Vulnerability archive: section 13, page 10
Open a report to review affected versions, available fixes and original sources. Each report covers a specific issue; its presence does not establish whether your website is affected.
- Coming Soon & Maintenance Mode by Colorlib <= 1.0.98 - Administrator+ Cross-Site Scripting
- Smart Appointment & Booking <= 1.0.7 - Authenticated (Subscriber+) Stored Cross-Site Scripting via saab_save_form_data AJAX Action
- Download Manager <= 3.3.60 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'no_data_msg' Shortcode Attribute
- Download Plugin <= 2.0.4 - Cross-Site Request Forgery
- Youtube SpeedLoad <= 0.6.3 - Cross-Site Request Forgery
- Enter Addons <= 2.1.8 - Authenticated (Contributor+) Stored Cross-Site Scripting
- Display custom fields in the frontend – Post and User Profile Fields <= 1.2.1 - Insecure Direct Object Reference to Authenticated (Contributor+) Post Meta Disclosure
- Woo Confirmation Email < 3.2.0 - Improper Access Control
- Nafeza Prayer Time <= 1.2.9 - Authenticated (Administrator+) Stored Cross-Site Scripting
- Ninja Forms - File Uploads <= 3.3.29 - Missing Authorization to Unauthenticated Log Disclosure and Deletion via debug-log/delete-all and debug-log/get-all REST Endpoints
- ReCaptcha Integration for WordPress <= 1.2.7 - Authenticated (Administrator+) Stored Cross-Site Scripting
- So Audible Cloud Music Player <= 0.9 - Cross-Site Scripting
- Leaflet Maps Marker < 3.12.6 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode
- I Recommend This < 3.8.2 - Cross-Site Scripting
- Youtube Video Grid <= 1.9 - Cross-Site Request Forgery
- Multiple Shipping And Billing Address For Woocommerce <= 1.3 - Unauthenticated SQL Injection
- Barcode Scanner with Inventory & Order Manager <= 1.5.3 - Unauthenticated Privilege Escalation
- My Calendar <= 3.4.23 - Authenticated (Admin+) Stored Cross-Site Scripting via Events
- Taboola <= 2.0.1 - Cross-Site Request Forgery to Plugin Settings Update
- System Dashboard <= 2.8.18 - Authenticated (Subscriber+) Sensitive Information Exposure
- wpForo Forum <= 2.3.4 - Authenticated (Subscriber+) Insecure Direct Object Reference
- 140+ Widgets | Best Addons For Elementor – FREE <= 1.4.3.1 - Authenticated (Contributor+) PHP Object Injection
- Product Input Fields for WooCommerce <= 1.9 - Authenticated (Contributor+) Arbitrary File Read
- Welcart e-Commerce <= 2.8.3 - Cross-Site Request Forgery
- WP Yelp Review Slider <= 7.0 - Authenticated (Subscriber+) SQL Injection
- Easy Captcha <= 1.0 - Reflected Cross-Site Scripting
- File Manager Advanced Shortcode WordPress <= 2.3.2 - Unauthenticated Arbitrary File Upload to Remote Code Execution via Shortcode
- MLS Import <= 7.0.3 - Authenticated (Subscriber+) Information Exposure
- Greenmart <= 4.2.11 - Authenticated (Contributor+) Local File Inclusion
- WP Data Access – App Builder for Tables, Forms, Charts, Maps & Dashboards <= 5.5.79 - Unauthenticated Stored Cross-Site Scripting
- Embed Extended – Embed Maps, Videos, Websites, Source Codes, and more <= 1.4.0 - Cross-Site Request Forgery
- Hash Form – Drag & Drop Form Builder <= 1.4.2 - Unauthenticated Arbitrary File Upload
- Clean Retina <= 3.0.6 - Unauthenticated Local File Inclusion
- Greeny <= 2.6 - Unauthenticated Local File Inclusion
- JetEngine <= 3.8.14.3 - Unauthenticated Stored Cross-Site Scripting
- Medical Addon for Elementor <= 1.6.2 - Insecure Direct Object Reference to Authenticated (Contributor+) Sensitive Information Exposure via Shortcode
- Kirki <= 6.0.6 - Unauthenticated Limited Arbitrary File Read and Deletion via downloadZIP
- SpiderCalendar <= 1.4.13 - Cross-Site Request Forgery
- IntelliWidget Elements <= 2.2.7 - Authenticated (Contributor+) Stored Cross-Site Scripting
- Mapbox for WP Advanced <= 1.0.0 - Reflected Cross-Site Scripting
- Redirection for Contact Form 7 <= 3.2.8 - Unauthenticated Stored Cross-Site Scripting
- Express Shop <= 4.0.2 - Cross-Site Request Forgery
- Coming Soon Page – Responsive Coming Soon & Maintenance Mode <= 1.1.18 - Cross-Site Scripting via social_icon_1 parameter
- Shortcode Loader <= 1.0 - Unauthenticated Arbitrary Shortcode Execution via 'code' Parameter
- Gutenverse Form <= 2.2.0 - Missing Authorization
- Companion Sitemap Generator <= 4.5.1.1 - Reflected Cross-Site Scripting
- User Frontend: AI Powered Frontend Post Submission, User Directory, User Profile, Membership & User Registration < 4.3.8 - Missing Authorization to Unauthenticated Media Attachment Deletion
- WPCafe <= 2.2.32 - Authenticated (Contributor+) Local File Inclusion
- WP Project Manager <= 2.6.26 - Authenticated (Subscriber+) SQL Injection via 'completed_at_operator'
- LearnPress <= 4.1.4 - Authenticated (Administrator+) Path Traversal to Arbitrary File Read via 'import-user-file' Parameter
- wpDataTables <= 2.1.27 - Authenticated Cross-Site Scripting
- Custom Body Class <= 0.6.0 - Cross-Site Request Forgery
- Draft List <= 2.6 - Authenticated (Contributor+) Stored Cross-Site Scripting
- Review Slider Pro <= 12.7.11 - Authenticated (Subscriber+) Stored Cross-Site Scripting
- Harper <= 1.13 - Unauthenticated Local File Inclusion
- Vayu Blocks <= 1.3.9 - Authenticated (Contributor+) Stored Cross-Site Scripting via Multiple Block Attributes
- Responsive Pricing Table <= 5.1.7 - Authenticated (Admin+) Stored Cross-Site Scripting
- Prevent files / folders access <= 2.5.1 - Authenticated (Administrator+) Arbitrary File Upload in mo_media_restrict_page
- Ultimate CSV Importer <= 9.1 - Unauthenticated Information Exposure
- Traffic Manager <= 1.4.5 - Missing Authorization to Stored Cross-Site Scripting
- OTP-less one tap Sign in <= 2.0.58 - Reflected Cross-Site Scripting
- Product Specifications for Woocommerce <= 0.8.9 - Missing Authorization to Authenticated (Subscriber+) Arbitrary Attribute/Group Creation, Modification, and Deletion via 'dwps_modify_groups' and 'dwps_modify_attributes' AJAX Actions
- Flo Forms – Easy Drag & Drop Form Builder <= 1.0.43 - Unauthenticated Stored Cross-Site Scripting via SVG Upload
- BackWPup <= 4.0.3 - Sensitive Information Exposure
- Waymark <= 1.5.0 - Authenticated (Contributor+) Stored Cross-Site Scripting
- WPC Badge Management for WooCommerce <= 2.4.0 - Missing Authorization
- Pixel Cat – Conversion Pixel Manager <= 2.6.1 - Cross-Site Request Forgery to Stored Cross-Site Scripting
- RT Mega Menu <= 1.5.1 - Authenticated (Subscriber+) Stored Cross-Site Scripting via rtmega_update_menu_options AJAX Action
- Miraculous Core < 2.0.9 - Unauthenticated Insecure Direct Object Reference
- Forminator Forms <= 1.57.2.0 - Missing Authorization
- WordPress Automatic Plugin <= 3.92.1 Cross-Site Request Forgery
- Thrive Visual Editor <= 10.9.3.1 - Unauthenticated Stored Cross-Site Scripting
- AI Puffer <= 2.4.89 - Missing Authorization to Authenticated (Subscriber+) Global Plugin Settings Modification via ajax_save_cpt_indexing_options AJAX Endpoint
- MyBookTable Bookstore <= 3.3.3 - Cross-Site Request Forgery
- Product Author for WooCommerce <= 1.0.7 - Cross-Site Request Forgery
- YayPricing <= 3.5.3 - Missing Authorization
- Giveaways and Contests by RafflePress <= 1.12.0 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode
- Album and Image Gallery with Lightbox – Flagallery Photo Portfolio <= 2.55 - SQL Injection
- AZIndex <= 0.8.1 - Cross-Site Request Forgery to Stored Cross-Site Scripting
- Infility Global <= 2.15.36 - Unauthenticated Stored Cross-Site Scripting
- WidgetKit <= 2.5.4 - Authenticated (Contributor+) Stored Cross-Site Scripting
- Simple Spoiler 1.2 - 1.3 - Unauthenticated Arbitrary Shortcode Execution
- XML Sitemap Generator for Google <= 1.3.3 - Cross-Site Request Forgery to Plugin Settings Changes
- YITH WooCommerce Product Add-Ons <= 4.5.0 - Unuathenticated Cross-Site Scripting
- Tonda Membership <= 1.0.1 - Unauthenticated Privilege Escalation
- Disqus Comment System < 2.68 - Reflected Cross-Site Scripting
- CoCart – Headless ecommerce <= 3.11.2 - Missing Authorization
- Advanced Sermons <= 3.6 - Authenticated (Contributor+) Stored Cross-Site Scripting
- Eventin <= 4.0.28 - Reflected Cross-Site Scripting
- WP ApplicantStack Jobs Display <= 1.1.1 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode Attributes
- Visual Sound <= 1.03 - Cross-Site Request Forgery to Settings Update
- Marin <= 0.1.1 - Reflected Cross-Site Scripting
- RepairBuddy – Repair Shop CRM & Booking Plugin for WordPress <= 4.1132 - Missing Authorization
- Open User Map <= 1.4.46 - Authenticated (Contributor+) Stored Cross-Site Scripting
- Product Filter Widget for Elementor <= 1.0.6 - Unauthenticated Stored Cross-Site Scripting
- SVG Complete <= 1.0.2 - Authenticated (Author+) Stored Cross-Site Scripting via SVG File Upload
- Currency Switcher for WooCommerce <= 2.16.2 - Reflected Cross-Site Scripting
- Countdown Timer block – Display the event's date into a timer. <= 1.2.4 - Authenticated (Contributor+) Post Disclosure
- Custom Field For WP Job Manager <= 1.1 - Authenticated (Administrator+) Stored Cross-Site Scripting
- Flatsome <= 3.20.5 - Missing Authorization