Vulnerability archive: section 11, page 25
Open a report to review affected versions, available fixes and original sources. Each report covers a specific issue; its presence does not establish whether your website is affected.
- Raise The Money <= 5.2 - Authenticated (Contributor+) Stored Cross-Site Scripting
- Smart Start <= 1.0.8 - Cross-Site Scripting
- Image optimization service by Optimole <= 4.1.0 - Insecure Direct Object Reference to Authenticated (Author+) Media Offload
- Popup Builder – Create highly converting, mobile friendly marketing popups. <= 4.4.1 - Authenticated (Contributor+) Stored Cross-Site Scripting
- Happy Addons for Elementor <= 3.20.7 - Authenticated (Contributor+) Stored Cross-Site Scripting via '_elementor_data' Meta Field
- TC Custom JavaScript <= 1.2.1 - Unauthenticated Stored Cross-Site Scripting
- Online Scheduling and Appointment Booking System <= 28.2 - Unauthenticated Authorization Bypass via PHP Type Juggling via 'verification_code' Parameter Type Juggling via json_data
- JetElements <= 2.6.20 - Authenticated (Contributor+) Arbitrary Local File Inclusion
- HUSKY – Products Filter for WooCommerce Professional <= 1.3.5.2 - Authenticated (Contributor+) SQL Injection
- FG Joomla to WordPress < 3.31.0 - Authenticated Stored Cross-Site Scripting
- Order Minimum/Maximum Amount Limits for WooCommerce <= 4.6.8 - Authenticated (Shop Manager+) Stored Cross-Site Scripting via Hide Add to Cart Content Fields
- Draw Attention <= 2.0.15 - Improper Access Control via register_cpt
- Disable Elementor Editor Translation <= 1.0.2 - Missing Authorization
- Wp Limits <= 1.0 - Cross-Site Request Forgery
- iControlWP <= 5.5.3 - Unauthenticated Privilege Escalation
- Chained Quiz <= 1.3.2 - Reflected Cross-Site Scripting via pointsf
- SiteOrigin Widgets Bundle <= 1.68.5 - Authenticated (Contributor+) Stored Cross-Site Scripting via `data-url` DOM Element Attribute
- RPB Chessboard <= 8.1.2 - Unauthenticated Stored Cross-Site Scripting via Comment Content
- Marketer Addons <= 1.0.1 - Authenticated (Contributor+) Stored Cross-Site Scripting
- WP Directory Kit <= 1.5.4 - Authenticated (Custom+) SQL Injection via 'data_fields_list' Parameter
- Backup, Restore and Migrate WordPress Sites With the XCloner Plugin <= 3.1.0 - Multiple Cross-Site Request Forgery
- ThemeIsle SDK <= Various Versions - Missing Authorization
- Social Discussions <= 6.1.1 - Remote File Inclusion and Full Path Disclosure
- Jetpackcrm Ext Woo Connect < 2.13 - Sensitive Information Exposure
- Booking and Rental Manager <= 2.3.8 - Missing Authorization
- WooCommerce Shipping & Tax <= 2.2.4 - Stored Cross-Site Scripting
- WP Dashboard Chat <= 1.0.3 - Authenticated (Contributor+) SQL Injection via id
- Ni WooCommerce Order Export <= 3.1.6 - Reflected Cross-Site Scripting
- Business Directory Plugin <= 6.4.3 - Authenticated (Author+) CSV Injection
- Post List Featured Image <= 0.5.9 - Authenticated (Contributor+) Stored Cross-Site Scripting
- Integration for HubSpot and Contact Form 7, WPForms, Elementor, Ninja Forms <= 1.3.7 - Unauthenticated PHP Object Injection
- WP-Recall <= 16.26.6 - Cross-Site Request Forgery
- Newsletter, SMTP, Email marketing and Subscribe forms by Sendinblue <= 3.1.39 - Cross-Site Scripting
- Bold Page Builder <= 4.7.6 - Authenticated (Contributor+) Stored Cross-Site Scripting via class
- Laika Pedigree Tree <= 1.4 - Cross-Site Request Forgery to Stored Cross-Site Scripting
- Advanced Woo Search <= 2.77 - Authenticated (Admin+) Stored Cross-Site Scripting
- Exclusive Addons for Elementor <= 2.7.9.8 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'exad_infobox_image'
- Church Admin <= 4.4.4 - Missing Authorization
- Royal Elementor Addons <= 1.7.1028 - Authenticated (Contributor+) Stored DOM-Based Cross-Site Scripting via Multiple Widgets
- Watu Quiz <= 3.3.8.1 - Reflected Cross-Site Scripting
- Simple Payment <= 2.5.1 - Unauthenticated Stored Cross-Site Scripting
- WP Yelp Review Slider <= 9.2 - Unauthenticated Stored Cross-Site Scripting via Yelp Review Text (imported via wpyelp_download_source)
- FormCraft <= 1.2.6 - Authenticated (Admin+) Stored Cross-Site Scripting
- Newspack Campaigns <= 2.31.1 - Authenticated (Contributor+) Stored Cross-Site Scripting
- Better Search <= 2.5.2 - Cross-Site Request Forgery to Settings Import
- Bitcoin / AltCoin Payment Gateway for WooCommerce <= 1.7.6 - Reflected Cross-Site Scripting
- Pay with Vipps and MobilePay for WooCommerce <= 6.2.0 - Authenticated (Shop Manager+) PHP Object Injection
- Houzez CRM <= 1.4.2 - Authenticated (Seller+) SQL Injection
- Secure Copy Content Protection and Content Locking <= 4.9.2 - Unauthenticated Sensitive Information Exposure via Exposed CSV Export File
- iFolders <= 1.5.0 - Authenticated (Administrator+) Stored Cross-Site Scripting
- CM Download Manager <= 2.8.5 - Authenticated (Administrator+) Arbitrary File Upload
- Be POPIA Compliant <= 1.2.0 - Authenticated (Subscriber+) SQL Injection
- Leaky Paywall <= 4.21.2 - Cross-Site Request Forgery
- Presto Player Pro <= 3.0.1 - Authenticated (Author+) Arbitrary File Deletion
- Premium Addons for Elementor <= 4.10.24 - Authenticated (Contributor+) Stored Cross-Site Scripting
- Razorpay Payment Button <= 2.4.6 - Reflected Cross-Site Scripting
- Activity Logs, User Activity Tracking, Multisite Activity Log from Logtivity <= 3.3.6 - Unauthenticated Information Disclosure via REST API
- WP Ultimate CSV Importer – WordPress CSV, XML & Excel Import Export <= 9.2 - Authenticated (Administrator+) SQL Injection
- Shortcodes Blocks Creator Ultimate <= 2.2.0 - Reflected Cross-Site Scripting via _wpnonce
- Query Wrangler <= 1.5.57 - Authenticated (Subscriber+) Remote Code Execution via 'options' Parameter
- Geo Content <= 6.0 - Authenticated (Contributor+) Stored Cross-Site Scripting
- Balkon <= 1.3.2 - Reflected Cross-Site Scripting
- Login Lockdown – Protect Login Form <= 2.06 - Authenticated(Administrator+) SQL Injection
- Featured Image Thumbnail Grid <= 6.8 - Authenticated (Contributor+) Stored Cross-Site Scripting
- MyMedi < 1.7.7 - Reflected Cross-Site Scripting
- VOD Infomaniak <= 1.5.6 - Reflected Cross-Site Scripting
- Logo Manager For Samandehi <= 0.5 - Cross-Site Request Forgery
- Pay With Tweet <= 1.1 - Cross-Site Scripting
- WP Shamsi <= 4.3.3 - Missing Authorization leading to Authenticated (Subscriber+) Attachment Deletion
- Feedify – Web Push Notifications <= 2.4.5 - Reflected Cross-Site Scripting
- Performance Monitor <= 1.0.6 - Unauthenticated Server-Side Request Forgery via 'url' Parameter
- UpDownUpDown <= 1.1 - Cross-Site Request Forgery to Stored Cross-Site Scripting
- Include Me <= 1.3.2 - Authenticated (Administrator+) Stored Cross-Site Scripting
- LatePoint – Calendar Booking Plugin for Appointments and Events <= 5.2.6 - Authenticated (Subscriber+) Insecure Direct Object Reference
- Smash Balloon Social Photo Feed <= 6.11.3 - Reflected Cross-Site Scripting via REQUEST_URI Query String
- WP Dummy Content Generator <= 4.0.0 - Missing Authorization
- WP微信机器人 <= 5.3.5 - Cross-Site Request Forgery to Stored Cross-Site Scripting
- Drag and Drop Multiple File Upload PRO - Contact Form 7 Standard <= 5.0.6.3 and <= 2.11.0 - Reflected Cross-Site Scripting
- Google Font Fix <= 2.3.1 - Reflected Cross-Site Scripting
- Limit Bio <= 1.0 - Reflected Cross-Site Scripting
- Classified Listing <= 5.3.8 - Insecure Direct Object Reference to Authenticated (Subscriber+) Receipt Disclosure
- Book Previewer for Woocommerce <= 1.0.6 - Missing Authorization
- Print-O-Matic <= 2.1.10 - Authenticated (Contributor+) Stored Cross-Site Scripting
- Website LLMs.txt <= 8.2.6 - Reflected Cross-Site Scripting
- Google Analytics MU < 2.4 - Cross-Site Request Forgery
- Reviewify <= 1.0.7 - Missing Authorization to Authenticated (Contributor+) Arbitrary WooCommerce Coupon Creation
- Plugin Inspector <= 1.5 - Authenticated (Admin+) Arbitrary File Download
- Hermit 音乐播放器 <= 3.1.6 - Cross-Site Request Forgery to Stored Cross-Site Scripting
- The Plus Addons for Elementor – Addons for Elementor, Page Templates, Widgets, Mega Menu, WooCommerce <= 6.4.9 - Authenticated (Contributor+) Stored Cross-Site Scripting via Progress Bar
- Visitor Traffic Real Time Statistics <= 2.11 - Missing Authorization to Arbitrary Plugin Installation/Activation
- Elementor Addons, Widgets and Enhancements – Stax <= 1.5.0 - Authenticated (Contributor+) Stored Cross-Site Scripting
- JAY Login & Register <= 2.6.03 - Unauthenticated Privilege Escalation via jay_login_register_ajax_create_final_user
- Info Cards – Gutenberg block for creating Beautiful Cards <= 1.0.5 - Authenticated (Contributor+) Stored Cross-Site Scripting
- WooCommerce Customers Manager <= 29.6 - Authenticated (Subscriber+) SQL Injection
- WP Taxonomy Import <= 1.0.5 - Reflected Cross-Site Scripting
- Court Reservation <= 1.10.8 - Reflected Cross-Site Scripting
- Ibtana <= 1.2.4.9 - Authenticated (Contributor+) Stored Cross-Site Scripting
- Master Slider <= 2.7.1 - Cross-Site Scripting
- Royal Elementor Addons <= 1.3.59 - Insufficient Access Control to Import Deletion
- Frontend File Manager <= 21.5 - Missing Authorization to Unauthenticated Arbitrary Post Deletion