Vulnerability archive: section 11, page 21
Open a report to review affected versions, available fixes and original sources. Each report covers a specific issue; its presence does not establish whether your website is affected.
- sem-wysiwyg <= 1.0 - Arbitrary File Upload
- GD bbPress Attachments <= 4.3.1 - Authenticated (Administrator+) Stored Cross-Site Scripting
- Post, Registration and Profile Form Builder – FrontEnd Editor BuddyForms – Easy WordPress Forms <= 2.8.1 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode
- Companion Auto Update <= 3.2.0 - Local File Inclusion
- User Frontend: AI Powered Frontend Posting, User Directory, Profile, Membership & User Registration <= 4.3.7 - Insecure Direct Object Reference to Unauthenticated Arbitrary Post Modification via 'wpuf_files_data' Parameter
- uContext for Amazon <= 3.9.1 - Cross-Site Request Forgery to Cross-Site Scripting
- Masteriyo LMS <= 2.2.1 - Missing Authorization to Authenticated (Student+) Arbitrary Course Announcement Modification
- Shield Security <= 21.0.9 - Authenticated (Subscriber+) Insecure Direct Object Reference to Disable Google Authenticator
- HUSKY – Products Filter Professional for WooCommerce <= 1.3.5.3 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode
- Starred Review <= 1.4.2 - Reflected Cross-Site Scripting via PHP_SELF Variable
- One Click Order Re-Order <= 1.1.9 - Missing Authorization to Authenticated (Subscriber+) Stored Cross-Site Scripting
- Tiempo.com <= 0.1.2 - Reflected Cross-Site Scripting
- ElementsReady Addons for Elementor <= 6.4.8 - Authenticated (Contributor+) Sensitive Information Exposure via Elementor Templates
- YITH WooCommerce Ajax Search <= 2.7.0 - Authenticated (Contributor+) Stored Cross-Site Scripting
- Consulting Elementor Widgets <= 1.3.0 - Authenticated (Contributor+) SQL Injection
- Ditty (formerly Ditty News Ticker) <= 3.0.14 - Reflected Cross-Site Scripting
- Tree Sitemap (Pages, Posts & Categories list) <= 2.9 - Missing Authorization to Arbitrary Plugin Installation/Activation
- Yahoo! WebPlayer <= 2.0.6 - Cross-Site Request Forgery to Stored Cross-Site Scripting
- Facturación Electrónica Costa Rica <= 2.0.4 - Cross-Site Request Forgery to Plugin Settings Update
- Annual Archive <= 1.5.5 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode
- Simply Schedule Appointments <= 1.6.8.30 - Authenticated (Contributor+) Stored Cross-Site Scripting via Multiple Shortcodes
- MetaMax <= 1.1.4 - Unauthenticated Local File Inclusion
- Contact Form 7 Widget For Elementor Page Builder & Gutenberg Blocks <= 1.1.5 - Cross-Site Request Forgery to Arbitrary Plugin Activation
- Page-list <= 6.2 - Missing Authorization to Authenticated (Contributor+) Sensitive Information Disclosure via Shortcode Attributes
- AppPresser <= 4.3.0 - Cross-Site Request Forgery via force_logging_off()
- CM Tooltip Glossary – Powerful Glossary Plugin <= 4.2.11 - Cross-Site Request Forgery
- Table Block by Tableberg <= 0.6.9 - Missing Authorization
- Team <= 1.2.6 - Authenticated (Contibutor+) Stored Cross-Site Scripting
- HTML5 jQuery Audio Player <= 2.6.2 - Cross-Site Scripting
- BizPrint <= 4.3.39 - Missing Authorization via showTemplatePreview()
- Food Drop <= 1.3 - Unauthenticated Local File Inclusion
- Ultimate Member 1.2.98 - 1.2.997 - Reflected Cross-Site Scripting
- Text Hover <= 4.1 - Admin+ Stored Cross-Site Scripting
- Korea SNS <= 1.7.0 - Authenticated (Author+) Stored Cross-Site Scripting
- Ocean Extra <= 2.1.2 - Authenticated (Subscriber+) Arbitrary Post Access
- Creative Blocks <= 1.0.1 - Authenticated (Contributor+) Stored Cross-Site Scripting
- Quiz and Survey Master <= 6.4.12 - Stored Cross-Site Scripting
- AI Engine <= 3.1.3 - Unauthenticated Sensitive Information Exposure to Privilege Escalation
- Front End Users <= 3.2.33 - Authenticated (Contributor+) Stored Cross-Site Scripting
- JS Help Desk – AI-Powered Support & Ticketing System < 3.1.4 - Authenticated (Subscriber+) Information Exposure
- Splashscreen <= 0.20 - Cross-Site Request Forgery
- Wp Login with Ajax <= 0.6 - Cross-Site Request Forgery to Stored Cross-Site Scripting
- WR Price List Manager For Woocommerce <= 1.0.8 - Authenticated (Subscriber+) Arbitrary File Upload
- radSLIDE <= 2.1 - Missing Authorization
- Crazy Bone <= 0.6.0 - Unauthenticated Stored Cross-Site Scripting
- System Dashboard <= 2.8.7 - Missing Authorization to Information Disclosure (sd_option_value)
- Essential Addons for Elementor <= 6.5.3 - Authenticated (Contributor+) Stored Cross-Site Scripting
- Stripe Payment Forms by WP Full Pay <= 8.5.1 - Missing Authorization
- Quartz <= 1.01.1 - SQL Injection
- wpDataTables - Tables & Table Charts (Premium) <= 6.3.2 - Missing Authorization to DataTable Access & Modification
- Broadcast Live Video – Live Streaming : WebRTC, HLS, RTSP, RTMP <= 6.2.4 - Cross-Site Request Forgery
- WordPress GDPR <= 2.0.2 - Missing Authorization to Unauthenticated Arbitrary User Deletion
- Apus Framework <= 2.4 - Authenticated (Subscriber+) Arbitrary Options Update in import_page_options
- ZIJ KART <= 1.1 - Unauthenticated Local File Inclusion
- Woffice Core <= 5.4.30 - Unauthenticated Insecure Direct Object Reference
- Classic Addons – WPBakery Page Builder <= 3.0 - Authenticated (Editor+) Local File Inclusion
- Extra Checkout Options (addon for Extra Product Options & Add-Ons for WooCommerce) <= 2.3.2 - Missing Authorization to Authenticated (Subscriber+) Arbitrary File Upload in eco_save_settings
- GD Rating System <= 2.3 - Cross-Site Scripting
- Find and Replace All <= 1.3 - Cross-Site Request Forgery to Reflected Cross-Site Scripting
- Royal Elementor Addons and Templates <= 1.7.1036 - Authenticated (Contributor+) Stored Cross-Site Scripting
- AdForest <= 5.1.6 - Privilege Escalation via Password Reset/Account Takeover
- Futurio Extra <= 1.6.2 - Authenticated (Admin+) SQL Injection
- Minimist <= 1.2.5 - Prototype Pollution
- Finalist (All Versions) - Cross-Site Scripting
- Slider by 10Web <= 1.2.35 - SQL Injection
- Brizy - Page Builder < 1.0.114 - Missing Authorization to Settings Update
- GiveWP – Donation Plugin and Fundraising Platform <= 3.6.1 -- Authenticated(Contributor+) Stored Cross-Site Scripting via Shortcode
- GlamChic <= 1.0.11 - Unauthenticated Local File Inclusion
- Post Duplicator <= 3.0.11 - Authorization Bypass to Authenticated (Contributor+) Post Duplication
- Essential Addons for Elementor Pro <= 5.4.8 - Unauthenticated Server-Side Request Forgery
- Asset CleanUp: Page Speed Booster <= 1.3.9.3 - Missing Authorization
- Exchange Addon Table Rate Shipping < 1.1.0 - Cross-Site Scripting
- Slider, Gallery, and Carousel by MetaSlider <= 3.111.0 - Authenticated (Author+) Stored Cross-Site Scripting via 'delay' Post Meta Setting
- Real Estate Manager Pro <= 12.7.3 - Reflected Cross-Site Scripting
- Contact Form 7 Style <= 3.2 - Cross-Site Request Forgery Bypass
- The Post Grid – Shortcode, Gutenberg Blocks and Elementor Addon for Post Grid <= 7.6.1 - Missing Authorization
- Ganohrs Toggle Shortcode <= 0.2.4 - Authenticated (Contributor+) Stored Cross-Site Scripting
- Reveal Template <= 3.7 - Unauthenticated Full Path Disclosure
- SSV MailChimp <= 3.1.5 - Unauthenticated Local File Inclusion
- Xagio SEO <= 7.1.0.30 - Authenticated (Subscriber+) Server-Side Request Forgery
- Subscribe To Comments Reloaded <= 220725 - Unauthenticated Sensitive Information Exposure
- ConvertBox Auto Embed WordPress plugin <= 1.0.19 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode
- amerisale-re (All Versions) - Arbitrary File Upload
- Location Weather <= 3.0.6 - Authenticated (Contributor+) Stored Cross-Site Scripting
- WPBruiser {no- Captcha anti-Spam} <= 3.1.43 - Unauthenticated PHP Object Injection
- Thumbnail carousel slider <= 1.0 - Cross-Site Request Forgery to Mass Slider Deletion
- Elizaibots <= 1.0.2 - Authenticated (Contributor+) Stored Cross-Site Scripting
- WP Docs <= 2.2.6 - Missing Authorization
- WP-Recall <= 16.26.14 - Missing Authorization
- Atarim <= 4.2.1 - Unauthenticated Information Exposure
- UsersWP <= 1.2.6 - Authenticated(Contributor+) Stored Cross-Site Scripting via Shortcode
- Automotive Listings <= 18.6 - Reflected Cross-Site Scripting
- Social Snap <= 1.3.5 - Missing Authorization
- Gravity Forms <= 3.1.0.4 - Unauthenticated Arbitrary File Upload via Hidden File Upload Field
- SQL Chart Builder < 2.3.8 - Unauthenticated SQL Injection
- WP-Lister Lite for Amazon <= 2.6.16 - Reflected Cross-Site Scripting
- iubenda < 2.3.5 - Failure to Restrict URL Protocol
- JupiterX Core <= 4.11.0 - Authenticated (Contributor+) Stored Cross-Site Scripting
- Matomo Analytics <= 5.1.0 - Cross-Site Request Forgery to Notice Dismissal
- File Manager Pro <= 8.3.7 - Authenticated (Subscriber+) Arbitrary File Upload