Vulnerability archive: section 14, page 2
Open a report to review affected versions, available fixes and original sources. Each report covers a specific issue; its presence does not establish whether your website is affected.
- Grand News <= 3.4.3 - Reflected Cross-Site Scripting
- 10Web Map Builder for Google Maps <= 1.0.69 - Authenticated Stored Cross-Site Scripting
- Starbox <= 3.5.3 - Authenticated (Contributor+) Stored Cross-Site Scripting via Twitter URL Field
- BodyCenter - Gym, Fitness WooCommerce WordPress Theme <= 2.4 - Unauthenticated Local File Inclusion
- Werk aan de Muur <= 1.5 - Authenticated (Administrator+) Stored Cross-Site Scripting
- User Registration Using Contact Form 7 <= 2.4 - Cross-Site Request Forgery
- Projectopia – WordPress Project Management <= 5.1.16 - Missing Authorization to Authenticated (Subscriber+) Arbitrary Option Deletion
- WP Donate <= 1.4 - Unauthenticated SQL Injection in donate-display.php
- One User Avatar | User Profile Picture <= 2.5.4 - Authenticated (Subscriber+) Stored Cross-Site Scripting via wpua-file Parameter
- Advanced Custom Fields: Extended <= 0.9.2.5 - Unauthenticated Privilege Escalation via Validation Bypass to '_acf_post_id' Parameter
- Perfect Font Awesome Integration <= 2.3 - Authenticated (Contributor+) Stored Cross-Site Scripting
- Avirato hotels online booking engine <= 5.0.5 - Authenticated (Subscriber+) SQL Injection
- YourMembership Single Sign On <= 1.1.3 - Authenticated (Administrator+) Stored Cross-Site Scripting via plugin settings
- Feedzy <= 5.2.4 - Authenticated (Contributor+) Server-Side Request Forgery
- Beaver Builder Addons by WPZOOM <= 1.3.4 - Authenticated (Contributor+) Stored Cross-Site Scripting via Image Box Widget
- Fudousan Plugin <= 5.7.0 - Cross-Site Scripting
- WangGuard < 1.7.2 - Reflected Cross-Site Scripting
- Plugin Notes Plus <= 1.2.6 - Authenticated (Administrator+) Stored Cross-Site Scripting
- MainWP (Various extensions) - Cross-Site Request Forgery
- Csomagpontok és Címkék WooCommerce-hez < 4.2.8 - Missing Authorization
- Crowdfunding <= 2.2.0 - Insecure Direct Object Reference to Authenticated (Subscriber+) Order Data Disclosure
- Abandoned Cart Lite for WooCommerce <= 5.15.2 - Authenticated (Administrator+) Stored Cross-Site Scripting
- eRoom – Zoom Meetings & Webinar <= 1.4.6 - Missing Authorization via stm_wpcfto_get_settings_callback
- ListingPro Plugin <= 2.9.8 - Reflected Cross-Site Scripting
- Newspaper <= 11.5.1 - Reflected Cross-Site Scripting
- Soledad <= 8.4.1 - Authenticated (Contributor+) SQL Injection
- Visual Composer Website Builder <= 45.0 - Authenticated Stored Cross-Site Scripting via 'Text Block'
- Easy YouTube Gallery <= 1.0.4 - Authenticated (Contributor+) Stored Cross-Site Scripting
- Disable Comments | WPZest <= 1.51 - Authenticated (Administrator+) SQL Injection
- Participants Database <= 2.5.9.2 - Unauthenticated PHP Object Injection
- LGPD Framework <= 2.0.2 - Reflected Cross-Site Scripting
- Simple User Registration <= 6.4 - Authenticated (Contributor+) Privilege Escalation
- WP Go Maps (formerly WP Google Maps) <= 9.0.36 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode
- Companion Sitemap Generator <= 4.5.1.1 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode
- Community Events <= 1.5.1 - Unauthenticated SQL Injection
- Image Cleanup <= 1.9.2 - Missing Authorization
- JetFormBuilder — Dynamic Blocks Form Builder < 3.6.5.2 - Unauthenticated Email Header Injection
- CoolClock <= 4.3.7 - Authenticated (Contributor+) Stored Cross-Site Scripting
- Claspo – Popups, Spin the Wheel & Email Capture <= 1.0.7 - Missing Authorization
- Five Star Business Profile and Schema <= 2.3.19 - Authenticated (Editor+) Arbitrary Code Execution
- Option Tree <= 2.6.0 - PHP Object Injection
- Reviews and Rating – Google Reviews <= 5.10 - Authenticated (Contributor+) Stored Cross-Site Scripting via Multiple Shortcodes
- Project Showcase <= 1.1.1 - Authenticated (Contributor+) Stored Cross-Site Scripting
- Easy Social Icons <= 3.2.4 - Authenticated (Contributor+) Stored Cross-Site Scripting via shortcode
- Security & Malware scan by CleanTalk <= 2.50 - Missing Authorization
- Image Hover Effects <= 5.5 - Cross-Site Request Forgery
- Document Embedder <= 2.0.4 - Insecure Direct Object Reference to Authenticated (Author+) Arbitrary Document Library Entry Deletion
- Slash Admin <= 3.8.1 - Cross-Site Request Forgery
- Welcart e-Commerce <= 2.9.4 - Unauthenticated PHP Object Injection
- Shopping Cart & eCommerce Store <= 5.6.4 - Sensitive Information Exposure
- BuddyForms <= 2.7.7 - PHAR Deserialization
- Meta-box GalleryMeta <= 3.0.1 - Missing Authorization to Authenticated (Author+) Gallery Management
- Uber Menu <= 3.8.2 - Authenticated (Contributor+) Stored Cross-Site Scripting via Multiple Shortcodes
- Document Library Lite <= 1.1.7 - Unauthenticated Insecure Direct Object Reference
- FluentCart <= 1.5.2 - Insecure Direct Object Reference to Unauthenticated Order PII Disclosure
- TablePress – Tables in WordPress made easy <= 3.3.1 - Reflected Cross-Site Scripting
- Image Compressor & Optimizer - iLoveIMG <= 1.0.5 - Authenticated (Administrator+) PHP Object Injection
- AI Chatbot Free Models – Customer Support, Live Chat, Virtual Assistant <= 1.6.5 - Unauthenticated CSV Injection
- Auto Amazon Links – Amazon Associates Affiliate Plugin <= 5.4.2 - Reflected Cross-Site Scripting
- Gutentor – Gutenberg Blocks – Page Builder for Gutenberg Editor <= 3.4.8 - Authenticated (Contributor+) Stored Cross-Site Scripting via Multiple Widgets
- wpForo Forum <= 2.0.5 - Insecure Direct Object Reference to Forum Status Change
- ManageWP Worker <= 4.9.31 - Unauthenticated Stored Cross-Site Scripting via 'MWP-Key-Name' Header
- View All Post's Pages <= 0.9.0 - Reflected Cross-Site Scripting
- WP Encryption <= 7.8.6.6 - Authenticated (Administrator+) Arbitrary File Write via 'imploded' Parameter
- Limit Login Attempts <= 1.7.0 - Brute Force Bypass
- Associados Amazon Plugin <= 0.8 - Cross-Site Request Forgery to Stored Cross-Site Scripting
- Booster for WooCommerce <= 7.4.0 - Missing Authorization
- Google SEO Pressor Snippet <= 2.0 - Cross-Site Request Forgery
- FluentCRM Pro <= 3.1.12 - Authenticated (Author+) SQL Injection
- Custom Login Page <= 2.0 - Authenticated (Administrator+) Stored Cross-Site Scripting
- DirectoriesPro Plugin by SabaiApps <= 1.3.45 - Cross-Site Scripting via _drts_form_build_id, _t_ Parameters
- Sensei LMS – Online Courses, Quizzes, & Learning <= 4.19.2 - Authenticated (Teacher+) User Email Disclosure
- Logo Carousel <= 3.4.1 - Unauthorised Private Post Access
- SmartCrawl SEO checker, analyzer & optimizer < 3.16.3 - Missing Authorization
- Spirit Framework <= 1.2.13 - Authenticated (Subscriber+) Local File Inclusion
- SEOPress – On-site SEO <= 8.1.1 - Reflected Cross-Site Scripting
- Block for Font Awesome <= 1.4.0 - Cross-Site Request Forgery
- Betheme <= 26.6.2 - Missing Authorization to Theme Settings Update
- Magical Addons For Elementor <= 1.2.1 - Authenticated (Subscriber+) Server-Side Request Forgery
- తెలుగు బైబిల్ వచనములు <= 1.0 - Cross-Site Request Forgery to Cross-Site Scripting
- Originality.ai AI Checker <= 1.0.16 - Missing Authorization to Authenticated (Subscriber+) Sensitive Information Disclosure via 'ai_get_table'
- RegistrationMagic - Custom Registration Forms, User Registration and User Login Plugin <= 4.6.0.2 - SQL Injection
- UrbanGo Membership <= 1.0.4 - Unauthenticated Privilege Escalation
- Qubely <= 1.8.14 - Authenticated (Contributor+) Sensitive Information Exposure
- Contact Form by Supsystic <= 1.7.36 - Unauthenticated Server-Side Template Injection via Prefill Functionality
- Collapse-O-Matic <= 1.8.5.5 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode
- IgniteUp – Coming Soon and Maintenance Mode <= 3.4 - Unauthenticated Arbitrary File Deletion
- Rapyd Payment Extension for WooCommerce <= 1.2.0 - Unauthenticated PHP Object Injection
- Fusion <= 2.1 - Arbitrary File Deletion
- Cab Grid <= 1.5.15 - Authenticated (Administrator+) Stored Cross-Site Scripting
- Easy Table of Contents <= 2.0.45.2 - Missing Authorization via eztoc_reset_options_to_default
- Royal Elementor Addons <= 1.3.59 - Insufficient Access Control to Template Kit Import
- NextScripts: Social Networks Auto-Poster <= 4.3.24 - Arbitrary Post Deletion via Cross-Site Request Forgery
- GiveWP <= 2.21.2 - Authenticated (Admin+) Stored Cross-Site Scripting
- Auto Save Remote Images (Drafts) <= 1.0.9 - Authenticated (Contributor+) Server-Side Request Forgery
- CodeBard's Patron Button and Widgets for Patreon <= 2.1.8 - Reflected Cross-Site Scripting via 'site_account'
- RentSyst – CRM solution for fleet management <= 2.1.3 - Missing Authorization
- E-cab Taxi Booking Manager for Woocommerce <= 2.1.1 - Missing Authroization
- Auto Post Scheduler <= 1.84 - Cross-Site Request Forgery to Stored Cross-Site Scripting via aps_options_page
- FiboSearch – Ajax Search for WooCommerce < 1.34.1 - Unauthenticated Information Exposure