Vulnerability archive: section 12, page 1
Open a report to review affected versions, available fixes and original sources. Each report covers a specific issue; its presence does not establish whether your website is affected.
- EKC Tournament Manager <= 2.2.1 - Authenticated (Admin+) Arbitrary File Download
- Five Star Restaurant Reservations – WordPress Booking Plugin < 2.7.23 - Missing Authorization
- LearnPress <= 4.4.10 - Missing Authorization to Authenticated (Subscriber+) Email Address Enumeration via 'search-authors' AJAX Action
- Spirit Framework <= 1.2.14 - Authentication Bypass to Account Takeover and Privilege Escalation
- Custom Field Template <= 2.6.5 - Authenticated (Contributor+) Stored Cross-Site Scripting
- Video Widget <= 1.2.3 - Authenticated (Admin+) Stored Cross-Site Scripting
- Essential Addons for Elementor <= 5.7.1 - Unauthenticated Arbitrary Password Reset to Privilege Escalation
- AWP Classifieds <= 4.4.7 - Missing Authorization
- Testimonial Slider <= 2.3.6 - Missing Authorization to Authenticated (Author+) Settings Update
- Bootstrap Shortcodes Ultimate <= 4.3.1 - Authenticated (Contributor+) Stored Cross-Site Scripting
- News & Blog Designer Pack <= 4.0 - Unauthenticated Local File Inclusion
- Group Chat & Video Chat by AtomChat <= 1.1.7 - Missing Authorization to Authenticated (Subscriber+) Plugin Options Update
- Compress <= 6.60.28 - Missing Authorization
- Custom Query Blocks <= 5.5.0 - Authenticated (Contributor+) Stored Cross-Site Scripting
- Opensea <= 1.0.2 - Cross-Site Scripting
- tarteaucitron.js – Cookies legislation & GDPR (WordPress plugin) <= 1.6 - Cross-Site Scripting
- Wp Ultimate Review <= 2.0.3 - Authenticated (Administrator+) Stored Cross-Site Scripting
- Maintenance Mode <= 3.0.1 - Information Exposure
- JetBlog <= 2.4.10 - Unauthenticated Stored Cross-Site Scripting
- Contact Manager <= 8.6.5 - Authenticated (Administrator+) Stored Cross-Site Scripting via 'title'
- Kallyas <= 4.22.0 - Authenticated (Contributor+) Stored Cross-Site Scripting
- Prime Slider – Addons For Elementor (Revolution of a slider, Hero Slider, Ecommerce Slider) <= 3.14.3 - Authenticated (Contributor+) Stored Cross-Site Scripting
- Browser Sniff <= 2.3 - Cross-Site Request Forgery to Stored Cross-Site Scripting
- Booking Calendar <= 8.9.1 - Reflected Cross-Site Scripting
- PictPress <= 0.91 - Directory Traversal
- User Private Files <= 2.1.0 - Insecure Direct Object Reference to Authenticated (Subscriber+) Private File Access
- SendPress Newsletters <= 1.26.1.20 - Missing Authorization
- WPeMatico RSS Feed Fetcher <= 2.8.26 - Authenticated (Contributor+) Privilege Escalation
- Slider by 10Web – Responsive Image Slider <= 1.2.62 - Authenticated (Contributor+) PHP Object Injection
- Implied Cookie Consent <= 1.3 - Reflected Cross-Site Scripting
- WPC Shop as a Customer for WooCommerce <= 1.2.6 - Authenticated (Subscriber+) PHP Object Injection
- Friends <= 3.2.1 - Missing Authorization
- Precious Metals Automated Product Pricing – Pro <= 4.1.2 - Missing Authorization
- LifterLMS – WP LMS for eLearning, Online Courses, & Quizzes - Various Versions - Authenticated (Student+) Privilege Escalation
- 多合一搜索自动推送管理插件-支持Baidu/Google/Bing/IndexNow/Yandex/头条 <= 4.2.5 - Cross-Site Request Forgery
- Newsletter Manager <= 1.5.1 - Insecure Deserialization
- Directorist <= 7.7.1 - CSV Injection
- Stop Spammers Classic <= 2026.3 - Unauthenticated Stored Cross-Site Scripting
- Livemesh Addons for WPBakery Page Builder <= 3.5 - Authenticated (Contributor+) Stored Cross-Site Scripting
- Edwiser Bridge <= 3.0.2 - Authenticated (Administrator+) SQL Injection
- Passster <= 4.2.6.4 - Authenticated (Contributor+) Stored Cross-Site Scripting via content_protector Shortcode
- Blog Designer PRO <= 3.4.8 - Missing Authorization
- Notification for Telegram <= 3.5.1 - Cross-Site Request Forgery
- Blocksy <= 2.1.41 - Authenticated (Contributor+) PHP Object Injection via Deserialization of Untrusted Data via 'blocksy_meta' REST API Field
- Naver Syndication V2 <= 0.8.3 - Cross-Site Request Forgery to Stored Cross-Site Scripting
- Rank Math SEO – AI SEO Tools to Dominate SEO Rankings <= 1.0.228 - Missing Authorization to Unauthenticated User and Term Metadata Insert, Update, and Delete
- Frontend Post Submission Manager Lite <= 1.3.4 - Unauthenticated Stored DOM-Based Cross-Site Scripting via post_content Parameter (data-label DOM Sink)
- Website Builder by SeedProd <= 6.15.13.1 - Cross-Site Request Forgery to Settings Update
- Related Posts, Inline Related Posts, Contextual Related Posts, Related Content By PickPlugins <= 2.0.59 - Cross-Site Request Forgery to Stored Cross-Site Scripting
- eCommerce Product Catalog <= 3.0.38 Reflected Cross-Site Scripting
- Account Manager for WooCommerce <= 2.1.1 - Missing Authorization
- Shortcodes Ultimate <= 5.12.0 - Cross-Site Request Forgery
- kk Star Ratings – Rate Post & Collect User Feedbacks <= 5.4.10 - Unauthenticated Arbitrary Shortcode Execution
- Calculated Fields Form <= 1.2.28 - Authenticated (Contributor+) Open Redirect via Shortcode
- Top 10 – Popular posts plugin for WordPress <= 3.2.3 - Missing Authorization on tptn_ajax_clearcache
- Beam me up Scotty – Back to Top Button <= 1.0.23 - Authenticated (Administrator+) Stored Cross-Site Scripting
- Shortcodes Blocks Creator Ultimate <= 2.2.0 - Reflected Cross-Site Scripting via 'page'
- Myriad <= 2.0 - Arbitrary File Deletion
- WordPress Core <= 7.1 - HTML API set_modifiable_text() Comment Boundary Break
- Formula <= 0.5.1 - Reflected Cross-Site Scripting via quality_customizer_notify_dismiss_action
- Contact Form Maker <= 1.13.23 - Authenticated (Administrator+) SQL Injection
- MapPress Maps for WordPress <= 2.88.15 - Insufficient Authorization to Information Disclosure
- Puca <= 2.6.39 - Authenticated (Contributor+) Local File Inclusion
- SureForms <= 2.2.0 - Unauthenticated Stored Cross-Site Scripting
- WP Best Quiz <= 1.0 - Authenticated (Author+) Stored Cross-Site Scripting
- Ultimate Addons for Contact Form 7 <= 3.1.0 - Reflected Cross-Site Scripting via 'page'
- PopupKit <= 2.1.5 - Authenticated (Subscriber+) SQL Injection
- Latest Registered Users <= 1.4 - Missing Authorization to Unauthenticated Sensitive Information Exposure via User Data Export
- Download Manager <= 3.1.17 - Missing Authorization
- CT Commerce <= 2.0.1 - Authenticated (Administrator+) Stored Cross-Site Scripting via admin settings
- Locker Content <= 1.0.0 - Unauthenticated Information Exposure
- En Masse <= 1.0 - Reflected Cross-Site Scripting
- Booking for Appointments and Events Calendar – Amelia (Premium) <= 2.4.4 - Authenticated (Custom+) Missing Authorization to Limited Account Takeover
- Abelle <= 1.22 - Unauthenticated PHP Object Injection
- Eventin 4.0.26 - 4.1.15 - Missing Authorization to Unauthenticated Payment Bypass via REST API
- Business Directory Plugin – Easy Listing Directories for WordPress <= 6.4.22 - Unauthenticated Stored Cross-Site Scripting
- WooCommerce Parcelas <= 1.3.5 - Authenticated (Shop manager+) Stored Cross-Site Scripting
- Free Booking Plugin for Hotels, Restaurant and Car Rental – eaSYNC <= 1.1.15 - Arbitrary File Upload
- ACF Quick Edit Fields <= 3.2.2 - Authenticated (Contributor+) Insecure Direct Object Reference
- Wholesale Market for WooCommerce <= 1.0.7 - Authenticated (Administrator+) Arbitrary File Download
- Give Tributes <= 2.3.1 - Unauthenticated PHP Object Injection via 'give_tributes_ecard_notify[recipient][personalized][]' Parameter
- Proof Factor – Social Proof Notifications <= 1.0.5 - Authenticated (Administrator+) Stored Cross-Site Scripting
- IndieAuth <= 4.5.4 - Cross-Site Request Forgery to Account Takeover via Stolen OAuth Tokens
- Duplicator <= 1.5.17 and Duplicator Pro <= 4.6.10 - Unauthenticated PHP Object Injection
- Manual Image Crop < 1.15 - Authenticated (Subscriber+) Insecure Direct Object Reference
- Ortto <= 1.0.19 - Reflected Cross-Site Scripting
- Mixcloud Embed <= 2.2.0 - Authenticated (Contributor+) Stored Cross-Site Scripting
- Gravity Forms <= 2.10.4 - Unauthenticated Arbitrary File Read via 'gform_uploaded_files' Parameter
- Aruba HiSpeed Cache <= 2.0.12 - Missing Authorization
- SendPress Newsletters <= 1.26.1.20 - Unauthenticated SQL Injection
- Quietly Insights <= 1.2.2 - Missing Authorization to Authenticated (Subscriber+) Arbitrary Options Update
- Motors <= 1.4.71 - Unauthenticated Local File Inclusion
- WpTravelly <= 1.7.7 - Missing Authorization
- Gallerio <= 1.0.1 - Reflected Cross-Site Scripting
- RepairBuddy – Repair Shop CRM & Booking Plugin for WordPress <= 4.1226 - Authenticated (Subscriber+) Information Exposure
- WP Funnel Manager <= 1.4.0 - Unauthenticated PHP Object Injection
- Invelity SPS connect <= 1.0.8 - Reflected Cross-Site Scripting
- Comments Evolved for WordPress <= 1.6.3 - Authenticated (Administrator+) Stored Cross-Site Scripting
- TableOn <= 1.0.4.2 - Reflected Cross-Site Scripting
- Embedder 1.3 - 1.3.5 - Authenticated (Subscriber+) Arbitrary Options Update