Vulnerability archive: section 12, page 23
Open a report to review affected versions, available fixes and original sources. Each report covers a specific issue; its presence does not establish whether your website is affected.
- WP Travel <= 10.1.3 - Authenticated (Author+) SQL Injection
- Rank Math SEO – AI SEO Tools to Dominate SEO Rankings <= 1.0.271 - Missing Authorization
- Starto < 2.2.5 - Reflected Cross-Site Scripting
- Attachments Handler <= 1.1.7 - Reflected Cross-Site Scripting
- Printcart Store - Web to Print Product Designer for WooCommerce (PCDesigner) <= 2.9.1 - Unauthenticated Arbitrary File Upload to Remote Code Execution via nbdesigner_copy_image_from_url
- GeoDirectory <= 2.8.119 - Authenticated (Contributor+) Stored Cross-Site Scripting
- WP GoToWebinar <= 15.7 - Authenticated (Subscriber+) Stored Cross-Site Scripting
- Easy Author Image <= 1.5 - Email Information Exposure
- TranslatePress <= 3.3.3 - Unauthenticated Stored Cross-Site Scripting via Comment Noise-Key Injection into HTML Parser
- MailChimp Campaigns <= 3.2.4 - Missing Authorization to Authenticated (Subscriber+) MailChimp App Disconnection
- SKT Page Builder <= 4.6 - Authenticated (Subscriber+) Arbitrary File Upload
- Ivory Search <= 5.4 - Multiple Admin+ Stored Cross-Site Scripting
- Editorial Rating <= 4.0.5 - Authenticated (Administrator+) Stored Cross-Site Scripting via 'Link URL' Field
- Store Locator <= 2.2.260 - Authenticated (Contributor+) PHP Object Injection
- Groups <= 3.10.0 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'groups_group_info' Shortcode
- GMAce <= 1.5.2 - Cross-Site Request Forgery via gmace_manager_client
- Photo Gallery by Ays <= 6.3.8 - Authenticated (Contributor+) Stored Cross-Site Scripting
- WP Editor.md – The Perfect WordPress Markdown Editor <= 10.2.1 - Authenticated (Administrator+) Stored Cross-Site Scripting
- uDesign <= 4.11.2 - Missing Authorization
- Featured Image from URL (FIFU) <= 5.3.1 - Authenticated (Contributor+) Server-Side Request Forgery via 'fifu_input_url'
- JetElements For Elementor <= 2.6.13 - Missing Authorization to Unauthenticated Arbitrary Attachment Download
- Secure Copy Content Protection and Content Locking <= 4.1.6 - Authenticated (Admin+) Stored Cross-Site Scripting
- Motors – Car Dealership & Classified Listings Plugin <= 1.4.64 - Missing Authorization to Authenticated (Subscriber+) Arbitrary Plugin Installation
- Custom Post Type to Map Store <= 1.1.0 - Cross-Site Request Forgery to Stored Cross-Site Scripting
- Filebird <= 6.4.2.1 - Authenticated (Author+) Insecure Direct Object Reference
- WordPress Email Marketing Plugin – WP Email Capture <= 3.9.3 - Cross Site Request Forgery
- SearchAzon <= 1.4 - Cross-Site Request Forgery
- Appointment Bookings for Zoom GoogleMeet and more – Wappointment <= 2.7.7 - Unauthenticated Insecure Direct Object Reference
- SureDash <= 1.10.0 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode Attributes
- Digg Digg < 5.3.5 - Cross-Site Request Forgery
- WP Login Security and History <= 1.0 - Cross-Site Request Forgery to Stored Cross-Site Scripting
- Webcamconsult <= 1.5.0 - Cross-Site Request Forgery to Stored Cross-Site Scripting
- FormLift for Infusionsoft Web Forms <= 7.5.19 - Authenticated (Contributor+) Stored Cross-Site Scripting
- Drag and Drop Multiple File Upload for Contact Form 7 <= 1.3.8.7 - Unauthenticated PHP Object Injection via PHAR to Arbitrary File Deletion
- ACF Frontend Display <= 2.0.6 - Unauthenticated Arbitrary File Upload
- Easy CSV Importer BETA <= 7.0.0 - Unauthenticated Arbitrary File Upload
- Database for Contact Form 7, WPforms, Elementor forms <= 1.4.5 - Missing Authorization to Unauthenticated Form Data Exfiltration via CSV Export
- Shortcodes Finder <= 1.5.4 - Reflected Cross-Site Scripting via nonce
- WP Data Access – App Builder for Tables, Forms, Charts, Maps & Dashboards <= 5.5.80 - Missing Authorization
- Essential Addons for Elementor -- Best Elementor Templates, Widgets, Kits & WooCommerce Builders <= 6.0.3 - Authenticated (Contributor+) Stored Cross-Site Scripting via Fancy Text Widget
- External Media <= 1.0.35 - Authenticated (Administrator+) Stored Cross-Site Scripting
- Mags <= 1.1.6 - Unauthenticated Local File Inclusion
- Salon booking system <= 9.6.5 - Cross-Site Request Forgery to Settings Update
- Paytm Payment Gateway <= 2.8.8 - Unauthenticated Payment Bypass
- WPCafe – Online Food Ordering, Restaurant Menu, Delivery, and Reservations for WooCommerce <= 2.2.24 - Authenticated (Contributor+) Stored Cross-Site Scripting via Reservation Form Shortcode
- Tutor LMS <= 1.9.11 - Stored Cross-Site Scripting
- Bulk Content Creator <= 1.2.1 - Cross-Site Request Forgery
- FundPress <= 2.0.8 - Missing Authorization to Unauthenticated Arbitrary Donation Status Modification via donate_action_status AJAX Handler
- Paid Memberships Pro CCBill Gateway <= 0.3 - Insufficient Authorization
- Conditional Shipping for WooCommerce <= 2.3.1 - Cross-Site Request Forgery
- Site Reviews <= 5.13.0 - Admin+ Stored Cross-Site Scripting
- Frontend File Manager Plugin < 3.6 - Arbitrary File Upload
- Backup, Restore and Migrate WordPress Sites With the XCloner Plugin <= 3.1.2 - Cross-Site Scripting
- Digital Lottery <= 3.0.5 - Unauthenticated Arbitrary File Upload
- Traveler Code <= 3.1.1 - Unauthenticated Arbitrary SQL Injection
- Force Update Translations <= 0.5 - Cross-Site Request Forgery
- Formulario de contacto SalesUp! <= 1.0.14 - Reflected Cross-Site Scripting
- Featured Video Plus <= 2.3.3 - Unauthenticated Information Exposure
- Ninja Forms <= 3.14.1 - Missing Authorization to Unauthenticated Sensitive Information Disclosure via token/refresh REST Endpoint
- WDesignkit <= 1.0.40 - Authenticated (Administrator+) Arbitrary File Upload
- iThemes Security < 5.3.1 - Insecure Backup/Logfile Generation
- Easy PHP Settings <= 1.0.4 - Authenticated (Administrator+) PHP Code Injection via 'wp_memory_limit' Setting
- Pods – Custom Content Types and Fields <= 2.7.28 - Authenticated (Admin+) Cross-Site Scripting
- Contact Form to Any API <= 1.1.2 - Authenticated (Administrator+) SQL Injection via 'form_id'
- WPLMS < 1.9.9.5 - Unauthenticated Arbitrary Directory Deletion
- CP Blocks <= 1.0.20 - Cross-Site Request Forgery to Settings Update
- MainWP Dashboard <= 4.2.4.1 - Cross-Site Request Forgery
- Orbit Fox by ThemeIsle <= 2.10.29 - Cross-Site Request Forgery
- WP Migrate Pro <= 2.6.10 - Unauthenticated PHP Object Injection
- WP Accessibility Helper (WAH) <= 0.6.2.9 - Missing Authorization
- Barcode Generator for WooCommerce <= 2.0.4 - Missing Authorization to Authenticated (Subscriber+) Settings Update
- Gradient Text Widget for Elementor <= 1.0.1 - Authenticated (Contributor+) Stored Cross-Site Scripting
- QQWorld Auto Save Images <= 1.9.8 - Missing Authorization to Arbitrary Post Content Retrieval
- 診断ジェネレータ作成プラグイン <= 1.4.16 - Authenticated (Subscriber+) Stored Cross-Site Scripting via 'js' Parameter
- Royal Elementor Addons <= 1.7.1017 - Authenticated (Contributor+) Stored Cross-Site Scripting
- Divi <= 4.27.6 - Authenticated (Contributor+) Stored Cross-Site Scripting via Social Media Follow 'skype_url' Shortcode Parameter
- Form Maker by 10Web <= 1.15.30 - Authenticated (Admin+) Stored Cross-Site Scripting
- Bold Page Builder <= 4.6.1 - Authenticated (Contributor+) Stored Cross-Site Scripting
- FluentCRM Pro <= 3.1.12 - Authenticated (Editor+) Privilege Escalation
- Contest Gallery <= 30.0.6 - Missing Authorization
- Quiz And Survey Master <= 11.1.4 - Missing Authorization
- Newsletters <= 4.13 - Missing Authorization
- Gift Up 2.21.3 - Cross-Site Request Forgery via consume_post
- The Events Calendar <= 6.15.12.2 - Missing Authorization
- Kubio AI Page Builder <= 2.6.3 - Missing Authorization to Authenticated (Subscriber+) Limited Plugin Installation
- UpStream: a Project Management Plugin for WordPress <= 2.1.0 - Missing Authorization
- WP OAuth2 Server <= 1.0.1 - Authentication Bypass
- Mavis HTTPS to HTTP Redirection <= 1.4.3 - Cross-Site Request Forgery
- Auphonic Importer <= 1.5.1 - Cross-Site Request Forgery to Stored Cross-Site Scripting
- Shibboleth <= 1.6 - Reflected Cross-Site Scripting
- Team Showcase and Slider – Team Members Builder <= 1.3 - Reflected Cross-Site Scripting
- All In One SEO Pack <= 4.9.1 - Authenticated (Contributor+) SQL Injection
- Metform Elementor Contact Form Builder <= 3.1.2 - Unauthenticated Stored Cross-Site Scripting
- Postalicious <= 3.0.1 - Authenticated (Administrator+) Stored Cross-Site Scripting via Plugin Settings
- KiviCare <= 4.5.0 - Authenticated (Doctor+) SQL Injection via 'orderby' Parameter in KCQueryBuilder
- Method <= 2.1 - Arbitrary File Deletion
- ScrollTo Top <= 1.2.2 - Cross-Site Request Forgery to Arbitrary File Upload
- Better Business Reviews <= 0.1.1 - Missing Authorization
- User Profile Builder – Beautiful User Registration Forms, User Profiles & User Role Editor < 4.0.1 - Authenticated (Contributor+) Stored Cross-Site Scripting
- miniOrange's Google Authenticator <= 6.1.1 - Missing Authorization