Vulnerability archive: section 13, page 8
Open a report to review affected versions, available fixes and original sources. Each report covers a specific issue; its presence does not establish whether your website is affected.
- WebPurify Profanity Filter <= 4.0.2 - Missing Authorization to Unauthenticated Plugin Settings Change via webpurify_save_options
- Sunshine Photo Cart <= 2.9.13 - Cross-Site Request Forgery
- MasterStudy LMS <= 3.7.49 - Missing Authorization
- Visitor Traffic Real Time Statistics <= 1.12 - Cross-Site Request Forgery
- Realia <= 0.9.1 - Reflected Cross-Site Scripting
- VikBooking Hotel Booking Engine & PMS <= 1.6.7 - Reflected Cross-Site Scripting
- Post List With Featured Image <= 1.2 - Reflected Cross-Site Scripting
- Widget Manager Light <= 1.18 - Missing Authorization
- JetFormBuilder <= 3.5.3 - Missing Authorization
- Directory Listings WordPress plugin – uListing <= 2.2.0 - Authenticated (Editor+) Arbitrary File Download
- Intro Tour Tutorial DeepPresentation <= 6.5.2 - Reflected Cross-Site Scripting
- 1003 Mortgage Application <= 1.75 - Authenticated (Subscriber+) Arbitrary File Download
- Accredible Certificates & Open Badges <= 1.4.8 - Authenticated (Administrator+) Stored Cross-Site Scripting via settings
- Smart Forms <= 2.6.93 - Missing Authorization
- Icegram Collect <= 1.3.8 - Authenticated(Contributor+) Cross-Site Scripting via Shortcode
- WordPress Exit Strategy <= 1.55 - Information Exposure
- GDPR Cookie Compliance <= 4.15.6 - Authenticated (Admin+) Stored Cross-Site Scripting
- Cartpauj Register Captcha <= 1.0.02 - CAPTCHA Bypass
- WS Facebook Like Box Widget <= 5.0 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode
- Page Builder: Pagelayer – Drag and Drop website builder <= 2.0.0 - Reflected Cross-Site Scripting via login_url Parameter
- Peter’s Random Anti-Spam Image <= 1.0.6 - Cross-Site Scripting
- Sidebar-Content from Shortcode <= 2.0 - Authenticated (Contributor+) Stored Cross-Site Scripting
- WP ALL Export Pro <= 1.7.8 - Authenticated Remote Code Execution
- WordPress Core <= 2.8.5 - Arbitrary File Upload
- Structured Content <= 1.6.1 - Authenticated (Contributor+) Stored Cross-Site Scripting via Classic Editor Shortcode
- Shaha | Islamic Centre & Mosque Theme + RTL <= 1.1.2 - Unauthenticated Local File Inclusion
- Types <= 3.4.17 - Authenticated (Administrator+) Arbitrary File Upload
- SiteBuilder Dynamic Components <= 1.0 - PHP Object Injection
- Blog Designer PRO <= 3.4.7 - Authenticated (Subscriber+) Local File Inclusion
- AJAX Hits Counter + Popular Posts Widget <= 0.10.210305 - Missing Authorization
- Hustle – Email Marketing, Lead Generation, Optins, Popups <= 7.8.14.2 - Missing Authorization
- Bus Ticket Booking with Seat Reservation < 5.6.8 - Missing Authorization
- Table of Contents Plus <= 2106 - Authenticated (Administrator+) Stored Cross-Site Scripting
- Image Gallery – Responsive Photo Gallery <= 1.7.0 - Reflected Cross-Site Scripting via linkbutton
- Simple Google Photos Grid <= 1.5 - Authenticated (Contributor+) Server-Side Request Forgery
- JetEngine <= 3.8.14.2 - Unauthenticated Stored Cross-Site Scripting
- Premium Addons for Elementor <= 4.10.16 - Authenticated(Contributor+) Stored Cross-Site Scripting via Wrapper Link Widget
- Simple Membership <= 4.3.8 - Reflected Cross-Site Scripting Vulnerability via environment_mode
- WP BASE Booking of Appointments, Services and Events <= 6.3.1 - Authenticated (Subscriber+) Privilege Escalation
- Biolife <= 3.2.3 - Authenticated (Contributor+) Local File Inclusion
- Cornerstone <= 0.8.0 - Reflected Cross-Site Scripting
- Recipe Card Blocks for Gutenberg & Elementor <= 3.4.8 - Incorrect Authorization
- Zalo Live Chat <= 1.1.0 - Reflected Cross-Site Scripting
- Widget for Google Reviews <= 1.0.15 - Unauthenticated Local File Inclusion
- Multiple Plugins <= (Various Versions) - Authenticated (Contributor+) Stored DOM-Based Cross-Site Scripting via ThickBox JavaScript Library
- Github Shortcode <= 0.1 - Authenticated (Contributor+) Stored Cross-Site Scripting
- Uploading SVG, WEBP and ICO files <= 1.0.1 - Arbitrary File Upload
- Ultimate Auction Pro <= 2.4.5 - Unauthenticated Stored Cross-Site Scripting
- MDJM Event Management <= 1.7.8.4 - Authenticated (Subscriber+) Privilege Escalation via 'set-permissions' and 'change_role' Handlers
- Events Manager <= 6.4.7.1 - Cross-Site Request Forgery
- JobWP <= 2.4.0 - Cross-Site Request Forgery
- Booknetic <= 4.0.9 - Cross-Site Request Forgery
- Unlimited Elements For Elementor <= 2.0.6 - Authenticated (Contributor+) Arbitrary File Read via Path Traversal in Repeater JSON/CSV URL with Path Traversal
- RecordBrowser <= 1.1.7 - Unauthenticated SQL Injection
- Builderall for WordPress <= 3.0.1 - Authenticated (Contributor+) Remote Code Execution
- Visual Composer Website Builder <= 45.16.2 - Authenticated (Contributor+) Stored Cross-Site Scripting
- Wishlist Member X <= 3.34.1 - Unauthenticated Account Takeover via 'mergewith' Parameter
- Shipping with Venipak for WooCommerce <= 1.22.4 - Reflected Cross-Site Scripting
- Muslim Prayer Time BD <= 2.4 - Cross-Site Request Forgery to Settings Reset
- YouTube Embed – YouTube Gallery, Vimeo Gallery – WordPress Plugin 10.0 - 10.3 - Unauthenticated Stored Cross-Site Scripting
- WP Lyrics <= 0.4.1 - Cross-Site Request Forgery to Stored Cross-Site Scripting
- WP Hotel Booking < 2.3.2 - Authenticated (Custom role+) SQL Injection
- Media Library Assistant <= 3.18 - Authenticated (Author+) Arbitrary File Upload via mla-inline-edit-upload-scripts AJAX Action
- Borderless – Widgets, Elements, Templates and Toolkit for Elementor & Gutenberg <= 1.5.3 - Authenticated (Contributor+) Stored Cross-Site Scripting
- Bold Page Builder < 5.9.9 - Authenticated (Contributor+) Stored Cross-Site Scripting
- WP Easy Gallery <= 4.8.5 - Authenticated (Contributor+) SQL Injection via key Parameter
- TPG Get Posts <= 3.6.5 - Authenticated (Contributor+) Stored Cross-Site Scripting
- WP-Polls <= 2.71 - SQL Injection
- WP All Export <= 1.4.14 - Unauthenticated Sensitive Information Exposure via PHP Type Juggling
- Icegram Express - Email Subscribers, Newsletters and Marketing Automation Plugin <= 5.7.14 - Unauthenticated SQL Injection
- SP Project & Document Manager < 2.4.4 - Multiple SQL Injection
- wpForo Forum <= 3.1.0 - Unauthenticated PHP Object Injection
- RegistrationMagic – Custom Registration Forms, User Registration, Payment, and User Login <= 6.0.4.3 - Authenticated (Subscriber+) Stored Cross-Site Scripting
- Geo Mashup <= 1.13.12 - Authenticated (Contributor+) Stored Cross-Site Scripting
- FW Gallery <= 8.0.0 - Unauthenticated Arbitrary File Deletion
- Radcliffe 2 <= 2.0.17 - Missing Authorization
- HAPPY <= 1.0.8 - Missing Authorization
- WP Support Plus Responsive Ticket System <= 9.0.2 - SQL Injection
- Gaea < 3.8 - Reflected Cross-Site Scripting
- SiteAlert (Formerly WP Health) <= 1.9.8 - Missing Authorization to Unauthenticated Site Health Information Exposure
- Page Restrict <= 2.5.5 - Cross-Site Request Forgery via pr_admin_page
- Import / Export Customizer Settings <= 1.0.3 - Cross-Site Request Forgery Bypass
- WP-FB-AutoConnect <= 4.6.3 - Authenticated (Administrator+) Stored Cross-Site Scripting
- AdForest <= 6.0.12 - Authentication Bypass
- Ui Slider Filter By Price <= 1.1 - Cross-Site Request Forgery
- Booking calendar, Appointment Booking System <= 3.2.36 - Unauthenticated Stored Cross-Site Scripting
- Content Blocks Builder <= 2.7.6 - Authenticated (Contributor+) Stored Cross-Site Scripting
- Link Whisper Free <= 0.7.1 - Authenticated (Contributor+) PHP Object Injection
- Trash Duplicate and 301 Redirect <= 1.9 - Missing Authorization to Unauthenticated Arbitrary Post Deletion
- Auto Featured Image (Auto Post Thumbnail) <= 5.0.4 - Authenticated (Contributor+) Server-Side Request Forgery
- DELUCKS SEO <= 2.5.9 - Authenticated (Contributor+) Stored Cross-Site Scripting
- AppPresser <= 4.3.2 - Improper Missing Encryption Exception Handling to Authentication Bypass
- Vitepos <= 3.5.0 - Authenticated (Outlet Manager+) Privilege Escalation
- WP Ultimate Exporter < 1.1 - Reflected Cross-Site Scripting
- ProjectHuddle Client Site <= 1.0.34 - Missing Authorization via ph_child_ajax_notice_handler
- Image Regenerate & Select Crop <= 7.3.0 - Sensitive Information Exposure
- WorkScout-Core < 1.7.06 - Reflected Cross-Site Scripting
- CozyStay - Hotel Booking WordPress Theme <= 1.10.0 - Unauthenticated Stored Cross-Site Scripting
- PickPlugins Product Slider for WooCommerce <= 1.13.41 - Authenticated (Contributor+) Stored Cross-Site Scripting
- Fusion <= 2.1 - Arbitrary File Download