Vulnerability archive: section 13, page 16
Open a report to review affected versions, available fixes and original sources. Each report covers a specific issue; its presence does not establish whether your website is affected.
- WP 2FA with Telegram <= 3.0 - Authenticated (Subscriber+) Authentication Bypass
- The School Management <= 5.4 - Authenticated (Custom+) SQL Injection via 'order[0][dir]' Parameter
- Embed Google Fonts <= 3.1.0 - Missing Authorization
- Import CDN-Remote Images <= 2.1.2 - Cross-Site Request Forgery
- Draft List < 2.6.4 - Authenticated (Contributor+) Stored Cross-Site Scripting
- Advanced Image Sitemap <= 1.2 - Reflected Cross-Site Scripting
- Backup by Supsystic <= 2.3.9 - Unauthenticated Local File Inclusion
- Backuply – Backup, Restore, Migrate and Clone <= 1.3.4 - Authenticated (Admin+) SQL Injection
- Gestpay for WooCommerce <= 20221130 - Cross-Site Request Forgery (CSRF) via ajax_unset_default_card
- OneLogin SAML SSO <= 3.1.2 - Open Redirection
- Gallery by BestWebSoft <= 4.6.9 - Authenticated (Author+) SQL Injection
- Support Board <= 3.8.0 - Unauthenticated Arbitrary File Deletion
- Simple URLs <= 120 - Cross-Site Request Forgery via Multiple AJAX Actions
- Polylang <= 3.7.3 - Authenticated (Contributor+) PHP Object Injection
- Photo Gallery by 10Web <= 1.5.30 - SQL Injection
- WP MultiTasking <= 0.1.12 - Cross-Site Request Forgery to Welcome Popup Update
- OSM <= 6.1.0 - Authenticated (Contributor+) Stored Cross-Site Scripting via osm_map and osm_map_v3 Shortcodes
- Double Opt-In for Download <= 2.0.9 - SQL Injection
- BAN Users <= 1.5.3 - Missing Authorization to Authenticated (Subscriber+) Settings Update & Privilege Escalation
- Slimstat Analytics <= 5.0.4 - Reflected Cross-Site Scripting
- Hubbub Lite <= 1.35.1 - Authenticated (Subscriber+) Sensitive Information Exposure
- Auto Image Attributes From Filename With Bulk Updater (Add Alt Text, Image Title For Image SEO) <= 4.9 - Authenticated (Author+) Stored Cross-Site Scripting via Image Attribute
- WP Blockade <= 0.9.14 - Missing Authorization to Authenticated (Subscriber+) Arbitrary Shortcode Execution via 'shortcode' Parameter
- Creator LMS – Online Courses and eLearning Plugin <= 1.1.18 - Authenticated (Contributor+) Privilege Escalation
- Computer Repair Shop < 2.0 - Authenticated (Admin+) Stored Cross-Site Scripting
- WordPress Notification Bar <= 1.3.10 - Authenticated (Administrator+) Stored Cross-Site Scripting
- Advanced Custom Fields: Font Awesome Field <= 5.0.2 - Authenticated (Contributor+) Stored Cross-Site Scripting
- Activity Plus Reloaded for BuddyPress <= 1.1.2 - Authenticated (Contributor+) Stored Cross-Site Scripting
- Author Box Plugin With Different Description <= 1.3.5 - Cross-Site Request Forgery
- Extend Link <= 2.0.0 - Authenticated (Contributor+) Server-Side Request Forgery
- Gutenberg Essential Blocks - Page Builder for Gutenberg Blocks & Patterns <= 6.1.4 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'configurablePrefix' Block Attribute
- Strong Testimonials <= 3.2.21 - Authenticated (Contributor+) Stored Cross-Site Scripting via testimonial_view Shortcode
- Burst Statistics <= 3.7.1 - Improper Authentication to Account Persistence via Share-Link Authentication Bypass via 'burst_share_token'
- Post Sliders & Post Grids <= 1.0.20 - Authenticated (Administrator+) Stored Cross-Site Scripting
- GA4WP: Google Analytics for WordPress <= 2.10.0 - Missing Authorization
- WPIDE <= 3.4.9 - Unauthenticated Full Path Dislcosure
- Page Builder Gutenberg Blocks – CoBlocks <= 3.1.6 - Authenticated (Contributor+) Stored Cross-Site Scripting
- YaySMTP 2.4.9 - 2.6.3 - Unauthenticated Stored Cross-Site Scripting
- Userback <= 1.0.13 - Cross-Site Request Forgery
- Pixel Manager for WooCommerce – Track Conversions and Analytics, Google Ads, TikTok and more <= 1.49.2 - Unauthenticated Information Exposure
- 1app Business Forms <= 1.0.0 - Authenticated (Author+) Stored Cross-Site Scripting
- Visualizer <= 4.0.3 - Missing Authorization to Unauthenticated Sensitive Information Disclosure via /visualizer/v1/action/{chart}/{type}/ REST Endpoint
- Uncanny Toolkit for LearnDash <= 3.6.4.3 - Missing Authorization via review-banner-visibility REST route
- Analytics for WP <= 1.5.1 - Authenticated (Admin+) Stored Cross-Site Scripting
- WP Support Plus Responsive Ticket System <= 9.1.1 - Stored Cross-Site Scripting
- Jobs for WordPress <= 2.7.7 - Authenticated (Contributor+) Stored Cross-Site Scripting
- Wava Payment <= 0.3.7 - Missing Authorization
- Ajax Domain Checker <= 1.3.0 - Authenticated (Contributor+) Stored Cross-Site Scripting
- Subscribe2 – Form, Email Subscribers & Newsletters <= 10.15 - Stored Cross-Site Scripting
- Breadcrumb NavXT <= 6.1.0 - Sensitive Data Exposure
- Master Addons <= 2.0.7.1 - Authenticated (Contributor+) Stored Cross-Site Scripting via id Parameter
- AA Audio Player <= 1.0 - Authenticated (Contributor+) Stored Cross-Site Scripting
- IP Blacklist Cloud <= 5.00 - Authenticated (Administrator+) Stored Cross-Site Scripting
- WordPress Core < 4.7.3 - Cross-Site Scripting via Taxonomy names
- W3SCloud Contact Form 7 to Zoho CRM <= 3.0 - Cross-Site Request Forgery
- WP Youtube Gallery <= 1.9 - Authenticated (Contributor+) Stored Cross-Site Scripting via id Parameter
- W3Counter Free Real-Time Web Stats <= 4.1 - Cross-Site Request Forgery
- UK Address Postcode Validation <= 3.9.2 - Unauthenticated Sensitive Information Exposure
- Make Connector <= 1.5.10 - Authenticated (Administrator+) Arbitrary File Upload
- WordPress Firewall 2 <= 1.3 - Stored Cross-Site Scripting
- EventON - WordPress Virtual Event Calendar Plugin Pro <= 4.5.4 & Free <= 2.2.7 - Cross-Site Request Forgery via evo_eventpost_update_meta
- Website Builder by SeedProd — Theme Builder, Landing Page Builder, Coming Soon Page, Maintenance Mode <= 6.15.21 - Missing Authorization via seedprod_lite_new_lpage
- MailMunch – Grow your Email List <= 3.1.2 - Cross-Site Request Forgery
- Office Locator <= 1.3.0 - Unauthenticated SQL Injection
- WPO365 | SEAMLESS WORDPRESS + MICROSOFT INTEGRATION (WPO365 | LOGIN) <= 43.2 - Cross-Site Request Forgery to Privilege Escalation via Plugin Settings Update
- Quform - WordPress Form Builder <= 2.20.0 - Unauthenticated Sensitive Information Exposure
- BruteBank - WP Security & Firewall <= 1.8 - Cross-Site Request Forgery
- Unlimited Elements For Elementor (Free Widgets, Addons, Templates) <= 1.5.48 - Authenticated (Admin+) Cross Site Scripting (XSS)
- WordPress Core < 2.8.1 - Open Redirect
- WPForms Lite 1.8.8.2 - 2.0.1.1 - Missing Authorization
- Google Review Slider <= 18.4 - Authenticated (Administrator+) SQL Injection
- All-Images.ai – IA Image Bank and Custom Image creation <= 1.0.4 - Authenticated (Subscriber+) Arbitrary File Upload
- Quran Gateway <= 1.5 - Cross-Site Request Forgery to Settings Update
- WP-Ultimate-Map <= 1.1 - Cross-Site Request Forgery to Stored Cross-Site Scripting via 'zoom-level' Parameter
- Subscription for WooCommerce – WordPress Recurring Payments Plugin <= 1.8.10 - Authenticated (Customer+) Insecure Direct Object Reference
- Movies <= 0.6 - Reflected Cross-Site Scripting
- Fluent CRM <= 2.8.44 - Authenticated (Administrator+) Stored Cross-Site Scripting
- Tainacan <= 0.20.6 - Unauthenticated Sensitive Information Exposure
- Quick Subscribe <= 1.7.1 - Cross-Site Request Forgery to Arbitrary Settings Update and Stored Cross-Site Scripting
- Newsletters <= 4.9.9.7 - Unauthenticated Stored Cross-Site Scripting
- Treck <= 1.0.0 - Reflected Cross-Site Scripting
- Trending < 0.2 - Cross-Site Scripting
- OAuth Server <= 4.3.3 - Open Redirect
- LearnPress – WordPress LMS Plugin for Create and Sell Online Courses <= 4.4.5 - Missing Authorization
- WP Post Page Clone <= 1.1 - Missing Authorization to Post Disclosure
- Additional Custom Emails & Recipients for WooCommerce <= 3.5.1 - Authenticated (Contributor+) Stored Cross-Site Scripting
- Woocommerce Envato Affiliates <= 1.2.1 - Missing Authorization
- Santé <= 1.5.1 - Unauthenticated PHP Object Injection
- Media Category Library <= 2.7 - Reflected Cross-Site Scripting
- We’re Open! <= 1.41 - Authenticated (Administrator+) Stored Cross-Site Scripting
- oik <= 4.10.3 - Authenticated (Contributor+) Stored Cross-Site Scripting via bw_button Shortcode
- WP Plugin Manager <= 1.1.7 - Cross-Site Request Forgery to Arbitrary Plugin Activation
- Xendit Payment <= 7.2.0 - Missing Authorization
- W3 Total Cache <= 0.9.2.8 - Remote Code Execution
- Product Filter by WBW <= 3.0.0 - Missing Authorization to Unauthenticated Settings Update
- Message Filter for Contact Form 7 <= 1.6.3.9 - Unauthenticated Stored Cross-Site Scripting
- AI Engine <= 2.2.0 - Unauthenticated Stored Cross-Site Scripting
- Tabs <= 3.7.1 - Authenticated (Administrator+) Stored Cross-Site Scripting
- FiboSearch <= 1.34.2 - Authenticated (Subscriber+) Stored Cross-Site Scripting via 'purchased_plan' Parameter
- Loan Comparison <= 1.5.2 - Authenticated (Contributor+) Cross-Site Scripting via Shortcode