Vulnerability archive: section 13, page 3
Open a report to review affected versions, available fixes and original sources. Each report covers a specific issue; its presence does not establish whether your website is affected.
- Wufoo Shortcode <= 1.55 - Authenticated (Contributor+) Stored Cross-Site Scripting
- RestroPress <= 2.8.3 - Missing Authorization
- WP Photo Album Plus <= 1.1 - SQL Injection
- WordPress Core < 4.5.3 - Password Change via Stolen Cookie
- m1.DownloadList <= 0.23 - Authenticated (Contributor+) Sensitive Information Disclosure
- WP w3all phpBB <= 2.9.8 - Cross-Site Request Forgery
- WP Visitor Statistics (Real Time Traffic) <= 8.4 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'height' Shortcode Attribute
- Online Contact Widget-多合一在线客服插件 <= 1.3.0 - Missing Authorization
- BlockMeister – Block Pattern Builder <= 3.1.10 - Reflected Cross-Site Scripting
- WP Proposals <= 2.3 - Authenticated (Editor+) Stored Cross-Site Scripting
- Kona Gallery Block <= 1.7 - Authenticated (Contributor+) Stored Cross-Site Scripting
- Schreikasten <= 0.14.18 - Authenticated (Author+) SQL Injection
- Best WordPress Gallery Plugin – FooGallery <= 2.4.7 -Authenticated(Administrator+) Stored Cross-Site Scripting via settings
- King Addons for Elementor <= 51.1.36 - Unauthenticated Arbitrary File Upload
- WP Fastest Cache <= 0.8.5.7 - Missing Authorization
- Slimstat Analytics <= 4.9.3.3 - Authenticated (Subscriber+) SQL Injection via Shortcode
- Booking Calendar and Notification <= 4.0.3 - Authentication Bypass
- Survey Maker <= 4.0.9 - IP Address Spoofing
- Set Bulk Post Categories <= 1.1 - Cross-Site Request Forgery to Bulk Post Category Update
- WooCommerce Shop Page Builder <= 2.27.7 - Missing Authorization
- WordPress CTA <= 1.5.8 - Missing Authorization via Multiple AJAX Actions
- WP Church Donation <= 1.7 - Unauthenticated Stored Cross-Site Scripting
- JetWidgets For Elementor <= 1.0.16 - Authenticated(Contributor+) Stored Cross-Site Scripting via Widget Button URL
- Contact Form & Lead Form Elementor Builder <= 2.0.1 - Authenticated (Subscriber+) Information Exposure
- Error Log Viewer By WP Guru <= 1.0.1.3 - Missing Authorization to Unauthenticated Arbitrary File Read
- AI Copilot <= 1.4.7 - Missing Authorization
- Easy Digital Downloads <= 3.3.8.1 - Authenticated (Contributor+) Stored Cross-Site Scripting via edd_receipt Shortcode
- Cookie Monster <= 1.51 - Authenticated (Administrator+) Stored Cross-Site Scripting
- Store Locator Widget <= 2025r1 - Authenticated (Contributor+) Stored Cross-Site Scripting
- Import and export users and customers <= 2.5.1 - Authenticated (Admin+) Privilege Escalation
- Squeeze <= 1.4 - Authenticated (Admin+) Arbitrary File Upload
- WooCommerce Multilingual & Multicurrency <= 5.3.4 - Missing Authorization
- Elements Kit Lite/Pro <= 2.1.7 - Authenticated (Contributor+) Stored Cross-Site Scripting
- Booking Ultra Pro <= 1.1.8 - Reflected Cross-Site Scripting
- WPGateway <= 3.5 - Unauthenticated Privilege Escalation
- Testimonial < 2.3 - SQL Injection
- Responsive Image Slider, Photo Gallery And Carousel < 1.3.2 - Cross-Site Request Forgery
- All-in-One Video Gallery 2.5.8 - 2.6.0 - Arbitrary File Download & Server-Side Request Forgery
- Download Read More Excerpt Link <= 1.6.0 - Cross-Site Request Forgery to Settings Update
- Arvow AI SEO Writer <= 1.5.3 - Unauthenticated Arbitrary Post Creation via Webhook Secret Type-Juggling
- Team Showcase <= 1.22.15 - Stored Cross-Site Scripting
- UPS Live Rates and Access Points <= 2.3.12 - Missing Authorization to Plugin API key reset
- Flipping Cards <= 1.30 - Authenticated (Administrator+) Stored Cross-Site Scripting
- Creative Contact Form < 1.0.0 - Arbitrary File Upload
- Pricing Table builder <= 1.5.1 - Cross-Site Request Forgery
- Nonaki – Drag and Drop Email Template builder and Newsletter plugin for WordPress <= 1.0.11 - Authenticated (Contributor+) Stored Cross-Site Scripting via Custom Fields
- Image Resizer On The Fly <= 1.1 - Unauthenticated Arbitrary File Deletion
- Regina Lite <= 2.0.7 - Reflected Cross-Site Scripting
- Memberpress <= 1.11.24 - Reflected Cross-Site Scripting via message and error
- Visual Composer Website Builder <= 45.15.0 - Missing Authorization
- Business Name Generator <= 1.3 - Authenticated (Administrator+) Stored Cross-Site Scripting
- Unlimited Elements for Elementor <= 1.5.107 - Authenticated (Contributor+) SQL Injection via data[post_ids][0]
- Sticky Chat Widget – Floating Chat Icons, Contact Form, Call, Click to Chat, Email & Message Buttons <= 1.4.2 - Unauthenticated SQL Injection
- Eventin – Event Calendar, Tickets, Registration, Booking & WooCommerce < 4.1.20 - Authenticated (Contributor+) Information Exposure
- PayU CommercePro Plugin <= 3.8.7 - Authentication Bypass
- Thim Elementor Kit <= 1.2.8 - Missing Authorization
- g-FFL Cockpit <= 1.7.1 - Missing Authorization to Unauthenticated Information Exposure
- Big Store <= 1.9.3 - Cross-Site Request Forgery to Arbitrary Plugin Activation
- GS Products Slider for WooCommerce <= 1.5.8 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode
- WP Flow Plus <= 5.2.2 - Authenticated (Contributor+) Stored Cross-Site Scripting
- Paid Membership Subscriptions – Effortless Memberships, Recurring Payments & Content Restriction <= 2.11.0 - Cross-Site Request Forgery to Notice Dismissal
- Password Reset with Code for WordPress REST API <= 0.0.15 - Weak Password Recovery Mechanism
- Livemesh Addons for Elementor <= 7.2.3 - Authenticated (Admin+) Stored Cross-Site Scripting
- PushEngage – Web Push Notifications, WooCommerce Automation & Chat Widget <= 4.2.3 - Authenticated (Subscriber+) Information Exposure
- TZ PlusGallery <= 1.5.5 - Cross-Site Request Forgery
- Podlove Web Player <= 5.7.1 - Authenticated (Contributor+) Stored Cross-Site Scripting
- WR ContactForm < 1.1.10 - SQL Injection
- Subscriptions & Memberships for PayPal <= 1.1.5 - Reflected Cross-Site Scripting
- WP Shamsi <= 4.1.1 - Missing Authorization to Plugin Settings Update
- Data Tables Generator by Supsystic <= 1.10.45 - Authenticated (Admin+) Arbitrary File Deletion
- LatePoint <= 5.5.1 - Authenticated (Agent+) Privilege Escalation to Administrator via IDOR in OsOrdersController::create_or_update + Unauthenticated Customer-Cabinet Password Reset
- Content Control – The Ultimate Content Restriction Plugin! Restrict Content, Create Conditional Blocks & More <= 2.6.5 - Missing Authorization
- Select Core < 2.6 - Authenticated (Contributor+) Local File Inclusion
- Postie <= 1.9.40 - Cross-Site Scripting
- Easy PayPal Shopping Cart <= 1.1.10 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode
- Jet Elements <= 2.7.2.1 - Authenticated (Contributor+) Stored Cross-Site Scripting via Multiple Widgets
- Video Player & FullScreen Video Background <= 2.4.1 - Authenticated (Administrator+) SQL Injection
- Memphis Documents Library <= 3.1.5 - Arbitrary File Download
- The Plus Addons for Elementor Pro < 6.3.7 - Missing Authorization
- Melapress File Monitor <= 2.1.0 - Authenticated (Admin+) Authenticated SQL Injection
- Embed Privacy <= 1.12.3 - Authenticated (Contributor+) Arbitrary File Deletion
- Simple Tweet <= 1.4.0.2 - Authenticated (Administrator+) Stored Cross-Site Scripting via plugin settings
- SmartIdeo <= 2.7.0 - Stored Cross-Site Scripting
- Vampire Character Manager <= 2.13 - Reflected Cross-Site Scripting
- Sync Master Sheet – Product Sync with Google Sheet for WooCommerce <= 1.1.3 - Missing Authorization
- ELEX WooCommerce Dynamic Pricing and Discounts <= 2.1.2 - Reflected Cross-Site Scripting
- Absolute Addons For Elementor <= 1.0.14 - Authenticated (Contributor+) Local File Inclusion
- Restaurant Menu and Food Ordering <= 2.4.11 - Missing Authorization
- Flexible Refund and Return Order for WooCommerce <= 1.0.38 - Missing Authorization to Authenticated (Subscriber+) Arbitrary Order Refund
- Events Made Easy <= 2.3.17 - Authenticated (Subscriber+) SQL Injection via 'search_name'
- Arya Multipurpose <= 1.0.5 - Reflected Cross-Site Scripting
- Timeline Event History <= 3.1 - Authenticated (Contributor+) PHP Object Injection
- Scribble Maps <= 1.2 - Reflected Cross-Site Scripting
- Starter Templates: AI-Powered Website Templates for Elementor & Gutenberg <= 4.7.7 - Missing Authorization
- GigPress <= 2.3.28 - Authenticated (Subscriber+) SQL Injection
- WP Logs Book <= 1.0.1 - Unauthenticated Stored Cross-Site Scripting
- Lava Ajax Search <= 1.1.9 - Authenticated (Administrator+) Stored Cross-Site Scripting
- Magic Post Thumbnail <= 3.3.6 - Reflected Cross-Site Scripting
- GiveWP – Donation Plugin and Fundraising Platform <= 4.5.0 - Authenticated (GiveWP worker+) Stored Cross-Site Scripting
- URL Shortener | Conversion Tracking | AB Testing | WooCommerce <= 9.0.2 - Reflected Cross-Site Scripting