Vulnerability archive: section 11, page 15
Open a report to review affected versions, available fixes and original sources. Each report covers a specific issue; its presence does not establish whether your website is affected.
- Exchange Rates Widget <= 1.4.0 - Authenticated (Contributor+) Stored Cross-Site Scripting
- Special Text Boxes <= 6.2.4 - Unauthenticated Arbitrary Shortcode Execution
- Student Result or Employee Database <= 1.7.9 - Missing Authorization
- Pixel Cat – Conversion Pixel Manager <= 2.6.3 - Reflected Cross-Site Scripting
- NextMove Lite – Thank You Page for WooCommerce & Finale Lite – Sales Countdown Timer & Discount for WooCommerce <= 2.17.0 - Missing Authorization to Unauthenticated System Information Disclosure
- Form Maker by 10Web <= 1.15.32 - Authenticated (Admin+) Stored Cross-Site Scripting
- Banner Garden Plugin for WordPress <= 0.1.3 - Reflected Cross-Site Scripting
- Autocompleter <= 1.3.5.2 - Cross-Site Request Forgery
- WP Recipe Maker <= 9.1.0 - Authenticated (Contributor+) Stored Cross-Site Scripting via icon_color
- Accordion (All Versions) - Arbitrary File Upload
- WP Fundraising Donation and Crowdfunding Platform <= 1.4.2 - Unauthenticated SQL Injection
- Goal Tracker for Patreon <= 0.4.6 - Authenticated (Administrator+) Stored Cross-Site Scripting
- Dialogity Free Live Chat <= 1.0.3 - Authenticated (Administrator+) Stored Cross-Site Scripting
- SlimStat-Ex <= 2.1.2 - Arbitrary Code Execution
- Geo Mashup <= 1.13.18 - Unauthenticated Time-Based SQL Injection via 'sort' Parameter
- GEO Plugin by Squirrly SEO <= 14.2.0 - Reflected Cross-Site Scripting
- NEX-Forms – Ultimate Form Builder – Contact forms and much more < 3.4 - SQL Injection
- PowerPack for Beaver Builder <= 2.33.0 - Authenticated (Contributor+) Privilege Escalation
- Ui Slider Filter By Price <= 1.1 - Reflected Cross-Site Scripting
- Multi-Step Checkout for WooCommerce <= 2.33 - Authenticated (Administrator+) Stored Cross-Site Scripting
- AI Post Generator | AutoWriter <= 3.5 - Missing Authorization to Authenticated (Contributor+) Post/Page Deletion
- BadgeOS <= 3.7.1.6 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode
- 百度站长SEO合集(支持百度/神马/Bing/头条推送) <= 2.0.6 - Unauthenticated Arbitrary File Upload
- Display Eventbrite Events <= 6.5.6 - Missing Authorization
- Wordfence < 3.3.7 - Reflected Cross-Site Scripting
- WP Debugging <= 2.11.7 - Cross-Site Request Forgery
- Good Mood <= 1.16 - Unauthenticated Local File Inclusion
- WooCommerce Coupon Popup, SmartBar, Slide In | MyShopKit <= 1.0.9 - Unauthenticated Sensitive Information Exposure
- Republish Old Posts <= 1.21 - Cross-Site Request Forgery via rop_options_page
- Newsletters <= 4.10 - Cross-Site Request Forgery
- Super Block Slider <= 2.7.9 - Missing Authorization
- WPMobile.App — Android and iOS Mobile Application <= 11.13 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcodes
- WP Live Chat Support Pro <= 8.0.06 - Remote Code Execution via unrestricted file upload
- WordPress Core < 5.5.2 - Privilege Escalation via XML-RPC
- Riode | Multi-Purpose WooCommerce < 1.6.29 - Reflected Cross-Site Scripting
- Wow Moodboard Lite <= 1.1.1.1 - Open Redirect
- ARPrice <= 4.1.3 - Authenticated (Subscriber+) SQL Injection
- Enter Addons – Ultimate Template Builder for Elementor <= 2.1.8 - Authenticated (Contributor+) Stored Cross-Site Scripting via Events Card Widget
- MailArchiver <= 2.10.1 - Unauthenticated Stored Cross-Site Scripting via Email Subject
- Accept Donations with PayPal <= 1.3.0 Cross-Site Request Forgery to Post Deletion
- Products Quick View for WooCommerce <= 2.2.0 - Missing Authorization
- Levo Slideshow <= 2.3 - Arbitrary File Upload
- Woocommerce Wholesale Lead Capture <= 2.0.3.1 - Unauthenticated Arbitrary File Upload
- Team Showcase < 25.05.13 - Missing Authorization
- GD Mylist <= 1.1.1 - Stored Cross-Site Scripting
- ProfileGrid <= 5.9.8.2 - Cross-Site Request Forgery to Group Membership Request Approval/Denial
- Read More & Accordion <= 3.4.7 - Cross-Site Request Forgery to Local File Inclusion
- Twitter Cards Meta <= 2.4.5 - Cross-Site Request Forgery
- Form Maker <= 1.14.11 - Stored Cross-Site Scripting
- TanTum <= 1.1.13 - Unauthenticated Local File Inclusion
- B Testimonial – testimonial plugin for WP <= 1.2.2 - Authenticated (Contributor+) Stored Cross-Site Scripting
- Activello <= 1.4.6 - Authenticated (Subscriber+) Stored Cross-Site Scripting
- Hide My WP Ghost – Security & Firewall <= 7.0.09 - Unauthenticated Server-Side Request Forgery
- User Spam Remover <= 1.0 - Unauthenticated Sensitive Information Exposure
- Zero Spam for WordPress <= 5.4.4 - Authenticated(Administrator+) SQL Injection
- WPFunnels <= 3.12.8 - Authenticated (Funnel Manager+) Privilege Escalation via 'group_id' Path Parameter
- Mobile Address Bar Changer <= 3.0 - Cross-Site Request Forgery to Settings Update
- Simple Restrict < 1.2.9 - Authenticated (Contributor+) Information Exposure
- Events Manager – Calendar, Bookings, Tickets, Appointments and more! <= 7.4.5 - Unauthenticated Information Exposure
- WP Google Maps <= 9.0.29 - Reflected Cross-Site Scripting
- Icegram Express Pro <= 5.9.5 - Authenticated (Admin+) Server-Side Request Forgery
- WordPress Download Manager <= 2.7.4 - Remote Code Execution
- Login with phone number <= 1.7.35 - Authenticated (Administrator+) Stored Cross-Site Scripting
- Tijaji <= 1.43 - Reflected Cross-Site Scripting
- WordPress Survey & Poll – Quiz, Survey and Poll Plugin for WordPress < 1.2 - SQL Injection
- Ippsum <= 1.2.0 - Unauthenticated PHP Object Injection
- DethemeKit For Elementor <= 2.1.7 - Authenticated (Contributor+) Stored Cross-Site Scripting
- Tutor LMS <= 2.1.10 - Unauthenticated SQL Injection
- Analytify <= 5.3.1 - Cross-Site Request Forgery to Opt-out
- WP Recipe Maker <= 9.1.0 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'tag'
- Simple Download Monitor <= 3.9.5 - Contributor+ Arbitrary Thumbnail Removal
- WPMovieLibrary <= 2.1.4.8 - Reflected Cross-Site Scripting
- ACF Recent Posts Widget <= 5.9.3 - Authenticated (Contributor+) Stored Cross-Site Scripting
- Masterstudy < 4.8.126 - Authenticated (Contributor+) Local File Inclusion
- Magazine Saga <= 1.2.7 - Unauthenticated Local File Inclusion
- ElementInvader Addons for Elementor <= 1.2.6 - Authenticated (Contributor+) Local File Inclusion
- Simple Photo Sphere <= 0.0.10 - Authenticated (Contributor+) Stored Cross-Site Scripting
- CLUEVO E-Learning Platform <= 1.8.0 - Authenticated Cross-Site Scripting
- Sherk Custom Post Type Displays <= 1.2.1 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'title' Shortcode Attribute
- RTMKit Addons for Elementor <= 2.0.8 - Authenticated (Contributor+) Information Exposure
- Webling <= 3.9.0 - Authenticated (Subscriber+) Stored Cross-Site Scripting via 'title' Parameter
- Fancy Testimonials <= 1.0 - Authenticated (Author+) Stored Cross-Site Scripting
- Spiffy Calendar <= 4.9.7 - Reflected Cross-Site Scripting
- Miniorange OTP Verification with Firebase <= 3.6.0 - Unauthenticated Arbitrary User Password Change
- WP Content Permission <= 1.2 - Authenticated (Administrator+) Stored Cross-Site Scripting via 'ohmem-message' Parameter
- Ultimate Member <= 2.4.1 - Username Enumeration
- WOOEXIM – WooCommerce Export Import Plugin <= 5.0.0 - Reflected Cross-Site Scripting
- Tutor LMS <= 4.1.0 - Insecure Direct Object Reference to Authenticated (Author+) Arbitrary Course Modification and Ownership Takeover via 'ID' Parameter
- MainWP Google Analytics Extension <= 4.0.4 - Missing Authorization to Plugin Settings Change
- Simple Auto Tag <= 1.1 - Cross-Site Request Forgery to Stored Cross-Site Scripting
- WP HRM LITE <= 1.1 - Unauthenticated SQL Injection
- Really Simple Security – Simple and Performant Security (formerly Really Simple SSL) < 9.8.0 - Authenticated (Custom Role+) Remote Code Execution
- Adapta RGPD <= 1.3.2 - Cross-Site Request Forgery
- BA Plus <= 1.0.3 - Reflected Cross-Site Scripting
- Any Post Slider <= 1.0.4 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'post_type' Shortcode Attribute
- Coon Google Maps <= 1.0 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode
- Clubmember <= 0.2 - Authenticated (Admin+) Stored Cross-Site Scripting
- AutomatorWP <= 2.5.0 - Cross Site Request Forgery
- Dokan: AI Powered WooCommerce Multivendor Marketplace Solution <= 5.0.4 - Authenticated (Custom+) Stored Cross-Site Scripting via Product SKU
- SW Core <= 1.7.18 - Authenticated (Contributor+) Local File Inclusion