Vulnerability archive: section 12, page 15
Open a report to review affected versions, available fixes and original sources. Each report covers a specific issue; its presence does not establish whether your website is affected.
- TemplatesNext ToolKit <= 3.2.8 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode
- Relais 2FA <= 1.0 - Authentication Bypass
- Poll Maker – Best WordPress Poll Plugin <= 5.1.8 - Missing Authorization to Unauthenticated Stored Cross-Site Scripting
- Catch Breadcrumb <= 1.5.4 - Reflected Cross-Site Scripting
- WooCommerce Customers Manager < 30.1 - Cross-Site Request Forgery to Customer Deletion
- Data Tables Generator by Supsystic <= 1.9.91 - Cross-Site Request Forgery
- Scroll post excerpt <= 8.0 - Authenticated (Administrator+) Stored Cross-Site Scripting
- Geo Mashup <= 1.13.18 - Unauthenticated Stored Cross-Site Scripting
- Virtual Moderator <= 1.4 - Cross-Site Request Forgery
- weMail <= 1.14.13 - Unauthenticated Sensitive Information Exposure
- Broken Link Checker <= 1.11.8 - Reflected Cross-Site Scripting
- ThriveDesk <= 2.1.7 - Missing Authorization to Authenticated (Subscriber+) Cache Deletion
- Event List <= 2.0.4 - Authenticated (Subscriber+) Privilege Escalation
- SEO Plugin by Squirrly SEO <= 14.0.0 - Unauthenticated Arbitrary Post Creation and Stored Cross-Site Scripting via savePost()
- Frontend Admin by DynamiApps <= 3.25.17 - Reflected Cross-Site Scripting
- FV Flowplayer Video Player <= 1.2.11 - Cross-Site Scripting
- Easy Testimonials <= 3.9.5 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode
- WP-FormAssembly <= 2.0.10 - Authenticated (Contributor+) Stored Cross-Site Scripting
- ProfilePress <= 4.15.18 - Unauthenticated Content Restriction Bypass to Sensitive Information Exposure
- Kadence WooCommerce Email Designer <= 1.5.11 - Cross-Site Request Forgery
- Course Builder - Online Course WordPress Theme < 3.6.6 - Unauthenticated PHP Object Injection
- Manufaktur Solutions <= 1.1.1 - Unauthenticated PHP Object Injection
- Easy Registration Forms <= 2.1.1 - Cross-Site Request Forgery to Stored Cross-Site Scripting
- CityGov <= 1.9 - Unauthenticated Local File Inclusion
- s2Member Pro <= 241216 - Unauthenticated PHP Object Injection
- LatePoint – Calendar Booking Plugin for Appointments and Events <= 5.5.0 - Unauthenticated Stored Cross-Site Scripting
- WP Posts Re-order <= 1.0 - Cross-Site Request Forgery to Settings Update
- MStore API – Create Native Android & iOS Apps On The Cloud <= 4.18.4 - Missing Authorization
- Gift Cards For WooCommerce Pro <= 4.2.9 - Unauthenticated Arbitrary File Upload
- Booking for Appointments and Events Calendar - Amelia <= 2.4.5 - Missing Authorization to Unauthenticated Payment Bypass
- URL Shortener <= 3.0.7 - Unauthenticated Server-Side Request Forgery
- Animated Rotating Words <= 5.4 - Cross-Site Request Forgery via save_admin_options
- GoQMieruca <= 1.0.0 - Reflected Cross-Site Scripting
- WP Catalogue <= 1.7.6 - Authenticated (Contributor+) Stored Cross-Site Scripting via shortcode
- Subpages Extended <= 1.6.6 - Authenticated (Administrator+) Cross-Site Scripting
- Import XML and RSS Feeds <= 2.1.4 - Unauthenticated Remote Code Execution
- Mailchimp for WooCommerce <= 2.7 - Authenticated (Subscriber+) Server-Side Request Forgery
- WP eMember <= 10.6.5 - Reflected Cross-Site Scripting via 'editrecord'
- Royal WordPress Backup & Restore Plugin <= 1.0.16 - Reflected Cross-Site Scripting via 'wpr_pending_template' Parameter
- Metform Elementor Contact Form Builder <= 3.3.0 - Authenticated (Contributor+) Stored Cross-Site Scripting via mf_last_name shortcode
- Hustle – Email Marketing, Lead Generation, Optins, Popups <= 7.8.5 - Missing Authorization to Unpublished Form Exposure
- Sweet Energy Efficiency <= 1.0.6 - Missing Authorization to Authenticated (Subscriber+) Arbitrary Graph Deletion
- Download Monitor <= 1.6.3 - Directory Listing to Information Disclosure
- Master Slider <= 3.11.1 - Authenticated (Contributor+) Stored Cross-Site Scripting
- WP GoToWebinar <= 14.46 - Missing Authorization
- Simple Quotation <= 1.3.2 - Cross-Site Request Forgery
- Digital Marketing and Agency Templates Addons for Elementor <= 1.1.1 - Cross-Site Request Forgery to Import
- WP EasyCart <= 5.4.8 - Cross-Site Request Forgery via process_bulk_activate_product
- Optinly <= 1.0.18 - Missing Authorization
- Simple URLs <= 117 - Reflected Cross-Site Scripting via 'post_id'
- Ajax Load More <= 7.6.0.2 - Unauthenticated Sensitive Information Exposure
- wpDiscuz <= 7.6.15 - Authenticated (Author+) Stored Cross-Site Scripting via Uploaded Image Alternative Text
- Soundy Background Music <= 3.9 - Cross-Site Scripting
- Anywhere Flash Embed <= 1.0.5 - Authenticated (Contributor+) Stored Cross-Site Scripting
- DigitalOcean Spaces Sync <= 2.2.1 - Authenticated (Administrator+) Stored Cross-Site Scripting
- Isolved Talent Acquisition <= 1.3.9 - Reflected Cross-Site Scripting
- Cardealer <= 1.6.4 - Missing Authorization to Authenticated (Subscriber+) Change and Delete JS and CSS Files
- Automatic User Roles Switcher <= 1.1.1 - Missing Authorization to Privilege Escalation
- PeproDev Ultimate Invoice <= 2.0.0 - Missing Authorization
- Style Admin <= 1.4.3 - Cross-Site Request Forgery to Stored Cross-Site Scripting
- Lightbox < 1.6.8 - Stored Cross-Site Scripting
- Booking Calendar <= 11.7 - Missing Authorization
- Jigoshop – Store Toolkit <= 1.4.0 - Reflected Cross-Site Scripting
- Pay with Contact Form 7 <= 1.0.4 - Reflected Cross-Site Scripting
- Edit Password Protected 2.0.0 - 2.0.6 - Unauthenticated Access Mode Bypass
- WANotifier – Send Message Notifications Using WhatsApp API <= 2.6 - Authenticated (Admin+) Stored Cross-Site Scripting
- Theme Options Z <= 1.4 - Cross-Site Request Forgery
- ProfilePress 3.0 - 3.1.3 - Arbitrary File Upload
- Product Subtitle for WooCommerce <= 1.3.9 - Authenticated (Contributor+) Stored Cross-Site Scripting via htmlTag Parameter
- Portfolio – Filterable Masonry Portfolio Gallery for Professionals <= 1.2.2 - Authenticated (Contributor+) Stored Cross-Site Scripting
- Domain For Sale – Landing Page Per Domain, Domain Mapping, Offers & Listings <= 3.5.1 - Missing Authorization
- Express Checkout <= 2.4.8 - Unauthenticated Payment Bypass
- GenerateBlocks <= 1.3.5 - Authenticated (Contributor+) Stored Cross-Site Scripting
- SportsPress – Sports Club & League Manager <= 2.7.20 - Missing Authorization to Notice Dismissal
- Media Library Assistant <= 3.10 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode
- Integration for Contact Form 7 HubSpot <= 1.4.3 - Authenticated (Subscriber+) Information Exposure
- CodeAtoZ B2B Suite for WooCommerce < 1.6.1 - Unauthenticated Insecure Direct Object Reference
- Qode Essential Addons <= 1.5.2 - Missing Authorization to Authenticated (Subscriber+) Arbitrary Plugin Installation/Activation
- Auto Affiliate Links <= 6.8.8.3 - Missing Authorization
- AWP Classifieds <= 4.4.3 - Unauthenticated Information Exposure
- Service Box <= 1.9 - Authenticated (Contributor+) Stored Cross-Site Scripting
- Essential Addons for Elementor <= 6.0.7 - Authenticated (Contributor+) Stored Cross-Site Scripting
- DELUCKS SEO <= 2.5.9 - Missing Authorization
- WP eBay Product Feeds <= 3.4.8 - Authenticated (Contributor+) Server Side Request Forgery
- Email Subscribers & Newsletters <= 4.2.2 - Missing Authorization
- BBQ Pro <= 3.9 - Unauthenticated Stored Cross-Site Scripting
- Floating Button <= 6.0 - Cross-Site Request Forgery via process_bulk_action
- NIX Anti-Spam Light <= 0.0.4 - Cross-Site Request Forgery
- Single Mailchimp <= 1.4 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode Attributes
- WP Biographia <= 4.0.0 - Authenticated (Administrator+) Stored Cross-Site Scripting
- Ibtana – WordPress Website Builder <= 1.1.8.7 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode
- Woocommerce OpenPos <= 7.0.1 - Missing Authorization to Information Exposure
- WE – Testimonial Slider <= 1.5 - Authenticated (Contributor+) Stored Cross-Site Scripting
- Dynamic QR Code Generator <= 0.0.5 - Reflected Cross-Site Scripting
- Slimstat Analytics < 4.1.6.1 - Cross-Site Scripting
- Yaad Sarig Payment Gateway For WC <= 2.2.4 - Missing Authorization to Authenticated (Subscriber+) Log Read/Deletion
- tagDiv Composer < 4.0 - Reflected Cross-Site Scripting via ‘td_video_url’
- Leaflet Maps Marker Pro < 1.5.8 - Cross-Site Scripting
- Stockie Extra <= 1.2.11 - Unauthenticated Arbitrary Shortcode Execution
- LA-Studio Element Kit for Elementor <= 1.6.1 - Authenticated (Contributor+) Local File Inclusion via 'progress_type' Widget Setting