Vulnerability archive: section 13, page 23
Open a report to review affected versions, available fixes and original sources. Each report covers a specific issue; its presence does not establish whether your website is affected.
- Master Addons – Elementor Addons with White Label, Free Widgets, Hover Effects, Conditions, & Animations <= 2.0.8.2 - Authenticated (Contributor+) Stored Cross-Site Scripting
- WP Rss Poster <= 1.0.0 - SQL Injection
- Carousel Slider <= 2.2.10 - Authenticated (Editor+) Stored Cross-Site Scripting
- Zingiri Web Shop <= 2.2.3 - Remote Code Execution
- RS WP Book Showcase <= 6.7.70 - Unauthenticated Arbitrary Shortcode Execution
- Structured Content (JSON-LD) #wpsc <= 1.6.3 - Authenticated (Contributor+) Stored Cross-Site Scripting via sc_fs_local_business Shortcode
- CodeBard's Patron Button and Widgets for Patreon <= 2.2.0 - Reflected Cross-Site Scripting
- Sociable <= 4.3.4.1 - Authenticated (Admin+) Stored Cross-Site Scripting
- Uncanny Automator – Easy Automation, Integration, Webhooks & Workflow Builder Plugin <= 7.3.2 - Authenticated (Administrator+) SQL Injection
- Live Sales Notification for Woocommerce – Woomotiv <= 3.6.3 - Reflected Cross-Site Scripting
- Advanced Form Integration <= 2.1.0 - Unauthenticated Privilege Escalation
- Booster for WooCommerce <= 7.2.3 - Reflected Cross-Site Scripting
- Child Pages Card <= 1.8 - Authenticated (Contributor+) Stored Cross-Site Scripting
- WordPress Core < 4.5.3 - Cross-Site Scripting via Attachment Name #2
- Pz-LinkCard <= 2.5.6 - Authenticated (Contributor+) Server-Side Request Forgery
- CLUEVO LMS, E-Learning Platform <= 1.10.0 - Cross-Site Request Forgery
- Elementor Addons by Livemesh <= 8.3.4 - Authenticated (Contributor+) Stored Cross-Site Scripting via Posts Multislider Widget
- Appointment Booking Calendar Plugin and Scheduling Plugin – BookingPress <= 1.1.16 - Authenticated (Subscriber+) SQL Injection
- WP Ultimate CSV Importer – WordPress CSV, XML & Excel Import Export <= 9.1 - Unauthenticated Information Exposure
- Media Library Assistant <= 3.35 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'mla_link_href' Shortcode Parameter
- Easy Digital Downloads <= 2.10.2 - Cross-Site Request Forgery
- Team Members for Elementor Page Builder <= 1.0.4 - Authenticated (Contributor+) Stored Cross-Site Scripting
- Aardvark <= 2.19 - Missing Authorization
- File Manager <= 3.0 - Stored Cross-Site Scripting
- Crelly Slider <= 1.3.4 - Arbitrary File Upload
- WP File Download <= 6.3.9 - Missing Authorization to Authenticated (Subscriber+) Arbitrary File Deletion/Modification via 'task' Parameter to Multiple Functions
- mTouch Quiz <= 3.1.2 - Reflected Cross-Site Scripting
- Cookie Banner for GDPR / CCPA <= 4.3.6 - Missing Authorization to Authenticated (Subscriber+) Scan Schedule Modification via gcc_save_schedule_scan AJAX Action
- Post Blocks & Tools <= 1.3.0 - Authenticated (Author+) Stored Cross-Site Scripting via 'sliderStyle' Block Attribute
- Post Timeline <= 2.4.1 - Missing Authorization
- Newsletter, SMTP, Email marketing and Subscribe forms by Sendinblue <= 3.1.30 - Reflected Cross-Site Scripting via lang & pid Parameters
- Picture Factory (Unspecified Versions) - Cross-Site Scripting
- Quick Paypal Payments <= 5.7.25 - Authenticated (Contributor+) Cross Site Scripting
- Constructo <= 4.3.9 - Cross-Site Request Forgery
- Post Grid Master <= 3.4.7 - Missing Authorization
- Import Spreadsheets from Microsoft Excel <= 10.1.4 - Authenticated (Editor+) Arbitrary File Upload
- iframe popup <= 3.3 - Authenticated (Administrator+) Stored Cross-Site Scripting via settings
- WPvivid — Backup, Migration & Staging < 0.9.131 - Unauthenticated Path Traversal
- WP Custom Widget area <= 1.2.5 - Missing Authorization
- Libsyn Publisher Hub <= 1.3.2 - Sensitive Information Exposure
- Featured Posts Grid <= 1.7 - Cross-Site Request Forgery to Cross-Site Scripting
- Brizy Pro <= 2.8.0 - Reflected Cross-Site Scripting
- Quiz and Survey Master <= 9.0.4 - Authenticated (Contributor+) Stored Cross-Site Scripting
- Qi Addons For Elementor <= 1.7.2 - Authenticated (Contributor+) Local File Inclusion
- Flynax Bridge <= 2.2.0 - Unauthenticated Privilege Escalation via Account Takeover
- Assistant – Every Day Productivity Apps <= 1.4.9.1 - Unauthenticated Sensitive Information Exposure
- Comment Info Detector <= 1.0.5 - Cross-Site Request Forgery to Settings Update
- Newsletter, SMTP, Email marketing and Subscribe forms by Sendinblue <= 3.1.77 - Reflected Cross-Site Scripting
- Paloma Widget <= 1.14 - Cross-Site Request Forgery to Stored Cross-Site Scripting
- WPPizza – A Restaurant Plugin <= 3.19.9 - Authenticated (Subscriber+) Information Exposure
- Button Generator – easily Button Builder <= 2.3.5 - Cross-Site Request Forgery in tools-data-base.php
- Ocean Extra <= 2.5.3 - Missing Authorization
- WP EasyCart <= 5.4.8 - Cross-Site Request Forgery via process_duplicate_product
- Sheets To WP Table Live Sync <= 2.12.15 - Cross-Site Request Forgery
- WP-Database-Optimizer-Tools <= 0.2 - Cross-Site Request Forgery
- Click to Chat <= 4.44 - Unauthenticated Arbitrary Shortcode Execution via REQUEST_URI via {url} Placeholder
- Responsive Menu <= 3.1.3 - Cross-Site Request Forgery
- LiteSpeed Cache <= 6.5.2 - Authenticated (Contributor+) Stored Cross-Site Scripting
- Social Link Groups <= 1.1.0 - Authenticated (Contributor+) SQL Injection
- EU Cookie Law <= 3.1.2 - Authenticated Stored Cross-Site Scripting
- Essential Addons for Elementor <= 6.6.11 - Authenticated (Contributor+) Stored Cross-Site Scripting via Reading Progress Global Color Settings
- Puzzles <= 4.2.6 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode
- Websimon Tables <= 1.3.4 - Reflected Cross-Site Scripting
- Erident Custom Login and Dashboard <= 3.4.1 - Cross-Site Request Forgery to Stored Cross-Site Scripting
- SureDash <= 1.1.0 - Authenticated (Subscriber+) Information Disclosure
- RegistrationMagic <= 6.0.1.0 - Unauthenticated Stored Cross-Site Scripting
- BizCalendar Web <= 1.1.0.25 - Reflected Cross-Site Scripting via 'tab'
- Academy LMS <= 3.8.1 - Unauthenticated Insecure Direct Object Reference to Private Topic Disclosure
- MonsterInsights – Google Analytics Dashboard for WordPress <= 5.3.2 - Stored Cross-Site Scripting
- Contempo Real Estate Core <= 3.6.3 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode
- WPZOOM Portfolio Lite – Filterable Portfolio Plugin <= 1.4.21 - Unauthenticated Stored Cross-Site Scripting
- Slider Hero with Video Background, Animation < 9.1.3 - Unauthenticated Stored Cross-Site Scripting
- Ai Image Alt Text Generator for WP <= 1.1.1 - Missing Authorization
- Visitor Logic Lite <= 1.0.3 - Unauthenticated PHP Object Injection via 'lpblocks' Cookie
- Events Manager <= 5.8.1.3 - Stored Cross-Site Scripting
- Malta <= 1.3.3 - Unauthenticated Local File Inclusion
- Subscriptions for WooCommerce <= 1.8.10 - Missing Authorization
- SEUR Oficial <= 1.6.0 - Cross-Site Scripting
- Themify Portfolio Post <= 1.2.4 - Authenticated (Editor+) Stored Cross-Site Scripting
- Content Egg <= 5.3.0 - Reflected Cross-Site Scripting
- Loco Translate <= 2.8.8 - Authenticated (Translator+) Limited File Read
- Featured Image from URL (FIFU) <= 5.2.7 - Authenticated (Admin+) SQL Injection
- RSFirewall! <= 1.1.45 - Unauthenticated Stored Cross-Site Scripting
- Luzuk Testimonials <= 0.0.1 - Authenticated (Contributor+) Stored Cross-Site Scripting
- Redux Framework <= 4.5.8 - Authenticated (Contributor+) Stored Cross-Site Scripting via data Parameter
- WP Easy Post Types <= 1.4.4 - Authenticated (Subscriber+) PHP Object Injection
- Essential Blocks <= 6.3.0 - Unauthenticated Information Exposure
- WPBot Pro Wordpress Chatbot <= 12.7.0 - Unauthenticated PHP Object Injection
- X Addons for Elementor <= 1.0.16 - Authenticated (Contributor+) Stored Cross-Site Scripting via Youtube Video ID Field
- WPS Bookings for WooCommerce <= 3.11.6 - Authenticated (Subscriber+) Insecure Direct Object Reference to Booking Order Cancellation
- Social Sharing Plugin – Sassy Social Share <= 3.3.75 - Reflected Cross-Site Scripting via 'heateor_mastodon_share' Parameter
- GLS Shipping for WooCommerce <= 1.4.0 - Reflected Cross-Site Scripting via 'failed_orders'
- Responsive Addons for Elementor – Free Elementor Addons Plugin and Elementor Templates <= 1.6.9 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'rael_title_tag'
- Booking calendar, Appointment Booking System <= 3.2.3 - Authenticated (Editor+) Stored Cross-Site Scripting
- WP User Manager <= 2.9.17 - Unauthenticated Path Traversal to Local File Inclusion via 'tab' Query Parameter
- GDPR Compliance <= 1.2.5 - Authenticated (Subscriber+) Information Exposure
- UiCore Elements <= 1.3.4 - Authenticated (Contributor+) Stored Cross-Site Scripting
- Spectra <= 2.6.6 - Missing Authorization
- Ni CRM Lead <= 1.3.0 - Reflected Cross-Site Scripting
- Include URL <= 0.3.5 - Authenticated (Contributor+) Stored Cross-Site Scripting