Vulnerability archive: section 12, page 16
Open a report to review affected versions, available fixes and original sources. Each report covers a specific issue; its presence does not establish whether your website is affected.
- Parallax Section Block – Add Parallax Scrolling Effects to Sections <= 2.0.4 - Unauthenticated Stored Cross-Site Scripting
- Outdoor <= 1.3.2 - Unauthenticated SQL Injection
- Stratum <= 1.3.15 - Authenticated (Contributor+) Stored Cross-Site Scripting
- Ultimate Member <= 2.13.0 - Unauthenticated Stored Cross-Site Scripting
- Wbcom Designs Plugins (Various Versions) - Arbitrary Plugin Installation, Activation and Deactivation
- Advance Product Search- Voice & Ajax Search for WooCommerce <= 1.4.4 - Unauthenticated SQL Injection
- Pdf Embedder Fay <= 1.10.1 - Authenticated (Contributor+) Stored Cross-Site Scripting
- SEO Links Interlinking <= 1.7.9.9.1 - Reflected Cross-Site Scripting via 'google_error' Parameter
- Simple Statistics for Feeds <= 20250322 - Cross-Site Request Forgery
- WordPress SEO Friendly Accordion FAQ with AI assisted content generation <= 2.2.1 - Authenticated (Contributor+) Stored Cross-Site Scripting
- Zotpress <= 7.3.7 - Authenticated (Contributor+) SQL Injection
- LayoutBoxx <= 0.3.1 - Unauthenticated Arbitrary Shortcode Execution
- Advanced Database Cleaner <= 3.1.2 - Authenticated (Administrator+) SQL Injection
- WPC Shop as a Customer for WooCommerce <= 2.0.0 - Authenticated (Subscriber+) Privilege Escalation via Missing Role Check on Target User to wpcsa_login AJAX Endpoint
- Advanced Booking Calendar <= 1.7.1 - Cross Site Request Forgery
- Legal Pages <= 1.4.6 - Missing Authorization
- iNET Webkit <= 1.2.2 - Missing Authorization
- BEAR – Bulk Editor and Products Manager Professional for WooCommerce by Pluginus.Net <= 1.1.8 - Unauthenticated Stored Cross-Site Scripting
- Side Slide Responsive Menu <= 1.0 - Cross-Site Request Forgery to Stored Cross-Site Scripting
- wp-forecast <= 9.2 - Authenticated (Contributor+) Stored Cross-Site Scripting
- EventON - WordPress Virtual Event Calendar Plugin <= 4.5.4 (Pro) & <= 2.2.8 (Free) - Cross-Site Request Forgery via save_virtual_event_settings
- GiveWP <= 2.17.2 - Reflected Cross-Site Scripting
- Grimag <= 1.1.0 - Open Redirection
- WCFM Membership – WooCommerce Memberships for Multivendor Marketplace <= 2.11.11 - Authenticated (Subscriber+) Privilege Escalation
- LA-Studio Element Kit for Elementor <= 1.6.2 - Cross-Site Request Forgery
- Sticky Header On Scroll <= 1.0 - Missing Authorization
- Reprizo <= 1.0.8 - Unauthenticated Local File Inclusion
- Advanced Classifieds & Directory Pro <= 3.1.3 - Authenticated (Contributor+) Local File Inclusion
- Smart Framework <= Multiple Plugins - Authenticated (Subscriber+) Arbitrary File Upload
- KeyWord Collector <= 1.4 - Unauthenticated Stored Cross-Site Scripting
- phZoom <= 1.2.92 - Cross-Site Request Forgery to Stored Cross-Site Scripting
- Additional Variation Images Gallery for WooCommerce <= 1.1.28 - Authenticated Stored Cross-Site Scripting
- Advanced XML Reader <= 0.3.4 - External Entity Injection
- eShop <= 6.3.14 - Multiple Cross-Site Scripting
- Houzez Theme - Functionality <= 4.1.2 - Missing Authorization
- Links/Problem Reporter <= 2.6.0 - Authenticated (Contributor+) Stored Cross-Site Scripting
- Eventer <= 3.9.9 - Missing Authorization to Authenticated (Subscriber+) Bookings Export
- VW Portfolio <= 1.3.3 - Missing Authorization
- Float Payment Gateway <= 1.1.9 - Improper Authorization to Unauthenticated Order Status Manipulation
- Bit File Manager <= 4.1.4 - Cross-Site Request Forgery to Arbitrary File Upload
- Duplicator < 1.3.0 - Unauthenticated Remote Code Execution
- GravityWP - Merge Tags <= 1.4.4 - Unauthenticated Local File Inclusion
- Speed Optimizer <= 7.4.6 - Missing Authorization via purge_on_other_events()
- Virtue Premium <= 4.10.21 - Authenticated (Contributor+) Stored Cross-Site Scripting
- SaasPricing <= 1.2.4 - Authenticated (Contributor+) Stored Cross-Site Scripting
- Samex - Clean, Minimal Shop WooCommerce WordPress <= 2.5 - Reflected Cross-Site Scripting
- Premium Addons PRO <= 2.9.12 - Authenticated (Contributor+) Stored Cross-Site Scripting via Global Badge Module
- Press3D <= 1.0.2 - Authenticated (Author+) Stored Cross-Site Scripting via Link URL Parameter in 3D Model Block
- Stripe Payment Forms by WP Full Pay – Accept Credit Card Payments, Donations & Subscriptions <= 8.5.6 - Missing Authorization
- Gestion de tarifs <= 1.4 - Authenticated (Contributor+) SQL Injection
- WP-GraphViz <= 1.5.1 - Authenticated (Contributor+) Stored Cross-Site Scripting
- QMean – WordPress Did You Mean and Search Suggestion Like Google <= 2.0 - Reflected Cross-Site Scripting
- ColorMag <= 3.1.2 - Missing Authorization to Arbitrary Plugin Installation
- Improved Sale Badges – Free Version <= 1.0.1 - Authenticated (Subscriber+) Local File Inclusion
- FileBird – WordPress Media Library Folders & File Manager <= 5.6.3 - Authenticated (Author+) Insecure Direct Object Reference
- Kirki – Freeform Page Builder, Website Builder & Customizer <= 6.2.0 - Missing Authorization
- Virtual Bot <= 1.0.0 - Cross-Site Request Forgery to Stored Cross-Site Scripting
- PublishPress Authors <= 4.7.3 - Authenticated (Administrator+) SQL Injection
- WC Vendors – WooCommerce Multivendor, WooCommerce Marketplace, Product Vendors < 2.7.2.1 - Cross-Site Request Forgery
- Code Snippets <= 2.13.3 - Cross-Site Request Forgery to Remote Code Execution
- Responsive Lightbox & Gallery <= 2.7.1 - Authenticated (Author+) Server-Side Request Forgery via Remote Library Image Upload
- JetFormBuilder — Dynamic Blocks Form Builder <= 3.6.5.4 - Unauthenticated Stored Cross-Site Scripting
- Windows Live Writer <= 0.1 - Cross-Site Request Forgery to Stored Cross-Site Scripting
- Cost Calculator Builder <= 3.2.12 - Authenticated (Administrator+) Stored Cross-Site Scripting
- Wallet System for WooCommerce <= 2.6.8 - Reflected Cross-Site Scripting
- Cargo Shipping Location for WooCommerce <= 5.6 - Unauthenticated SQL Injection
- Posts List Designer by Category – List Category Posts Or Recent Posts <= 3.3.2 - Authenticated (Contributor+) Stored Cross-Site Scripting
- WP GoToWebinar <= 14.45 - Authenticated (Administrator+) Stored Cross-Site Scripting via settings
- KiviCare – Clinic & Patient Management System (EHR) <= 3.6.4 - Authenticated (Doctor/Receptionist+) SQL Injection
- WatchTowerHQ <= 3.16.0 - Authenticated (Administrator+) Arbitrary File Read via 'wht_download_big_object_origin' Parameter
- Olivia <= 0.9.5 - Reflected Cross-Site Scripting
- AI Engine 2.8.4 - Insecure OAuth Implementation
- Download Monitor <= 5.0.12 - Missing Authorization to API Key Manipulation
- Slideshow Gallery <= 1.6.8 - Cross-Site Scripting
- Contact Form Email <= 1.3.58 - Missing Authorization
- Woocommerce Customers Manager <= 26.4 - Authenticated Account Creation and Privilege Escalation
- Able Player, accessible HTML5 media player <= 1.2.1 - Authenticated (Contributor+) Stored Cross-Site Scripting via preload Parameter
- Lock User Account <= 1.0.5 - User Lock Bypass
- Brizy – Page Builder <= 2.4.44 - Missing Authorization to Authenticated (Contributor+) Post Modification
- Melapress File Monitor < 2.2.0 - Missing Authorization
- CSS & JavaScript Toolbox <= 12.0.5 - Authenticated (Admin+) Stored Cross-Site Scripting
- Zephyr Project Manager <= 3.3.205 - Authenticated (Custom+) Stored Cross-Site Scripting via 'message' Parameter
- Formality <= 1.5.8 - Authenticated (Contributor+) Stored Cross-Site Scripting via align Parameter
- The Plus Addons for Elementor <= 6.3.15 - Authenticated (Author+) Stored Cross-Site Scripting via SVG
- WPLifeCycle <= 3.3.1 - Missing Authorization
- CleanSkin <= 1.5.0 - Unauthenticated Local File Inclusion
- Ultimate Member <= 2.11.1 - Authenticated (Subscriber+) Stored Cross-Site Scripting via DOM Gadgets
- SEO Plugin by Squirrly SEO <= 12.4.14 - Missing Authorization to Authenticated (Subscriber+) Cloud Service Disconnection
- MediClinic <= 2.1 - Unauthenticated Local File Inclusion
- Easy Digital Downloads – Shoppette Theme < 1.0.5 - Cross-Site Scripting
- Redirect Redirection <= 1.1.3 - Missing Authorization in 'loadSettings' function
- Popup Maker – Boost Sales, Conversions, Optins, Subscribers with the Ultimate WP Popup Builder <= 1.22.0 - Missing Authorization to Authenticated (Editor+) Arbitrary Plugin Installation
- Abandoned Cart Lite for WooCommerce <= 5.8.5 - Cross-Site Request Forgery Bypass
- simpleSAMLphp Authentication <= 0.7.0 - Reflected Cross-Site Scripting
- Groundhogg <= 4.9.3 - Authenticated (Sales Representative+) Arbitrary File Deletion via CSV Import 'copy_file' Field Mapping
- Beds24 Online Booking <= 2.0.24 - Authenticated (Contributor+) Stored Cross-Site Scripting
- Ultimate Blocks – WordPress Blocks Plugin <= 3.1.9 - Authenticated (Contributor+) Stored Cross-Site Scripting via title tag attribute
- Image Wall <= 3.0 - Reflected Cross-Site Scripting
- Fluent Forms Pro Add On Pack <= 6.2.6 - Authenticated (Subscriber+) PHP Object Injection to Arbitrary User Password Change via User Meta Field
- ENL Newsletter <= 1.0.1 - Cross-Site Request Forgery