Vulnerability archive: section 11, page 7
Open a report to review affected versions, available fixes and original sources. Each report covers a specific issue; its presence does not establish whether your website is affected.
- Yatra <= 2.1.14 - Authenticated (Administrator+) Stored Cross-Site Scripting
- Easy Automatic Newsletter Lite <= 3.2.0 - Reflected Cross-Site Scripting
- History Log by click5 <= 1.0.13 - Unauthenticated SQL Injection
- RAphicon <= 2.1.2 - Authenticated (Contributor+) Stored Cross-Site Scripting
- WPForms <= 1.10.2 - Improper Neutralization of CRLF Sequences to Unauthenticated Email Header Injection via Reply-To Display Name
- AP Pricing Tables Lite <= 1.1.6 - Authenticated (Admin+) SQL Injection
- GigPress <= 2.3.10 - Reflected Cross-Site Scripting
- WooCommerce Bookings <= 2.0.3 - Cross-Site Request Forgery
- Fleet Manager <= 2.5.1 - Authenticated (Editor+) Stored Cross-Site Scripting
- Custom Posts Order <= 4.4 - Cross-Site Request Forgery to Stored Cross-Site Scripting
- weDocs <= 2.1.16 - Missing Authorization to Authenticated (Subscriber+) Documentation Post Update
- Slider Hero <= 8.6.1 - Authenticated (Administrator+) Stored Cross-Site Scripting
- Noptin <= 3.8.7 - Authenticated (Administrator+) Stored Cross-Site Scripting
- XV Random Quotes <= 1.41 - Reflected Cross-Site Scripting
- Revamp CRM for WooCommerce < 1.0.4 - Local File Inclusion
- PagBank / PagSeguro Connect para WooCommerce <= 4.44.3 - Authenticated (Shop Manager+) SQL Injection
- Anything Order by Terms <= 1.4.0 - Missing Authorization
- WPDM – Premium Packages <= 6.0.2 - Cross-Site Request Forgery
- WP Google Review Slider <= 18.0 - Unauthenticated Stored Cross-Site Scripting
- Chained Quiz <= 1.3.2 - Reflected Cross-Site Scripting via ipf
- Fresh Framework <= 1.70.0 - Unauthenticated Remote Code Execution
- MF Gig Calendar <=1.2.1 - Authenticated(Contributor+) SQL Injection
- Eventin <= 4.1.23 - Authenticated (Custom+) Stored Cross-Site Scripting via 'etn_shedule_objective' schedule_slot Parameter
- Visualizer – Tables & Charts Manager with Built-in AI Generator <= 4.0.1 - Authenticated (Contributor+) SQL Injection
- Fast Video and Image Display <= 2.5.2 - Authenticated (Contributor+) Stored Cross-Site Scripting
- Another Events Calendar <= 1.7.0 - Reflected Cross-Site Scripting
- Estatebud – Properties & Listings <= 5.5.0 - Cross-Site Request Forgery to Stored Cross-Site Scripting
- Rich Reviews by Starfish <= 1.9.14 - Cross-Site Request Forgery
- Simple Table Manager <= 1.5.6 - Authenticated(Administrator+) Stored Cross-Site Scripting
- Wappointment <=2.7.2 - Missing Authorization
- Appointment Booking Calendar <= 1.3.69 - Missing Authorization
- Divi Booster < 5.0.2 - Unauthenticated PHP Object Injection
- MasterStudy LMS WordPress Plugin – for Online Courses and Education <= 3.7.52 - Authenticated (Contributor+) Stored Cross-Site Scripting
- Web Push Notifications <= 4.39.0 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'webpushr_notification_title' Post Meta Parameter
- Free Follow-Up Emails & Marketing Automation for WooCommerce – ShopMagic <= 4.5.6 - Unauthenticated Information Exposure
- Basic Log Viewer <= 1.0.4 - Cross-Site Request Forgery via wpst_lw_viewer
- Enter Addons <= 2.3.2 - Cross-Site Request Forgery
- Emailchef <= 3.5.1 - Missing Authorization to Authenticated (Subscriber+) Arbitrary Plugin Settings Deletion
- Aruba HiSpeed Cache <= 2.0.6 - Sensitive Information Exposure via Log File
- GDPR-Extensions-com – Consent Manager <= 1.0.0 - Authenticated (Author+) Stored Cross-Site Scripting via SVG File Upload
- RepairBuddy – Repair Shop CRM & Booking Plugin for WordPress <= 4.1121 - Missing Authorization
- Twitter Bootstrap Collapse aka Accordian Shortcode <= 1.0 - Authenticated (Contributor+) Stored Cross-Site Scripting
- Frontend File Manager <= 23.4 - Authenticated (Subscriber+) Arbitrary File Deletion
- Forminator Forms – Contact Form, Payment Form & Custom Form Builder <= 1.35.1 - Cross-Site Request Forgery to Draft Custom Form Creation
- SEO Plugin by Squirrly SEO <= 12.1.10 - Authenticated (Contributor+) Arbitrary File Upload
- Booking calendar, Appointment Booking System <= 3.2.15 - Unauthenticated Stored Cross-Site Scripting via SVG File Upload
- Coming Soon Page & Maintenance Mode <= 1.8.1 - Unauthenticated Settings Reset
- Web and WooCommerce Addons for WPBakery Builder <= 1.4.5 - Missing Authorization to Authenticated (Subscriber+) Plugin Settings Modification
- Really Simple Guest Post <= 1.0.6 - Local File Inclusion
- wpForo Forum <= 3.1.5 - Missing Authorization to Authenticated (Subscriber+) Guest Post Takeover via wpforo_post_edit Action / Forged comment_author_email Cookie
- Helpful <= 4.4.58 - Admin+ Stored Cross-Site Scripting
- Autolinks <= 1.0.1 - Cross-Site Request Forgery to Cross-Site Scripting
- AcuGIS Leaflet Maps <= 5.1.1.0 - Unauthenticated Stored Cross-Site Scripting
- BuddyPress <= 11.3.1 - Authenticated (Contributor+) Stored Cross-Site Scripting
- StudioZen <= 1.6 - Multiple Vulnerabilities
- Envo Extra <= 1.8.16 - Authenticated (Contributor+) Cross-Site Scripting
- Plugin Permalink <= 2.4.3.1 - Missing Authorization via get_uri_editor
- Neo Ocular < 1.2 - Unauthenticated Local File Inclusion
- Elementor Addon Elements <= 1.13.3 - Authenticated (Contributor+) Stored Cross-Site Scripting
- WP Google Map Plugin < 3.0.0 - Cross-Site Request Forgery to Cross-Site Scripting
- Contact Form Widget <= 1.4.2 - Cross-Site Request Forgery
- BetterDocs <= 4.6.0 - Authenticated (Custom+) SQL Injection via 'lang' Parameter
- Woo superb slideshow transition gallery with random effect <= 9.1 - Authenticated (Contributor+) SQL Injection
- HBook <= 2.1.9 - Unauthenticated Stored Cross-Site Scripting via Multiple Parameters
- WPCafe <= 2.2.27 - Authenticated (Contributor+) Local File Inclusion
- Metronet Tag Manager < 1.2.9 - Cross-Site Request Forgery
- Magical Addons For Elementor <= 1.1.41 - Authenticated (Subscriber+) Server-Side Request Forgery
- All 404 Redirect to Homepage & Broken images Redirection <= 2.0 - Cross-Site Scripting
- Memberful – Membership Plugin <= 1.81.0 - Cross-Site Request Forgery
- Skillate <= 1.2.10 - Reflected Cross-Site Scripting
- DMSGuestbook <= 1.8.0 - Directory Traversal
- Wholesale Suite <= 2.1.5 - Missing Authorization to Plugin Settings Change
- Booster for WooCommerce 4.0.1 - 7.2.4 - Unauthenticated Stored Cross-Site Scripting
- Credova_Financial <= 2.5.0 - Cross-Site Request Forgery
- Redux Framework <= 4.5.12 - Authenticated (Subscriber+) Privilege Escalation
- Stackable – Page Builder Gutenberg Blocks <= 3.12.11 - Authenticated(Contributor+) Stored Cross-Site Scripting via Posts Block
- Show/Hide Shortcode <= 1.0.0 - Authenticated (Contributor+) Stored Cross-Site Scripting
- Modern Events Calendar <= 7.12.1 - Authenticated (Subscriber+) Server Side Request Forgery
- Offload, AI & Optimize with Cloudflare Images <= 1.10.2 - Authenticated (Author+) Remote Code Execution via 'api-key' / 'account-id' Parameters in cf_images_do_setup AJAX Action
- Soleng <= 1.0.5 - Unauthenticated Local File Inclusion
- Namaste! LMS <= 2.5.9.3 - Authenticated (Admin+) Stored Cross-Site Scripting
- WCFM Membership <= 2.9.10 - Cross-Site Request Forgery
- QA Analytics <= 4.1.1.1 - Missing Authorization to Unauthenticated Settings Update
- LA-Studio Element Kit for Elementor <= 1.5.6.3 - Unauthenticated Privilege Escalation via Backdoor to Administrative User Creation via lakit_bkrole parameter
- Kaswara Modern VC Addons <= 3.0.1 - Arbitrary File Upload
- Paid Videochat Turnkey Site – HTML5 PPV Live Webcams <= 7.5.12 - Missing Authorization
- RSSImport <= 4.6.1 - Authenticated (Contributor+) Stored Cross-Site Scripting via shortcode
- Penci Podcast <= 1.7 - Authenticated (Contributor+) Stored Cross-Site Scripting
- Contest Gallery <= 13.1.0.9 - Cross-Site Scripting
- Lottier for Elementor <= 1.0.9 - Missing Authorization
- Ripe HD FLV <= 1.1 - Full Path Disclosure
- WC Builder <= 1.2.0 - Authenticated (Contributor+) Stored Cross-Site Scripting
- Simple Link Directory <= 8.8.3 - Cross-Site Request Forgery
- MathJax-LaTeX < 1.2 - Cross-Site Request Forgery
- Page Builder by SiteOrigin <= 2.10.15 - Cross-Site Request Forgery to Reflected Cross-Site Scripting
- Antispam Bee <= 2.11.3 - IP Address Spoofing via get_client_ip
- KuteShop <= 4.2.9 - Unauthenticated Local File Inclusion
- Image Gallery with Slideshow <= 1.5.2 - SQL Injection via gallery_name
- Happy Addons for Elementor <= 3.20.3 - Authenticated (Contributor+) Stored Cross-Site Scripting via Custom JS
- Integration for Contact Form 7 and Zoho CRM, Bigin <= 1.2.2 - Cross-Site Request Forgery via settings_page function