Vulnerability archive: section 12, page 3
Open a report to review affected versions, available fixes and original sources. Each report covers a specific issue; its presence does not establish whether your website is affected.
- Stop User Enumeration <= 1.3.8 - Unauthenticated Username Enumeration
- Simple Telegram <= 0.9.3 - Authenticated (Admin+) Stored Cross-Site Scripting
- Robin Image Optimizer <= 2.0.2 - Authenticated (Author+) Stored Cross-Site Scripting via Image Alternative Text Field
- RegistrationMagic <= 5.0.2.1 - SQL Injection
- WP Crowdfunding <= 2.1.5 - Cross-Site Request Forgery
- Latest Custom Post Type Updates <= 1.3.0 - Reflected Cross-Site Scripting
- Coupon API <= 6.2.12 - Authenticated (Administrator+) SQL Injection via 'log_duration'
- Grand Conference Theme Custom Post Type < 2.6.4 - Reflected Cross-Site Scripting
- Sunshine Photo Cart <= 3.7.4 - Unauthenticated PHP Object Injection via 'key' Parameter
- WordPress Core < 1.5.1 - Full Path Disclosure
- Jobmonster <= 4.7.8 - Reflected Cross-Site Scripting
- Add to Cart Text Changer and Customize Button, Add Custom Icon <= 2.0 - Cross-Site Request Forgery via wactc_text_form
- Element Pack Elementor Addons (Header Footer, Template Library, Dynamic Grid, Carousel and Remote Arrows) <= 5.10.2 - Authenticated (Contributor+) Stored Cross-Site Scripting
- SC Simple Zazzle <= 1.1.6 - Reflected Cross-Site Scripting
- wpCentral <= 1.4.7 - Privilege Escalation
- WP Post List Table <= 1.0.3 - Authenticated (Contributor+) Stored Cross-Site Scripting
- WidgetShortcode <= 0.3.5 - Authenticated(Contributor+) Stored Cross-Site Scripting via Shortcode
- LH Add Media From Url <= 1.23 - Reflected Cross-Site Scripting
- BM Content Builder < 3.17.1 - Authenticated (Subscriber+) Arbitrary File Deletion
- Prime Slider - Addons For Elementor (Revolution of a slider, Hero Slider, Ecommerce Slider <= 3.15.18 - Authenticated (Contributor+) Stored Cross-Site Scripting via Blog Widget
- JS Help Desk – AI-Powered Support & Ticketing System <= 3.0.9 - Missing Authorization
- Piotnet Addons For Elementor <= 2.4.36 - Authenticated (Contributor+) Stored Cross-Site Scripting
- Ad Inserter <= 1.5.5 - Cross-Site Request Forgery to Cross-Site Scripting
- Presto Player <= 4.5.1 - Unauthenticated Stored Cross-Site Scripting via Comment Content via Tag
- Draw Attention <= 2.0.11 - Missing Authorization to Arbitrary Post Featured Image Modification
- Easy Textillate <= 2.01 - Authenticated(Contributor+) Stored Cross-Site Scripting via Shortcode
- miniOrange Social Login and Register (Discord, Google, Twitter, LinkedIn) <= 7.8.0 - Authenticated (Contributor+) Stored Cross-Site Scripting
- Helion | Personal Portfolio & Agency WordPress Theme <= 1.1.12 - Unauthenticated Local File Inclusion
- Object Cache 4 everyone <= 2.3.2 - Information Exposure
- Advance Post Prefix <= 1.1.1 - Authenticated (Admin+) SQL Injection
- s2Member Pro <= 241216 - Reflected Cross-Site Scripting
- Quantity Dynamic Pricing & Bulk Discounts for WooCommerce <= 3.8.0 - Reflected Cross-Site Scripting
- Booking calendar, Appointment Booking System <= 3.2.3 - Cross-Site Request Forgery
- WordPress Portfolio Builder – Portfolio Gallery <= 1.1.7 - Authenticated (Editor+) Stored Cross-Site Scripting
- This-or-That by André Boekhorst <= 1.0.4 - Authenticated (Contributor+) Stored Cross-Site Scripting
- Send email only on Reply to My Comment <= 1.0.6 - Cross-Site Request Forgery to Stored Cross-Site Scripting
- Data Tables Generator by Supsystic <= 1.10.25 - Missing Authorization
- Duplicate Post < 1.5.6 - Missing Authorization
- Verse-O-Matic <= 4.1.1 - Cross-Site Request Forgery to Stored Cross-Site Scripting
- Checkout Field Manager <= 7.9.6 - Missing Authorization
- Tumult Hype Animations <= 1.9.11 - Cross-Site Request Forgery to Cross-Site Scripting
- rtMedia for WordPress, BuddyPress and bbPress <= 4.7.13 - Unauthenticated Arbitrary File Deletion
- Clients <= 1.1.4 - Authenticated (Subscriber+) Stored Cross-Site Scripting
- EventPrime <= 3.1.5 - Reflected Cross-Site Scripting via 'event_id'
- Textmetrics <= 3.6.2 - Authenticated (Administrator+) Stored Cross-Site Scripting
- underConstruction <= 1.19 - Cross-Site Request Forgery to Construction Mode Disabled
- Simple CAPTCHA with Cloudflare Turnstile <= 1.42.1 - Unauthenticated Arbitrary Shortcode Execution
- MDC Comment Toolbar <= 1.1 - Cross-Site Request Forgery to Stored Cross-Site Scripting
- Light Poll <= 1.0.0 - Cross-Site Request Forgery to Poll Answers Deletion
- HT Conctact Form 7 <= 1.2.1 - Authenticated (Contributor+) Stored Cross-Site Scripting
- BEAR <= 1.1.4 - Missing Authorization via Several Functions
- NinjaTeam Header Footer Custom Code < 1.2 - Authenticated (Admin+) Stored Cross-Site Scripting
- iMember360 3.8.012 - 3.9.001 - Remote Code Execution
- Groundhogg — CRM, Newsletters, and Marketing Automation <= 4.4.1 - Authenticated (Sales Representative+) Arbitrary File Deletion
- Tutor LMS <= 2.6.2 - Missing Authorization to Unauthenticated Limited Options Update
- Media Library Assistant <= 3.05 - Authenticated (Administrator+) SQL Injection
- Everest Forms <= 3.4.3 - Unauthenticated PHP Object Injection via Form Entry Metadata
- Gumlet Video <= 1.0.3 - Authenticated (Contributor+) Stored Cross-Site Scripting
- JetWooBuilder <= 2.1.18 - Missing Authorization
- Proxy & VPN Blocker <= 3.5.3 - Missing Authorization
- WPMobile.App <= 11.56 - Open Redirect via 'redirect' Parameter
- Advanced Custom Fields <= 5.8.11 - Cross-Site Scripting
- Duplica <= 0.6 - Authenticated (Subscriber+) Missing Authorization to Users/Posts Duplicates Creation
- Advanced Custom Fields: Link Picker Field <= 1.2.8 - Reflected Cross-Site Scripting
- Encyclopedia / Glossary / Wiki <= 1.7.60 - Reflected Cross-Site Scripting
- Social proof testimonials and reviews by Repuso <= 5.01 - Cross-Site Request Forgery
- Responsive Column Widgets <= 1.2.7 - Reflected Cross-Site Scripting via tab
- Pricing Table <= 2.0.1 - Cross-Site Request Forgery via ajax()
- NotificationX <= 3.1.11 - Missing Authorization to Authenticated (Contributor+) Analytics Reset
- DN Sitemap Control <= 1.0.6 - Reflected Cross-Site Scripting
- WPBot <= 8.5.9 - Unauthenticated Information Exposure
- Database Sync < 0.5 - Reflected Cross-Site Scripting
- GSheet For Woo Importer <= 2.3.1 - Missing Authorization to Authenticated (Subscriber+) Plugin Settings Reset
- Quick Restaurant Menu <= 2.0.2 - Cross-Site Request Forgery
- Appointment Booking Calendar <= 1.6.9.29 - Insecure Direct Object Reference to Authenticated (Staff+) Sensitive Information Exposure
- WordPress Button Plugin MaxButtons <= 9.2 - Shortcode-Based Cross-Site Scripting
- SmartFix < 1.2.4 - Missing Authorization
- MagicAI for WordPress - AI Text, Image, Chat, Code, and Voice Generator <= 1.4 - Authenticated (Subscriber+) Local File Inclusion
- Visualmodo Elements <= 1.0.2 - Authenticated (Author+) Stored Cross-Site Scripting via SVG File Upload
- Falang multilanguage <= 1.3.61 - Cross-Site Request Forgery
- Infinite Scroll – Ajax Load More <= 5.5.4 - Authenticated (Admin+) Arbitrary File Read via Directory Traversal
- Simple Post Notes <= 1.7.6 - Cross-Site Request Forgery
- JetEngine <= 3.8.10 - Unauthenticated PHP Object Injection
- iFlyChat – WordPress Chat <= 4.7.2 - Authenticated (Contributor+) Stored Cross-Site Scripting
- Photo Gallery <= 1.5.74 - File Upload Path Traversal
- AI Engine 3.4.9 - Authenticated (Subscriber+) Privilege Escalation via Missing Authorization in MCP OAuth Bearer Token
- All In One Favicon <= 4.6 - Authenticated (Admin+) Stored Cross-Site Scripting
- ARI Stream Quiz <= 1.3.2 - Authenticated(Contributor+) Content Injection
- Drag and Drop File Upload for Elementor Forms <= 1.5.3 - Unauthenticated Arbitrary File Upload
- Simplish <= 2.6.4 - Authenticated (Subscriber+) Stored Cross-Site Scripting
- WPC Product Bundles for WooCommerce <= 8.4.5 - Missing Authorization
- PRIMER by chloédigital <= 1.0.25 - Reflected Cross-Site Scripting
- ShortPixel Image Optimizer <= 6.4.3 - Authenticated (Author+) Stored Cross-Site Scripting via Attachment Title
- Forminator Forms – Contact Form, Payment Form & Custom Form Builder < 1.57.1 - Unauthenticated Privilege Escalation
- SCORM Cloud For WordPress < 1.0.7 - SQL Injection
- PixTypes <= 1.4.15 - Reflected Cross-Site Scripting
- Himalayas <= 1.3.2 - Authenticated (Administrator+) Stored Cross-Site Scripting
- JetFormBuilder <= 3.0.8 - Authenticated (Author+) Privilege Escalation
- Fidelo Snippet <= 1.12 - Reflected Cross-Site Scripting
- Salient Core <= 3.0.8 - Missing Authorization