugin for WooCommerce <= 3.0.2 - Missing Authorization via Multiple AJAX Actions
- WP Gravity Forms Constant Contact Plugin <= 1.1.0 - Open Redirect
- WordPress All In One Login Plugin <= 2.0.8 - IP Sooofing to Protection Mechanism Bypass
- Advanced File Manager <= 5.3.1 - Missing Authorization to Notice Dismisaal
- Gerencianet Oficial <= 1.4.8 - Missing Authorization
- Groundhogg <= 4.9 - Authenticated (Custom+) Privilege Escalation to 'user' Parameter
- Accept Donations with PayPal & Stripe <= 1.5.5 - Authenticated (Contributor+) Stored Cross-Site Scripting
- User Registration Advanced Fields <= 1.6.20 - Unauthenticated Arbitrary File Upload
- WooCommerce Weight Based Shipping <= 5.4.1 - Cross-Site Request Forgery leading to Plugin Settings Changes
- Multiple Page Generator Plugin – MPG <= 4.0.5 - Authenticated (Editor+) Server-Side Request Forgery via fileUrl
- WordPress Core < 2.0.4 - Full Path Disclosure
- Pods - Custom Content Types and Fields - Authenticated (Contributor+) SQL Injection via Shortcode
- Print My Blog <= 3.27.0 - Authenticated (Author+) Stored Cross-Site Scripting
- Download Manager <= 3.2.43 - Reflected Cross-Site Scripting
- All-in-One WP Migration and Backup <= 7.86 - Unauthenticated Information Disclosure via Error Logs
- Premium Packages – Sell Digital Products Securely <= 7.0.5 - Unauthenticated Stored Cross-Site Scripting
- File Sharing & Download Manager <= 2.1.6 - Authenticated (Subscriber+) Stored Cross-Site Scripting via 'fldr_ttl' Parameter
- Bulgarisation for WooCommerce <= 3.0.14 - Cross-Site Request Forgery
- WP External Links < 1.81 - Authenticated Stored Cross-Site Scripting
- Refund Request for WooCommerce <= 1.0 - Missing Authorization to Authenticated (Subscriber+) Refund Status Update
- WP Post Category Notifications <= 1.0 - Reflected Cross-Site Scripting
- PDF Poster <= 2.4.0 - Missing Authorization
- FoodBook Lite <= 1.5.6 - Missing Authorization to Unauthenticated User Registration via 'registration_action' AJAX Action
- Beaver Builder <= 2.8.2.2 - Authenticated (Contributor+) Stored Cross-Site Scripting
- Zoho Creator Forms <= 1.0.5 - Authenticated (Contributor+) Stored Cross-Site Scripting
- Passster <= 4.2.23 - Unauthenticated Protected Content Disclosure
- Wishlist Member <= 3.30.1 - Missing Authorization to Authenticated (Subscriber+) API Secret Key Disclosure and Privilege Escalation via 'wlm3_get_screen' AJAX action
- VikBooking <= 1.5.8 - Reflected Cross-Site Scripting
- User Registration & Membership – Free & Paid Memberships, Subscriptions, Content Restriction, User Profile, Custom User Registration & Login Builder <= 5.2.2 - Missing Authorization
- WooCommerce <= 3.4.4 - Authenticated PHP Object Injection
- Avada Builder <= 3.15.1 - Unauthenticated SQL Injection via 'product_order' Parameter
- افزونه حمل و نقل ووکامرس | پست پیشتاز، تیپاکس و پیک موتوری <= 4.4.5 - Cross-Site Request Forgery
- PayPal Brasil para WooCommerce <= 1.4.2 - Cross-Site Request Forgery
- PDF Invoices and Packing Slips For WooCommerce <= 1.3.7 - Authenticated (Subscriber+) PHP Object Injection
- VaultPress <= 1.8.6 - Remote Code Execution
- WordPress Gallery Plugin – Limb Image Gallery <= 1.5.7 - Authenticated (Subscriber+) Arbitrary File Upload
- Easy Forms for MailChimp <= 6.8.7 - Reflected Cross-Site Scripting
- Paid Memberships Pro <= 2.6.5 - Reflected Cross-Site Scripting