Vulnerability archive: section 12, page 2
Open a report to review affected versions, available fixes and original sources. Each report covers a specific issue; its presence does not establish whether your website is affected.
- Simple Payment <= 2.3.7 - Reflected Cross-Site Scripting
- Ultimate Product Catalog < 3.1.3 - Multiple Vulnerabilities
- WooCommerce Box Office <= 1.1.50 - Authenticated (Contributor+) Stored Cross-Site Scripting
- Multi Step Form <= 1.7.21 - Missing Authorization via fw_delete_files
- Secure Copy Content Protection and Content Locking <= 4.4.3 - Unauthenticated Stored Cross-Site Scripting
- Snippy <= 1.4.1 - Reflected Cross-Site Scripting
- CP Contact Form with PayPal < 1.1.6 - Cross-Site Request Forgery
- WPMU DEV Dashboard <= 5.0.0 - Authentication Bypass to Arbitrary Plugin Installation (Remote Code Execution) via Forged WDP_AUTH HMAC on ?wpmudev-hub= Endpoint
- 1-Click Login: Passwordless Authentication 1.4.5 - Authentication Bypass via Account Takeover
- WP CTA – Call To Action Plugin, Sticky CTA, Sticky Buttons <= 1.7.0 - Missing Authorization to Unauthenticated Sticky Status Update
- BE REST Endpoints <= 1.0.0 - Unauthenticated Stored Cross-Site Scripting
- Pro Mime Types <= 1.0.7 - Cross-Site Request Forgery
- Stock market charts from finviz <= 1.0.1 - Authenticated(Admin+) Stored Cross-Site Scripting
- Piotnet Addons For Elementor Pro <= 7.1.67 - Unauthenticated Arbitrary File Upload
- Premium Packages - Sell Digital Products Securely <= 5.9.3 - Authenticated (Contributor+) Stored Cross-Site Scripting via wpdmpp_pay_link Shortcode
- WP Timeline – Vertical and Horizontal timeline plugin <= 3.6.7 - Unauthenticated Local File Inclusion
- PageLayer <= 1.8.7 - Authenticated (Administrator+) Stored Cross-Site Scripting
- Ninja Forms <= 3.6.25 - Missing Authorization to Form Submission Export
- SIP Calculator <= 1.0 - Cross-Site Request Forgery to Stored Cross-Site Scripting
- Photocrati (Unknown Versions) - Multiple Vulnerabilities
- ProfileGrid <= 5.9.7.2 - Insecure Direct Object Reference to Authenticated (Subscriber+) Arbitrary User Profile and Cover Image Modification
- Kentha Elementor Widgets < 3.1 - Authenticated (Contributor+) Local File Inclusion
- seekXL Snapr <= 2.0.6 - Reflected Cross-Site Scripting
- Sermon'e <= 1.0.2 - Missing Authorization
- JNews - Video <= 11.0.2 - Reflected Cross-Site Scripting
- Advanced Woo Labels <= 2.37 - Authenticated (Contributor+) Remote Code Execution via 'callback' Parameter
- GS Books Showcase <= 1.3.0 - Authenticator (Contributor+) Stored Cross-Site Scripting via Shortcode
- Activity Reactions For Buddypress <= 1.0.22 - Cross-Site Request Forgery
- Avada Theme <= 7.11.13 - Unauthenticated Arbitrary Shortcode Execution
- Popup Maker WP 1.2.2.1 - 1.4.5 - Missing Authorization
- Bulk Me Now! <= 2.0 - Authenticated (Contributor+) Stored Cross-Site Scripting
- Payment Gateway for Redsys & WooCommerce Lite <= 7.0.0 - Missing Authorization
- Cimy Header Image Rotator <= 6.1.1 - Cross-Site Request Forgery
- External Media without Import < 1.0.0 - Reflected Cross-Site Scripting
- Formality <= 1.5.7 - Unauthenticated Local File Inclusion
- Mane <= 1.7 - Unauthenticated Local File Inclusion
- Advanced IP Blocker <= 8.13.13 - Unauthenticated Authentication Bypass via Missing Step-1 Binding to 2FA Login Handler
- Royal Addons for Elementor <= 1.7.1057 - Authenticated (Contributor+) Server-Side Request Forgery via CSV URL Parameter
- Slider Revolution <= 6.7.13 - Authenticated (Administrator+) Stored Cross-Site Scripting
- R&F <= 1.5 - Unauthenticated Local File Inclusion
- WP Rocket < 3.23.5 - Missing Authorization
- Role Based Pricing for WooCommerce <= 1.6.1 - Authenticated (Subscriber+) Arbitrary File Upload
- Share This Image <= 2.09 - Missing Authorization
- MW WP Form < 5.1.6 - Authenticated (Editor+) Stored Cross-Site Scripting
- Spirit Framework <= 1.2.13 - Authenticated (Subscriber+) Local File Inclusion
- Beautiful Cookie Consent Banner <= 2.10.0 - Missing Authorization to Settings Update
- Freshio <= 2.4.2 - Authenticated (Contributor+) Local File Inclusion
- Widget4Call <= 1.0.7 - Reflected Cross-Site Scripting
- BabelZ – Google Translate Widget <= 1.1.5 - Cross-Site Request Forgery to Stored Cross-Site Scripting
- Contact Form 7 Email Add on <= 1.9 - Authenticated (Contributor+) Local File Inclusion
- UW Freelancer <= 0.1 - Reflected Cross-Site Scripting
- Maxi Blocks <= 2.1.9 - Authenticated (Author+) Stored Cross-Site Scripting via Style Card REST API
- Nativery <= 0.1.6 - Authenticated (Contributor+) Stored Cross-Site Scripting
- User Registration <= 3.0.2 - Authenticated (Subscriber+) Arbitrary File Upload
- video carousel slider with lightbox 1.0 - Cross-Site Request Forgery
- WordPress Core <= 2.2.1 - Cross-Site Scripting
- Eulerpool Research Systems <= 4.0.1 - Authenticated (Contributor+) Stored Cross-Site Scripting
- External Media without Import <= 1.1.2 - Authenticated (Subscriber+) Blind Server-Side Request Forgery
- Move Addons for Elementor <= 1.3.6 - Authenticated (Contributor+) Stored Cross-Site Scripting
- Kirki – Freeform Page Builder, Website Builder & Customizer <= 6.0.12 - Unauthenticated PHP Object Injection
- WordPress Core < 4.0.1 - Cross-Site Request Forgery to Authentication Takeover
- Sina Extension for Elementor <= 3.5.7 - Authenticated (Contributor+) Sensitive Information Exposure via Sina Modal Box Widget Elementor Template
- Encrypted Blog <= 0.0.6.2 - Reflected Cross-Site Scripting
- WP DoNotTrack <= 0.8.8 - Authenticated (Admin+) Stored Cross-Site Scripting
- Parkivia <= 1.1.9 - Unauthenticated Local File Inclusion
- Templines Elementor Helper Core <= 2.7 - Authenticated (Subscriber+) Privilege Escalation
- Royal Addons for Elementor <= 1.7.1056 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'Follow Button Text' Parameter
- EventPrime <= 4.0.3.2 - Missing Authorization via calendar_event_create()
- Digital Download <= 1.1.4 - Missing Authorization
- Asset CleanUp: Page Speed Booster <= 1.3.9.8 - Authenticated (Admin+) Server-Side Request Forgery
- Backup Scheduler <= 1.5.13 - Missing Authorization to Sensitive Information Disclosure
- Testimonials <= 3.0.5 - Authenticated (Contributor+) Stored Cross-Site Scripting
- SEOPress <= 7.7.2 - Authenticated (Contributor+) Open Redirect
- Events In City <= 3.0 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode Attributes
- TrustMate.io integration for WooCommerce < 1.8.12 - Authenticated (Subscriber+) Arbitrary Settings Update
- Affiliate Links Lite <= 3.1.0 - Reflected Cross-Site Scripting
- Eveeno <= 1.7 - Authenticated (Contributor+) Stored Cross-Site Scripting
- Support Plus Responsive Ticket System < 7.1.0 - Insecure Direct Object Reference
- WordPress Core <= 3.3.1 - Cross-Site Scripting
- JetEngine <= 3.8.14.3 - Authenticated (Subscriber+) Stored Cross-Site Scripting
- Multiple Page Generator Plugin – MPG <= 4.1.7 - Reflected Cross-Site Scripting
- Element Pack Pro <= 7.21.0 - Cross-Site Request Forgery
- Form Maker <= 1.15.27 - Authenticated (Administrator+) Stored Cross-Site Scripting
- OSM – OpenStreetMap < 6.1.15 - Authenticated (Subscriber+) Stored Cross-Site Scripting
- Simple Social Media Share Buttons <= 3.1.1 - Reflected Cross-Site Scripting
- WP Sessions Time Monitoring Full Automatic <= 1.1.1 - Reflected Cross-Site Scripting
- PDF Invoices & Packing Slips for WooCommerce <= 3.8.0 - Unauthenticated Server-Side Request Forgery
- Instantio <= 3.3.16 - Authenticated (Admin+) Arbitrary File Upload
- Amoveo Multipurpose Wordpress Theme <= 2.0 - Arbitrary File Upload
- Bux Woocommerce <= 1.2.3 - Missing Authorization
- Church Admin <= 4.1.17 - Authenticated (Contributor+) Stored Cross-Site Scripting via meta-text
- HT Mega <= 2.7.6 - Authenticated (Contributor+) Stored Cross-Site Scripting via block_css and inner_css
- XV Random Quotes <= 1.40 - Cross-Site Request Forgery to Settings Reset
- Community Events <= 1.5 - Authenticated (Admin+) Stored Cross-Site Scripting
- Rozy - Flower Shop <= 1.2.25 - Unauthenticated Local File Inclusion
- Event Espresso Free/Lite <= 3.1.37.12.L - Unauthenticated SQL Injection
- PostX Gutenberg Blocks Saved Templates Addon <= 2.4.9 - Private Content Disclosure
- Typed JS: A typewriter style animation <= 1.2.0 - Authenticated (Contributor+) Stored Cross-Site Scripting via typespeed Parameter
- Product Table and List Builder for WooCommerce Lite <= 4.6.2 - Unauthenticated Time-Based SQL Injection via 'search' Parameter
- WP Fast Total Search – The Power of Indexed Search <= 1.81.282 - Missing Authorization