Vulnerability archive: section 12, page 9
Open a report to review affected versions, available fixes and original sources. Each report covers a specific issue; its presence does not establish whether your website is affected.
- JS Job Manager <= 2.0.2 - Unauthenticated Arbitrary File Upload
- XML for Avito <= 2.5.2 - Reflected Cross-Site Scripting
- Podlove Podcast Publisher < 2.3.16 - SQL Injection
- JetFormBuilder <= 3.6.5.3 - Reflected Cross-Site Scripting via 'jfb_xss' (URL Query Variable) Parameter via Calculated Field
- UPC/EAN/GTIN Code Generator <= 2.0.2 - Authenticated (Subscriber+) Arbitrary File Deletion
- News Kit Elementor Addons <= 1.3.4 - Missing Authorization
- Like in Vk.com <= 0.5.2 - Cross-Site Request Forgery to Stored Cross-Site Scripting
- WassUp Real Time Analytics <= 1.9.4.5 - Unauthenticated Stored Cross-Site Scripting via IP
- Page Builder KingComposer <= 2.9.6 - Authenticated Arbitrary Profile Creation and Stored Cross-Site Scripting
- Instantio <= 3.3.7 - Missing Authorization to Unauthenticated Settings Update
- Easy Modal <= 2.1.0 - Authenticated (Contributor+) Stored Cross-Site Scripting
- WP-Filebase <= 3.4.23 - Reflected Cross-Site Scripting
- Total Donations <= 2.0.5 - Missing Authorization to Arbitrary Options Update
- Beaver Themer <= 1.4.9 - Authenticated (Contributor+) Sensitive Information Exposure via shortcode
- BMLT Meeting Map <= 2.6.1 - Authenticated (Contributor+) Stored Cross-Site Scripting
- DirectoryPress <= 3.6.19 - Cross-Site Request Forgery to Cross-Site Scripting
- User Registration & Membership <= 5.1.0 - Unauthenticated Payment Bypass
- VikBooking Hotel Booking Engine & PMS <= 1.5.8 - Arbitrary File Upload
- Front End Users <= 3.2.24 - Missing Authorization to Unauthenticated Registered User Deletion
- KB Support – Customer Support Ticket & Helpdesk Plugin, Knowledge Base Plugin <= 1.7.4 - Unauthenticated Sensitive Information Exposure Through Unprotected Directory
- Google Maps made Simple <= 0.6 - Authenticated (Subscriber+) SQL Injection via Shortcode
- WordPress Core 2.1.1 - Supply Chain Compromise
- Link Library <= 5.9.13.26 – SQL Injection
- OpenPix <= 2.13.3 - Missing Authorization to Authenticated (Subscriber+) Settings Update
- Quick Event Manager <= 9.7.4 - Missing Authorization Checks
- Persian WooCommerce <= 7.1.6 - Missing Authorization
- Remove Duplicate Posts <= 1.3.5 - Missing Authorization to Post Deletion
- LeagueManager <= 3.7 - Multiple Cross-Site Scripting
- Feather Login Page <= 1.1.3 - Cross-Site Request Forgery
- Loan Comparison <= 2.0 - Authenticated (Contributor+) Stored Cross-Site Scripting
- Multi Feed Reader <= 2.2.3 - Authenticated SQL Injection
- Bulk Landing Page Creator for WordPress LPagery <= 2.4.9 - Missing Authorization
- Frictionless <= 0.0.23 - Authenticated (Contributor+) Stored Cross-Site Scripting
- Infility Global <= 2.9.8 - Reflected Cross-Site Scripting via set_type Parameter
- Borderless <= 1.5.8 - Authenticated (Editor+) Stored Cross-Site Scripting
- CURCY <= 2.3.7 - Missing Authorization to Arbitrary Shortcode Execution
- Homey <= 2.4.5 - Unauthenticated SQL Injection
- Real Estate Manager <= 7.3 - Authenticated (Contributor+) Stored Cross-Site Scripting
- Login With Ajax < 3.1 - Cross-Site Request Forgery
- CP Multi View Event Calendar <= 1.4.36 - Missing Authorization
- Design Scuole Italia <= 2.17.3 - Open Redirect
- 1003 Mortgage Application <= 1.87 - Missing Authorization
- Qi Addons For Elementor <= 1.9.1 - Authenticated (Contributor+) Stored Cross-Site Scripting
- Debug Meta Data <= 1.1.2 - Stored Cross-Site Scripting
- WP Symposium < 13.04 - Cross-Site Scripting
- WordPress File Upload <= 4.24.8 - Unauthenticated Stored Cross-Site Scripting via SVG File Upload
- WordPress/Plugin Upgrade Time Out Plugin <= 1.0 - Cross-Site Request Forgery to Stored Cross-Site Scripting
- WC Vendors Marketplace <= 2.4.4 - Authenticated (Contributor+) Stored Cross-Sites Scripting via Shortcode
- Web Bricks Addons for Elementor <= 1.1.1 - Authenticated (Contributor+) Stored Cross-Site Scripting
- WordPress Buffer – HYPESocial. Social Media Auto Post, Social Media Auto Publish and Schedule <= 2020.1.0 - Cross-Site Request Forgery
- Structured Content <= 1.6.2 - Authenticated (Contributor+) Stored Cross-Site Scripting
- Download Manager <= 3.2.59 - Refleced Cross-Site Scripting
- SpeakOut! Email Petitions <= 4.0.3 - Reflected Cross-Site Scripting
- EDD Download Info <= 1.1 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode Attributes
- ShortPixel Image Optimizer <= 6.3.4 - Authenticated (Contributor+) Settings Import/Export
- WPMobile.App — Android and iOS Mobile Application <= 11.41 - Reflected Cross-Site Scripting
- WP-Cal <= 0.3 - SQL Injection
- Epeken All Kurir for Woocommerce <= 2.1.2 - Unauthenticated Payment Bypass
- OneLogin SAML SSO <= 2.8.0 - Distributed Denial-of-Service
- Kognetiks Chatbot <= 2.3.5 - Missing Authorization to Unauthenticated Limited File Uploads and Conversation Erasing
- Reftagger Shortcode <= 1.1 - Authenticated (Contributor+) Stored Cross-Site Scripting
- Advanced Product Fields (Product Addons) for WooCommerce <= 1.6.18 - Missing Authorization
- Portfolio by BestWebSoft < 2.4.0 - Reflected Cross-Site Scripting
- Post Indexer <= 3.0.6.1 - PHP Object Injection
- On Page SEO + Whatsapp Chat Button <= 1.0.1 Reflected Cross-Site Scripting
- Make, formerly Integromat Connector <= 1.5.1 - Missing Authorization to Arbitrary Options Update
- OAuth Client by DigitialPixies <= 1.1.0 - Cross-Site Request Forgery
- Testimonial Slider And Showcase Pro <= 2.1.7 - Authenticated (Subscriber+) Local File Inclusion
- Akismet htaccess writer <= 1.0.1 - Reflected Cross-Site Scripting
- Query Wrangler <= 1.5.57 - Authenticated (Subscriber+) Remote Code Execution
- WP Page Builder <= 1.2.8 - Authenticated (Admin+) Stored Cross-Site Scripting
- Electric Enquiries <= 1.1 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'button' Shortcode Attribute
- WordPress Core < 4.7.2 - Path Disclosure
- SCSS WP Editor <= 1.2.1 - Cross-Site Request Forgery
- Taggbox <= 3.3 - Cross-Site Request Forgery
- AnyClip Luminous Studio <= 1.3.3 - Authenticated (Administrator+) Stored Cross-Site Scripting
- Wizhi Multi Filters by Wenprise <= 1.8.6 - Cross-Site Request Forgery to Stored Cross-Site Scripting
- Sensei LMS <= 4.23.1 & Sensei Pro (WC Paid Courses) <= 4.24.0.1.24.0 - Missing Authorization
- Jotform – AI Chatbot <= 3.8.2 - Unauthenticated Stored Cross-Site Scripting
- YT Player – Embed and Customize Video Players <= 2.0.9 - Missing Authorization
- Shortcodes for Elementor <= 1.0.4 - Authenticated (Contributor+) Post Disclosure
- YITH plugins by YITHEMES <= (Various Versions) - Missing Authorization
- Right Way <= 4.0 - Unauthenticated Local File Inclusion
- ORDER POST <= 2.0.2 - Unauthenticated Arbitrary Shortcode Execution
- RobotCPA <= 5 - Unauthenticated Local File Inclusion
- wpDiscuz <= 7.6.5 - Unauthenticated SQL Injection
- ReverbNation Widgets <= 2.1 - Authenticated (Contributor+) Stored Cross-Site Scripting
- Kubio AI Page Builder <= 2.9.2 - Unauthenticated Stored Cross-Site Scripting
- GMap Shortcode <= 2.0 - Authenticated (Contributor+) Stored Cross-Site Scripting
- URL Media Uploader <= 1.0.0 - Authenticated (Author+) Server-Side Request Forgery via DNS Rebinding
- WordPress GDPR & CCPA <= 1.9.26 Reflected Cross-Site Scripting
- Penci Podcast <= 1.6 - Authenticated (Contributor+) Stored Cross-Site Scripting
- Premium Addons for Elementor <= 4.10.35 - Regular Expressions Denial of Service
- persian-woocommerce-shipping <= 4.2.3 - Authenticated (Contributor+) Stored Cross-Site Scripting
- Easy WP Optimizer <= 1.1.0 - Missing Authorization
- Custom Product Tabs for WooCommerce <= 1.7.7 - Subscriber+ Settings Update
- wpForo Forum <= 2.1.7 - Authenticated (Subscriber+) Local File Include, Server-Side Request Forgery, and PHAR Deserialization via file_get_contents
- Be POPIA Compliant <= 1.1.5 - Sensitive Information Exposure
- Themify Portfolio Post <= 1.1.5 - Authenticated Stored Cross-Site Scripting
- Tockify Events Calendar <= 2.2.13 - Authenticated (Contributor+) Stored Cross-Site Scripting