Vulnerability archive: section 13, page 19
Open a report to review affected versions, available fixes and original sources. Each report covers a specific issue; its presence does not establish whether your website is affected.
- Music Store <= 1.0.41 - Cross-Site Scripting
- WooCommerce Subscription < 9.1.0 - Unauthenticated PHP Object Injection
- Prime Slider – Addons For Elementor <= 3.13.3 - Authenticated (Contributor+) Stored Cross-Site Scripting via Rubix Widget
- BWD Elementor Addons <= 4.3.20 - Authenticated (Contributor+) Stored Cross-Site Scripting
- Events Made Easy <= 3.2.22 - Unauthenticated Stored Cross-Site Scripting via 'event[location_name]' Parameter
- WP Ultimate CSV Importer <= 6.5.7 - Missing Authorization
- ERP <= 1.16.10 - Authenticated (Crm agent+) SQL Injection
- 404 to 301 – Redirect, Log and Notify 404 Errors <= 3.1.1 - Reflected Cross-Site Scripting
- Sanger <= 1.24.0 - Unauthenticated Local File Inclusion
- Blacklist Manager for WooCommerce 1.3.0 - 2.3.1 - Blocked User Restriction Bypass
- EasyIndex <= 1.1.1704 - Cross-Site Request Forgery
- atec Debug <= 1.2.22 - Authenticated (Administrator+) Arbitrary File Deletion
- Shopkeeper Extender < 7.0 - Authenticated (Contributor+) Stored Cross-Site Scripting
- Fluent Forms Pro Add On Pack <= 6.2.13 - Unauthenticated Stored Cross-Site Scripting
- JetTricks <= 1.5.4.1 - Authenticated (Subscriber+) Information Exposure
- Quick Event Manager <= 9.7.4 - Unauthenticated Stored Cross Site Scripting
- Popup Builder <= 1.1.29 - Authenticated (Author+) Stored Cross-Site Scripting
- Newsletter <= 7.4.5 - Authenticated (Admin+) Stored Cross-Site Scripting
- vSlider Multi Image Slider <= 4.1.2 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode
- Narrative Publisher <= 1.0.7 - Authenticated (Contributor+) Stored Cross-Site Scripting
- DSGVO All in one for WP <= 4.2 - Authenticated (Administrator+) Stored Cross-Site Scripting
- wpDataTables - Tables & Table Charts (Premium) <= 6.3.1 - Unauthenticated SQL Injection
- HivePress <= 1.7.31 - Authenticated (Subscriber+) Stored Cross-Site Scripting via Listing Attribute Value in Administrator-configured HTML Format
- Really Simple Security – Simple and Performant Security (formerly Really Simple SSL) <= 9.8.0 - Unauthenticated Two-Factor Authentication Bypass
- WooCommerce <= 2.2.2 - Cross-Site Scripting via range Parameter
- WP-ISPConfig 3 <= 1.5.6 - Cross-Site Request Forgery to Stored Cross-Site Scripting
- User Submitted Posts <= 20251121 - Unauthenticated Open Redirect
- Social comments by WpDevArt <= 2.4.9 - Admin+ Stored Cross-Site Scripting
- TinyMCE Advanced qTranslate fix editor problems <= 1.0.0 - Cross-Site Request Forgery to Stored Cross-Site Scripting
- Sticky Ad Bar <= 1.3.1 - Authenticated (Admin+) Stored Cross-Site Scripting
- InLinks <= 1.1 - Authenticated SQL Injection
- YML for Yandex Market <= 4.7.2 - Reflected Cross-Site Scripting
- Pastebin <= 1.5 - Authenticated (Contributor+) Stored Cross-Site Scripting
- Radio Station by netmix® – Manage and play your Show Schedule in WordPress! <= 2.5.7 - Cross-Site Request Forgery to Notice Dismissal
- WCPOS <= 1.9.8 - Authenticated (Shop Manager+) Path Traversal to Arbitrary File Read via 'type' Parameter
- Photosmash Plugin < 1.0.5 - Cross-Site Scripting
- Asgaros Forum <= 2.1.0 - Cross-Site Request Forgery
- Download Manager <= 3.3.58 - Authenticated (Contributor+) Stored Cross-Site Scripting via wpdm_packages Shortcode
- WP Hotel Booking <= 2.1.0 - Unauthenticated SQL Injection
- Genesis Style Shortcodes <= 1.0 - Authenticated (Contributor+) Stored Cross-Site Scripting
- WPCS – WordPress Currency Switcher Professional <= 1.1.9 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode
- Magic Slider <= 2.2 - Reflected Cross-Site Scripting
- Wordlift <= 3.37.1 - Authenticated (Administrator+) Stored Cross-Site Scripting
- Popup Builder – Create highly converting, mobile friendly marketing popups. <= 4.1.11 - Cross-Site Request Forgery to Settings Update
- IP Blacklist Cloud < 3.41 - SQL Injections
- Advance Menu Manager <= 3.0.6 - Missing Authorization
- ALO EasyMail Newsletter <= 2.6.00 - Cross-Site Request Forgery to Stored Cross-Site Scripting
- Gravel <= 1.6 - Reflected Cross-Site Scripting
- Expert Invoice <= 1.0.2 - Authenticated (Admin+) Stored Cross-Site Scripting
- WP MathJax <= 1.0.1 - Authenticated (Contributor+) Stored Cross-Site Scripting
- Hostel <= 1.1.5 - Reflected Cross-Site Scripting
- Charity Zone <= 1.1.1 - Authenticated (Subscriber+) Arbitrary File Upload
- AI Engine <= 2.9.4 - Missing URL Scheme Validation to Authenticated (Subscriber+) Arbitrary File Read via simpleTranscribeAudio and get_audio Functions
- Events Manager <= 7.3.7.4 - Authenticated (Administrator+) Local File Inclusion via 'dbem_data[updates]' Array Keys
- News Magazine X <= 1.2.50 - Missing Authorization
- Neos Connector for Fakturama <= 0.0.14 - Cross-Site Request Forgery to Settings Update
- PDF Viewer & 3D PDF Flipbook – DearPDF <= 2.0.38 - Authenticated (Contributor+) Stored Cross-Site Scripting
- WP Photo Album Plus <= 8.5.02.005 - Insecure Direct Object Reference
- Bold Timeline Lite <= 1.2.7 - Authenticated (Contributor+) Stored Cross-Site Scripting
- NextGEN Gallery <= 4.4.0 - Authenticated (Contributor+) Insecure Direct Object Reference
- Satisfaction Reports from Help Scout <= 2.0.3 - Reflected Cross-Site Scripting
- LifterLMS Wordpress Plugin <= 3.37.14 - Arbitrary File Write
- Duplicate Post <= 1.4.1 - Cross-Site Request Forgery via 'cdp_action_handling' AJAX action
- WP-Walla <= 0.5.3.5 - Cross-Site Request Forgery to Stored Cross-Site Scripting
- WPBookit <= 1.6.4 - Unauthenticated Arbitrary User Password Change
- W3 Total Cache <= 2.9.1 - Missing Authorization
- Experto Dashboard for WooCommerce <= 1.0.4 - Authenticated (Administrator+) Stored Cross-Site Scripting via 'Navigation Font Size' Setting
- GPTranslate <= 2.34.6 - Unauthenticated Sensitive Information Exposure in Public Frontend Inline Script
- JavaScript Logic <= 0.1 - Cross-Site Request Forgery to Stored Cross-Site Scripting
- WordPress Online Booking and Scheduling Plugin – Bookly <= 23.2 - Authenticated (Subscriber+) Stored Cross-Site Scripting via Color Profile Parameter
- Generate PDF using Contact Form 7 <= 4.2.1 - Unauthenticated Arbitrary File Read
- JetSearch <= 3.6.1.2 - Unauthenticated Information Exposure
- MailOptin <= 1.2.78.6 - Unauthenticated Privilege Escalation to 'form_custom_field_mappings' Parameter
- Persian Nested Show/Hide Text <= 1.5 - Authenticated (Contributor+) Stored Cross-Site Scripting
- Amazon Products to WooCommerce <= 1.2.7 - Missing Authorization to Unauthenticated Arbitrary Product Creation
- MasterStudy LMS <= 3.7.25 - Authenticated (Subscriber+) Time-based Blind SQL Injection via 'order' and 'orderby' Parameters
- Change WordPress Login Logo <= 1.1.4 - Stored Cross-Site Scripting
- WCFM Membership <= 2.10.0 - Unauthenticated Privilege Escalation
- Register Plus <= 3.5.11 - Sensitive Information Disclosure
- bbPress2 shortcode whitelist <= 2.2.1 - Cross-Site Request Forgery to Stored Cross-Site Scripting
- Flickr Show <= 1.5 - Authenticated (Contributor+) Stored Cross-Site Scripting
- WP-UserOnline <= 2.88.2 - Unauthenticated Stored Cross-Site Scripting
- Download Manager <= 3.3.70 - Authenticated (Author+) Stored Cross-Site Scripting
- Amministrazione Trasparente <= 7.1 - Cross-Site Request Forgery Bypass
- Social Media Links <= 1.0.3 - Cross-Site Request Forgery to Stored Cross-Site Scripting
- WP Shop <= 3.9.6 - Missing Authentication to Settings Change and Order Deletion
- Post SMTP <= 3.8.0 - Unauthenticated Stored Cross-Site Scripting via 'event_type'
- Easy Digital Downloads <= 3.2.6 - Authenticated(Shop Manager+) Stored Cross-Site Scripting via variable pricing options
- NEX-Forms <= 8.7.15 - Authenticated (Admin+) SQL Injection
- post highlights 2.0 - 2.6 - Cross-Site Scripting
- WPCS – WordPress Currency Switcher Professional <= 1.2.0 - Authenticated (Contributor+) Stored Cross-Site Scripting
- coreActivity: Activity Logging for WordPress <= 3.0 - Unauthenticated PHP Object Injection via 'user_agent' Log Meta Field
- WordPress Live Webcam Widget & Shortcode <= 1.2 - Authenticated (Contributor+) Stored Cross-Site Scripting
- Simple Maps <= 0.98 - Cross-Site Request Forgery
- ImproveSEO <= 2.0.11 - Unauthenticated Arbitrary File Upload
- Like Button Rating <= 2.5.3 - Arbitrary Settings Change
- Business <= 1.3 - Authenticated (Contributor+) Stored Cross-Site Scripting
- Webcam Video Conference <= 4.91.8 - Unrestricted File Upload leading to Remote Code Execuction
- Arlo <= 6.0.3 - Unauthenticated Local File Inclusion
- WP Shortcodes Plugin — Shortcodes Ultimate <= 7.3.3 - Authenticated (Contributor+) Stored Cross-Site Scripting via src Parameter