Vulnerability archive: section 12, page 25
Open a report to review affected versions, available fixes and original sources. Each report covers a specific issue; its presence does not establish whether your website is affected.
- Contact Form to Any API <= 1.1.6 - Missing Authorization via delete_cf7_records()
- Ultimate Blocks – WordPress Blocks Plugin <= 3.2.7 - Authenticated (Contributor+) Stored Cross-Site Scripting
- GNUCommerce < 1.4.2 - Stored Cross-Site Scripting
- Community by PeepSo <= 6.2.2.0 - Authenticated (Contributor+) Stored Cross-Site Scripting
- WANotifier <= 2.7.12 - Missing Authorization
- Superior FAQ <= 1.0.2 - Cross Site Request Forgery
- 5 star review funnel for Google Reviews, Trustpilot, ProvenExpert and more | RRatingg <= 1.2.67 - Missing Authorization
- Restaurant & Cafe Addon for Elementor <= 1.5.2 - Cross-Site Request Forgery
- Contact Form by Bit Form - Bit Form <= 2.20.3 - Unauthenticated Arbitrary File Upload
- Stripe Payments For WooCommerce by Checkout <= 1.9.1 - Unauthenticated Insecure Direct Object Reference
- WP Back Button <= 1.1.3 - Authenticated (Admin+) Stored Cross-Site Scripting
- Events Manager <= 7.4.0 - Unauthenticated Privilege Escalation
- SiteSEO – SEO Simplified <= 1.3.2 - Improper Authorization to Authenticated Settings Reset
- H5P <= 1.15.7 - Authenticated (Contributor+) Stored Cross-Site Scripting
- WerkStatt <= 1.6.6 - Authenticated (Contributor+) Local File Inclusion
- WP iCommerce – the first interactive ecommerce for wordpress <= 1.1.1 - Authenticated (Admin+) SQL Injection
- Starter Templates — Elementor, Gutenberg & Beaver Builder Templates <= 2.7.0 - Missing Authorization to Stored Cross-Site Scripting
- EventPrime <= 4.2.8.4 - Missing Authorization to Unauthenticated Image Upload via 'ep_upload_file_media' AJAX Endpoint
- WPML Multilingual CMS <= 4.6.12 - Authenticated (Contributor+) Remote Code Execution via Twig Server-Side Template Injection
- Accordion FAQ <= 2.2.1 - Authenticated (Contributor+) Local File Inclusion
- Paytm Payment Gateway <= 2.8.8 - Unauthenticated SQL Injection
- LatePoint - Appointment Booking & Scheduling <= 5.6.9 - Unauthenticated Insecure Direct Object Reference to Sensitive Information Disclosure via 'customer[id]' Parameter
- Appointment Hour Booking <= 1.3.71 - Missing Authorization
- Eventify - Simple Events <= 1.7.f - SQL Injection via eventid
- User Meta Manager < 3.4.8 - Missing Authorization to Sensitive Information Disclosure
- Staging CDN <= 1.0.0 - Reflected Cross-Site Scripting
- WP Ultimate Email Marketer <= 1.1.0 - Stored Cross-Site Scripting
- Slider, Gallery, and Carousel by MetaSlider – Image Slider, Video Slider <= 3.94.0 - Authenticated (Editor+) PHP Object Injection
- WPCS – WordPress Currency Switcher Professional <= 1.3.1 - Unauthenticated Stored Cross-Site Scripting
- TinyNav <= 1.4 - Cross-Site Request Forgery
- Smart Product Gallery Slider <= 1.0.4 - Cross-Site Request Forgery to Stored Cross-Site Scripting
- AnalyticsWP <= 2.1.2 - Unauthenticated Sensitive Information Exposure
- Social Counter <= 2.0.5 - Authenticated (Administrator+) PHP Object Injection
- Easy Social Photos Gallery <= 3.1.2 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'wrapper_class' Shortcode Attribute
- Sender – Newsletter, SMS and Email Marketing Automation for WooCommerce <= 2.10.22 - Authenticated (Administrator+) SQL Injection
- Conditional Fields for Contact Form 7 <= 2.4.0 - Missing Authorization
- Card Elements for Elementor <= 1.2.2 - Authenticated (Contributor+) Stored Cross-Site Scripting
- Embed Any Document <= 2.7.10 - Authenticated (Contributor+) Stored Cross-Site Scripting
- Royal Elementor Addons <= 1.3.987 - Authenticated (Contributor+) Stored Cross-Site Scripting
- WP-Lister Lite for eBay <= 3.8.3 - Missing Authorization
- Dovetail <= 1.2.13 - Authenticated (Administrator+) Stored Cross-Site Scripting
- Elementor Website Builder Pro <= 3.20.1 - Authenticated (Contributor+) Stored Cross-Site Scripting
- Royal Addons for Elementor <= 1.7.1058 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'title_tag' Parameter
- WP Travel Engine <= 5.3.0 - Editor+ Stored Cross-Site Scripting
- TM Replace Howdy <= 1.4.2 - Cross-Site Request Forgery
- Ravpage <= 2.16 - Reflected Cross-Site Scripting
- Biltorvet Dealer Tools <= 1.0.22 - Authenticated (Contributor+) Stored Cross-Site Scripting
- WP Social Bookmarking <= 3.6 - Cross-Site Request Forgery
- WP Import – Ultimate CSV XML Importer for WordPress <= 7.37 - Authenticated (Subscriber+) SQL Injection via File Name
- LearnPress <= 4.2.3 - Missing Authorization
- Talkback <= 1.0 - Unauthenticated PHP Object Injection
- Mark Posts <= 2.2.4 - Missing Authorization
- Contact Form Email <= 1.3.63 - Missing Authorization
- Webcraftic Clearfy – WordPress optimization plugin <= 2.3.2 - Cross-Site Request Forgery to Plugin Settings Update via 'setup-wbcr_clearfy'
- Post Teaser <= 4.1.5 - Cross-Site Request Forgery
- Master Addons – Free Widgets, Hover Effects, Toggle, Conditions, Animations for Elementor <= 2.0.6.4 - Authenticated (Contributor+) Stored Cross-Site Scripting via data-jltma-wrapper-link Element
- Broken Link Checker <= 2.4.7 - Authenticated (Editor+) SQL Injection
- Automatically Hierarchic Categories in Menu <= 2.0.7 - Authenticated (Contributor+) Stored Cross-Site Scripting
- S3Bubble Cloud Video with Adverts and Analytics < 4.8 - Arbitrary File Download
- VikAppointments Services Booking Calendar <= 1.2.21 - Unauthenticated Arbitrary File Deletion via 'old_vapcfN' Parameter
- Giveaways and Contests by RafflePress <= 1.12.18 - Missing Authorization
- Custom Product List Table <= 3.0.0 - Cross-Site Request Forgery
- Pixelavo – Server Side Tracking & Pixel + AI Ads Tools < 1.5.4 - Missing Authorization
- weMail <= 1.14.5 - Reflected Cross-Site Scripting
- Ecwid by Lightspeed Ecommerce Shopping Cart <= 6.12.27 - Cross-Site Request Forgery to Send Deactivation Message
- Post Grid and Gutenberg Blocks 2.2.85 - 2.3.3 - Unauthenticated Privilege Escalation
- Caldera Forms <= 1.5.4 - Cross-Site Scripting
- WEN Responsive Columns <= 1.3.2 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode
- Gutenberg Blocks with AI by Kadence WP – Page Builder Features <= 3.3.1 - Authenticated (Contributor+) Stored Cross-Site Scripting via Icon Widget
- Salon booking system <= 10.8.1 - Unauthenticated Open Redirect
- Logo Showcase Ultimate <= 1.4.4 - Authenticated (Contributor+) Local File Inclusion
- Ultimate Addons for WPBakery Page Builder < 3.21.1 - Authenticated (Contributor+) Stored Cross-Site Scripting
- Recent Posts From Each Category <= 1.4 - Cross-Site Request Forgery
- Album and Image Gallery plus Lightbox <= 1.6.2 - Missing Authorization
- VR-Frases <= 4.0.1 - Reflected Cross-Site Scripting
- Avada Core < 5.15.0 - Missing Authorization
- Fluent Forms <= 6.2.0 - Insecure Direct Object Reference to Authenticated (Subscriber+) Subscription Cancellation
- Newsletter <= 9.4.0 - Unauthenticated Stored Cross-Site Scripting via 'np1' Custom Field Parameter
- Third Party Cookie Eraser <= 1.0.2 - Cross-Site Request Forgery to Stored Cross-Site Scripting
- Popup Maker <= 1.16.8 - Authenticated (Contributor+) Cross-Site Scripting
- My Sticky Bar <= 2.7.2 - Authenticated (Admin+) Stored Cross-Site Scripting
- WordPress Core 6.4.0 - 6.4.1 - Remote Code Execution POP Chain
- EmbedPress <= 3.9.11 - Missing Authorization
- Ajax Search Pro <= 4.29.1 - Unauthenticated SQL Injection
- SUMO Reward Points for WooCommerce <= 32.7.0 - Unauthenticated Stored Cross-Site Scripting via 'reason' Parameter
- Element Pack Elementor Addons (Header Footer, Template Library, Dynamic Grid, Carousel and Remote Arrows) <= 5.10.28 - Authenticated (Contributor+) DOM-Based Stored Cross-Site Scripting
- GiveWP – Donation Plugin and Fundraising Platform < 4.16.6 - Authenticated (Donor+) Stored Cross-Site Scripting
- Nuance <= 1.2 - Arbitrary File Upload
- Happy Addons for Elementor <= 3.15.1 - Authenticated (Contributor+) Stored Cross-Site Scripting
- Save as PDF <= 3.2.1 - Authenticated (Admin+) Stored Cross-Site Scripting
- Stream <= 3.0.5 - Sensitive Data Exposure
- Stetic <= 1.0.6 Cross-Site Request Forgery to Stored Cross-Site Scripting
- WP User <= 7.0 - Unauthenticated SQL Injection
- EventPrime <= 3.3.4 - Missing Authorization to Booking Price Maniputlation
- Tickera <= 3.5.2.8 - Missing Authorization to Authenticated (Susbcriber+) Ticket Deletion
- Booking for Appointments and Events Calendar – Amelia < 2.4.10 - Authenticated (Custom Role+) Privilege Escalation
- JetEngine <= 3.7.0 - Authenticated (Contributor+) Stored Cross-Site Scripting
- ReviewX – Multi-Criteria Reviews for WooCommerce with Google Reviews & Schema <= 2.3.6 - Missing Authorization
- I Recommend This < 3.7.3 - SQL Injection
- File Uploads Addon for WooCommerce <= 1.7.1 - Unauthenticated Sensitive Information Exposure Through Unprotected Directory