Vulnerability archive: section 14, page 25
Open a report to review affected versions, available fixes and original sources. Each report covers a specific issue; its presence does not establish whether your website is affected.
- Import and export users and customers <= 1.26.6.1 - Authenticated (Administrator+) Stored Cross-Site Scripting
- Export Post Info <= 1.1.0 - Authenticated (Administrator+) Stored Cross-Site Scripting
- HashBar – Announcement, Notification Bar & Popup Campaign <= 2.0.3 - Authenticated (Administrator+) SQL Injection
- Geo Controller <= 8.6.4 - Unauthenticated PHP Object Injection via shortcode REST API Route
- Import WP – Import and Export WordPress data to XML or CSV files <= 2.4.5 - Authenticated Arbitrary File Upload
- Futurio Extra <= 2.0.13 - Authenticated (Contributor+) Post Disclosure
- Invoice Generator <= 1.0.0 - Unauthenticated Account Takeover via Weak Password Reset Validation via 'reset_user_id' Parameter
- WP Dummy Content Generator <= 3.4.6 - Missing Authorization to Authenticated (Subscriber+) Arbitrary User Deletion
- My AskAI <= 1.0.0 - Authenticated (Contributor+) Stored Cross-Site Scripting
- Groundhogg — CRM, Newsletters, and Marketing Automation < 4.4.1 - Missing Authorization
- WP Mobile Menu – The Mobile-Friendly Responsive Menu <= 2.8.4.2 - Authenticated (Contributor+) Stored Cross-Site Scripting via Image Alt
- RightMessage WP <= 0.9.7 - Authenticated (Contributor+) Stored Cross-Site Scripting
- Hippoo Mobile App for WooCommerce <= 1.9.4 - Unauthenticated Authentication Bypass to Administrator Account Takeover via REST API
- IDonate < 2.1.13 - Missing Authorization
- Templately <= 3.1.5 - Missing Authorization via AJAX actions
- Exclusive Addons for Elementor <= 2.6.9 - Authenticated (Contributor+) Stored Cross-Site Scripting via Countdown Timer Widget
- Mamita <= 1.0.9 - Unauthenticated Local File Inclusion
- Discy <= 5.1 - Cross-Site Request Forgery to Settings Reset
- WaMate Confirm <= 2.0.2 - Missing Authorization to Authenticated (Subscriber+) Arbitrary Phone Number Blocking/Unblocking
- Community Events <= 1.4.7 - Reflected Cross-Site Scripting
- Media from FTP <= 11.16 - Authenticated (Author+) Improper Privilege Management
- Contest Gallery <= 28.0.0 - Cross-Site Request Forgery
- JetBackup <= 2.0.9.7 - Sensitive Information Exposure via Directory Listing
- Gmedia Photo Gallery <= 1.6.4 - Cross-Site Scripting
- Directory Listings WordPress plugin – uListing <= 2.2.0 - Missing Authorization to Authenticated (Subscriber+) Arbitrary Post Meta Update and PHP Object Injection
- Bulk Delete Users by Email <= 1.2 - Cross-Site Request Forgery
- InstaSqueeze Sexy Squeeze Pages (All Known Versions) - Cross-Site Scripting
- wpForo Forum <= 2.1.8 - Reflected Cross-Site Scripting via 'wpforo_debug'
- RepairBuddy – Repair Shop CRM & Booking Plugin for WordPress <= 4.1225 - Authenticated (Customer+) Stored Cross-Site Scripting
- Ultimate WP Mail <= 1.3.4 - Cross-Site Request Forgery
- Companion Portfolio – Responsive Portfolio Plugin <= 2.4.0.1 - Authenticated (Contributor+) Stored Cross-Site Scripting
- Photos, Files, YouTube, Twitter, Instagram, TikTok, Ecommerce Contest Gallery – Upload, Vote, Sell via PayPal, Social Share Buttons <= 26.0.0.1 - Unauthenticated Stored Cross-Site Scripting
- ElementInvader Addons for Elementor <= 1.2.4 - Authenticated (Contributor+) Stored Cross-Site Scripting
- Wallstreet <= 2.8.6 - Cross-Site Request Forgery
- Thumbnail carousel slider <= 1.1.9 - Reflected Cross-Site Scripting
- MaxSlider <= 1.2.3 - Authenticated (Contributor+) Local File Inclusion
- WooCommerce Cart Count Shortcode <= 1.0.4 - Authenticated (Contributor+) Stored Cross-Site Scripting
- WIP WooCarousel Lite <= 1.1.7 - Cross-Site Request Forgery to Stored Cross-Site Scripting
- WP Activity Log <= 5.6.6 - Authenticated (Administrator+) SQL Injection
- Weblizar Pin Feeds < 1.1.2 - Cross-Site Request Forgery
- Percent to Infograph <= 1.0 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode Attributes
- Simple Calendar <= 3.1.42 - Cross-Site Request Forgery to Transient Cache Clearing
- Directorist Booking <= 2.4.1 - Unauthenticated SQL Injection
- Plugin: Newsletter <= 1.5 - Arbitrary File Read
- WP2Social Auto Publish <= 2.4.12 - Authenticated (Administrator+) Stored Cross-Site Scripting via 'pages' Parameter
- Redirection for Contact Form 7 2.2.7 - 3.2.10 - Unauthenticated Arbitrary Shortcode Execution
- GSheetConnector For Gravity Forms <= 1.3.23 - Cross-Site Request Forgery to Arbitrary Plugin Activation/Deactivation
- WP – Bulk SMS – by SMS.to <= 1.0.12 - Reflected Cross-Site Scripting
- Château <= 1.2.1 - Unauthenticated PHP Object Injection
- Jet Engine <= 3.6.2 - Authenticated (Contributor+) Stored Cross-Site Scripting via list_tag Parameter
- Wanderland <= 1.5 - Missing Authorization
- WPFunnels – Funnel Builder for WooCommerce with Checkout & One Click Upsell <= 3.13.1 - Unauthenticated Stored Cross-Site Scripting
- wp-nano-ad <= 1.31 - Authenticated (Administrator+) Stored Cross-Site Scripting via blogrole_link Parameter
- Simple Membership <= 4.3.8 - Reflected Cross-Site Scripting
- Review Ratings <= 1.6 - Cross-Site Request Forgery to Stored Cross-Site Scripting
- ShopWP <= 5.2.4 - Missing Authorization
- ScanCircle <= 2.9.2 - Authenticated (Contributor+) Stored Cross-Site Scripting
- Email Customizer for WooCommerce | Drag and Drop Email Templates Builder <= 2.6.0 - Information Exposure
- Coupon Affiliates – Affiliate Plugin for WooCommerce <= 7.8.1 - Authenticated (Subscriber+) Information Exposure
- Wordfence Security – Firewall & Malware Scan 6.1.1 - 6.1.6 - Reflected Cross-Site Scripting
- Gravity Upload Ajax <= 1.1 - Unrestricted File Upload
- Smart Online Order for Clover <= 1.5.6 - Missing Authorization
- SKT Page Builder <= 4.1 - Missing Authorization to Authenticated(Subscriber+) Content Injection
- Gravity Forms <= 2.9.30 - Unauthenticated Stored Cross-Site Scripting via Credit Card 'Card Type' Sub-Field
- Cryptocurrency All-in-One <= 3.0.19 - Authenticated (Contributor+) Stored Cross-Site Scripting
- WP DSGVO Tools (GDPR) <= 3.1.39 - Missing Authorization to Unauthenticated Sensitive Personal Data Disclosure via subject-access-request AJAX Endpoint (process_now/is_ajax Parameters)
- File Manager Pro <= 8.3.9 - Unauthenticated Limited JavaScript File Upload
- uReach <= 1.3.3 - Unauthenticated Local File Inclusion
- Docket Cache <= 24.07.03 - Unauthenticated Local File Inclusion
- WordPress Uninstall <= 1.2.1 - Cross-Site Request Forgery to Site Reset
- AI Twitter Feeds (Twitter widget & shortcode) <= 2.4 - Authenticated (Contributor+) Stored Cross-Site Scripting
- Affiliate Super Assistent <= 1.10.1 - Unauthenticated Stored Cross-Site Scripting
- Voldor <= 1.0.0 - Reflected Cross-Site Scripting
- Related Posts for WordPress <= 2.1.2 - Authenticated (Administrator+) Stored Cross-Site Scripting
- Spiffy Calendar <= 4.9.1 - Authenticated (Contributor+) SQL Injection
- Account Switcher <= 1.0.2 - Authenticated (Subscriber+) Authentication Bypass to Privilege Escalation
- WordPress Core < 3.9.2 - Brute Force of Cross-Site Request Forgery Tokens
- Multiple Themes (Various Versions) - Reflected Cross-Site Scripting
- Accept PayPal Payments using Contact Form 7 <= 4.0.6 - Missing Authorization
- BuddyForms <= 2.8.9 - Email Verification Bypass due to Insufficient Randomness
- Uncanny Automator Pro < 5.3.0.1 - Missing Authorization to Unauthenticated License Setting Reset
- Vapester <= 1.1.10 - Unauthenticated Local File Inclusion
- WP Last Modified Info <= 1.9.5 - Insecure Direct Object Reference to Authenticated (Author+) Post Metadata Modification
- User Registration <= 4.0.3 - Authenticated (Administrator+) Stored Cross-Site Scripting
- Affiliate Super Assistent <= 1.10.2 - Unauthenticated Stored Cross-Site Scripting via ‘doCommentShortcode’ function
- Quotes and Tips by BestWebSoft < 1.3.2 - Reflected Cross-Site Scripting
- Giardino <= 1.1.10 - Unauthenticated Local File Inclusion
- IndieBlocks <= 0.13.1 - Unauthenticated Server-Side Request Forgery
- GeoDirectory – WP Business Directory Plugin and Classified Listings Directory <= 2.8.161 - Authenticated (Subscriber+) Server-Side Request Forgery
- Namaste! LMS <= 2.6.4.1 - Cross-Site Request Forgery
- miniOrange OTP Login, Verification and SMS Notifications <= 5.5.7 - Unauthenticated Privilege Escalation
- MC Woocommerce Wishlist <= 1.7.2 - Missing Authorization
- Analytify – Google Analytics Dashboard For WordPress <= 4.2.2 - Cross-Site Request Forgery
- SULly <= 4.3.0 - Cross-Site Request Forgery to Stored Cross-Site Scripting
- Swift Framework < 2024.0.0 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode
- Page Builder: Live Composer <= 1.5.42 - Authenticated (Contributor+) Stored Cross-Site Scripting
- Sprout Clients <= 3.2.2 - Authenticated (Contributor+) Stored Cross-Site Scripting
- PayU CommercePro < 3.9.0 - Missing Authorization
- Image Hover Effects – Elementor Addon <= 1.4 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'eihe_align'
- WordPress Core <= 2.2.1 - SQL Injection