Vulnerability archive: section 13, page 5
Open a report to review affected versions, available fixes and original sources. Each report covers a specific issue; its presence does not establish whether your website is affected.
- MapPress Maps <= 2.73.3 - Reflected Cross-Site Scripting
- Smart Custom Fields <= 5.0.6 - Missing Authorization to Authenticated (Contributor+) Sensitive Information Exposure via Relational Post Search
- Bird Feeder <= 1.2.3 - Cross-Site Request Forgery
- WP Social Stream Designer <= 1.3 - Authenticated (Administrator+) SQL Injection
- FluentBoards <= 1.47 - Unauthenticated PHP Object Injection
- JupiterX Core <= 4.10.1 - Authenticated (Contributor+) PHP Object Injection
- Video Conferencing with Zoom <= 4.6.6 - Missing Authorization
- Builderall for WordPress <= 3.0.2 - Authenticated (Contributor+) Stored Cross-Site Scripting via Photo Module 'attributes' Setting
- Export User Data <= 2.2.6 - Authenticated (Subscriber+) PHP Object Injection
- JupiterX Core <= 4.8.11 - Authenticated (Contributor+) Stored Cross-Site Scripting
- Listly: Listicles For WordPress <= 2.7 - Unauthenticated Arbitrary Transient Deletion
- Easy Liveblogs <= 2.3.5 - Authenticated (Contributor+) Stored Cross-Site Scripting
- Event Monster <= 2.1.0 - Unauthenticated Insufficient Verification of Data Authenticity to Payment Bypass via em_capture_payment AJAX Action
- Image Captcha <= 1.2 - Cross-Site Request Forgery
- Contextual Related Posts <= 2.9.3 - Cross-Site Request Forgery
- MF Gig Calendar <= 1.1 - Reflected Cross-Site Scripting
- WP Register Profile With Shortcode <= 3.6.2 - Authenticated (Contributor+) Sensitive Information Exposure
- PPO Call To Actions <= 0.1.3 - Cross-Site Request Forgery to Stored Cross-Site Scripting
- Clever Addons for Elementor <= 2.2.0 - Authenticated (Author+) Stored Cross-Site Scripting
- Ajar in5 Embed <= 3.1.5 - Unauthenticated Arbitrary File Upload
- Advanced Google Maps <= 5.8.4 - Missing Authorization
- Contact form Form For All <= 1.2 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode
- TeraWallet - Wallet for WooCommerce <= 1.6.9 - Missing Authorization to Authenticated (Subscriber+) Wallet Balance Inflation
- TI WooCommerce Wishlist <= 2.7.3 - Unauthenticated Blind SQL Injection via Rest API
- Appointment Booking Plugin <= 5.7.2 - Unauthenticated SQL Injection via 'booking[service_id]' Parameter
- Hide Login+ <= 3.5.1 - Reflected Cross-Site Scripting
- Cream Blog, Fascinate, Glaze Blog Lite, & Everest News (All Versions) - Cross-Site Scripting
- EventON <= 2.4.1 - Authenticated (Contributor+) Local File Inclusion
- WP Statistics < 9.1.3 - Authenticated (Admin+) Stored Cross-Site Scripting
- Currency Switcher for WooCommerce <= 0.0.7 - Cross-Site Request Forgery
- Job Board Manager <= 2.1.61 - Authenticated (Job Poster+) Arbitrary Shortcode Execution
- Quotes Collection <= 2.5.2 - Authenticated (Admin+) SQL Injection
- WP Frontend Profile <= 1.2.1 - Cross-Site Request Forgery
- Simple YouTube Responsive <= 2.5 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode
- WP Super Cache <= 1.2 - Remote Code Execution
- Alt Text AI <= 1.10.41 - Missing Authorization to Authenticated (Subscriber+) Arbitrary Post Content Modification via atai_enrich_post_content AJAX Action
- Car Rental Manager <= 1.0.9 - Missing Authorization
- WP Profitshare <= 1.4.9 - Cross-Site Request Forgery to Stored Cross-Site Scripting
- BEAR <= 1.1.4.3 - Missing Authorization
- Widget Control Powered By Everyblock <= 1.0.1 - Reflected Cross-Site Scripting
- Shortcodes and extra features for Phlox theme <= 2.10.5 - PHP Objection Injection
- Tiger <= 2.0 - Reflected Cross-Site Scripting
- Indutri < 1.3.0 - Unauthenticated Local File Inclusion
- WordPress Automatic Plugin - AI content generator and auto poster plugin <= 3.115.0 - Authenticated (Author+) Arbitrary File Upload
- WordPress Shortcodes <= 1.6.36 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode
- PJ News Ticker <= 1.9.5 - Authenticated(Contributor+) Stored Cross-Site Scripting via shortcode
- GS Variation Swatches for WooCommerce <= 3.0.4 - Missing Authorization
- Community by PeepSo <= 6.2.6.0 - Reflected Cross-Site Scripting
- FacturaONE <= 5.36 - Unauthenticated Remote Code Execution
- North <= 5.7.5 - Authenticated (Contributor+) PHP Object Injection
- Activity Plus Reloaded for BuddyPress <= 1.1.2 - Missing Authorization
- Comments Ratings <= 1.1.6 - Cross-Site Request Forgery
- AffiliateWP <= 2.34.0 - Reflected Cross-Site Scripting
- Bot for Telegram on WooCommerce <= 1.2.7 - Authenticated (Subscriber+) Telegram Bot Token Disclosure to Authentication Bypass
- Astra <= 4.6.4 - Authenticated (Editor+) Stored Cross-Site Scripting via Theme Header/Footer
- Pix 4x sem juros - Pagaleve <= 1.6.9 - Unauthenticated PHP Object Injection
- Avenir-soft Direct Download <= 1.0 - Cross-Site Scripting
- EZ InLinkz linkup <= 0.18 - Authenticated (Contributor+) Stored Cross-Site Scripting
- Hero Mega Menu - Responsive WordPress Menu Plugin <= 1.16.5 - Reflected Cross-Site Scripting
- Hitsteps Web Analytics <= 5.86 - Cross-Site Request Forgery via hst_optionpage
- Multi Post Carousel by Category <= 1.4 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'slides' Shortcode Attribute
- ActiveCampaign for WooCommerce <= 1.9.6 - Missing Authorization to Error Log Deletion
- Table Addons for Elementor <= 2.1.2 - Authenticated (Contributor+) Stored Cross-Site Scripting via _id Parameter
- Clock In Portal <= 2.1 - Cross-Site Request Forgery To Staff Deletion
- FiveStar <= 1.7 - Unauthenticated Local File Inclusion
- Crelly Slider <= 1.4.6 - Authenticated (Admin+) Stored Cross-Site Scripting
- Sunshine Photo Cart <= 3.5.7.2 - Missing Authorization
- JetBlocks For Elementor <= 1.3.16 - Authenticated (Contributor+) Stored Cross-Site Scripting
- PeproDev WooCommerce Receipt Uploader <= 2.6.9 - Reflected Cross-Site Scripting
- Quiz And Survey Master <= 7.3.4 - Authenticated (Administrator+) SQL Injection
- Acerola <= 1.6.5 - Missing Authorization
- WP Video Posts <= 3.5.1 - Cross-Site Request Forgery to Remote Code Execution
- Document Gallery <= 5.1.0 - Unauthenticated Stored Cross-Site Scripting
- Widgets for Social Photo Feed <= 1.8 - Missing Authentication to Unauthenticated Plugin Settings Access/Update via trustindex_feed_hook_instagram REST API endpoints
- User Avatar – Reloaded <= 1.2.1 - Authenticated(Contributor+) Stored Cross-Site Scripting via Shortcode
- WP Bulk Delete <= 1.4.2 - Authenticated (Administrator+) SQL Injection via 'delete_user_roles' Parameter
- SeedProd Pro <= 6.18.12 - Authenticated (Editor+) SQL Injection
- Duplicate Post Page Menu & Custom Post Type <= 2.3.1 - Missing Authorization
- Masteriyo LMS <= 2.2.0 - Missing Authorization to Unauthenticated Course Progress Disclosure and Deletion
- Bit Assist <= 1.1.8 - Authenticated (Administrator+) Stored Cross-Site Scripting
- WebinarIgnition – Live, Automated & Evergreen Webinar System also for WooCommerce < 4.08.253 - Authenticated (Subscriber+) Arbitrary File Deletion
- Jibu Pro <= 1.7 - Authenticated Stored Cross-Site Scripting
- Steveas WP Live Chat Shoutbox <= 1.4.2 - Unauthenticated Stored Cross-Site Scripting
- Motor – Cars, Parts, Service, Equipments and Accessories WooCommerce Store < 3.1.0 - Local File Inclusion
- Chained Quiz <= 1.3.2 - Reflected Cross-Site Scripting via datef
- guzzlehttp/psr7 <= 1.84 and 2.0.0-2.1.0 - Improper Input Validation
- LetsRecover <= 1.1.0 - Authenticated (Admin+) SQL Injection
- Kids Planet - Children Kindergarten and Playgroup WordPress Theme <= 2.2.14.2 - Reflected Cross-Site Scripting
- Logo Slider <= 5.5 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'lgx_tooltip_position' Parameter
- SupportCandy – AI Customer Support Ticket System & Live Chatbot Agent <= 3.4.8 - Authenticated (Customer+) Stored Cross-Site Scripting
- JetFormBuilder — Dynamic Blocks Form Builder <= 3.6.4.1 - Missing Authorization
- Wheel of Life <= 1.1.8 - Missing Authorization
- Essential Real Estate <= 5.2.2 - Missing Authorization
- Content Writer <= 3.6.8 - Unauthenticated Information Exposure via Log File
- Timeline Module for Beaver Builder <= 1.1.3 - Authenticated (Editor+) Stored Cross-Site Scripting
- Developer Toolbar <= 1.0.3 - Unauthenticated Information Exposure
- Shortcodes and extra features for Phlox theme <= 2.9.8 - Authenticated (Contributor+) Stored Cross-Site Scripting
- WP Frontend Submit <= 1.1.0 - Reflected Cross-Site Scripting
- SKT Blocks – Gutenberg based Page Builder <= 1.8 - Authenticated (Contributor+) Stored Cross-Site Scripting
- SmokeSignal <= 1.2.6 - Cross-Site Scripting