Vulnerability archive: section 14, page 7
Open a report to review affected versions, available fixes and original sources. Each report covers a specific issue; its presence does not establish whether your website is affected.
- Ninja Tables <= 4.3.4 - Authenticated (Administrator+) Stored Cross-Site Scripting via plugin settings
- TrueBooker – Appointment Booking and Scheduler System <= 1.1.9 - Missing Authorization
- Payment Form for PayPal Pro <= 1.1.72 - Authenticated (Administrator+) Stored Cross-Site Scripting
- Visual Portfolio, Photo Gallery & Post Grid <= 3.5.1 - Authenticated (Subscriber+) Local File Inclusion
- WordPress Core < 2.8.4 - Forced Password Reset
- Breeze <= 2.1.3 - Authenticated (Administrator+) Stored Cross-Site Scripting via breeze_api_token
- CMB2 <= 2.12.0 - Missing Authorization
- Social Web Suite <= 4.1.12 - Unauthenticated SQL Injection
- Pie Calendar <= 1.2.8 - Authenticated (Contributor+) Stored Cross-Site Scripting
- Tree Sitemap (Pages, Posts & Categories list) <= 2.9 - Cross-Site Request Forgery to Arbitrary Plugin Installation/Activation
- Predictive Search for WooCommerce <= 1.0.5 - Cross-Site Scripting
- WordPress Core <= 2.1.2 - Cross-Site Scripting
- CTHthemes CityBook <= 2.3.3, TownHub <= 1.0.5, and EasyBook <= 1.2.1 - Stored Cross-Site Scripting
- My Calendar <= 3.3.16 - Administrator+ Stored Cross-Site Scripting
- WPBot – ChatBot Conversational Forms <= 1.5.0 - Authenticated (Subscriber+) PHP Object Injection
- WCS QR Code Generator <= 1.0 - Authenticated (Contributor+) Stored Cross-Site Scripting
- BizPrint <= 4.5.1 - Missing Authorization in showTemplatePreview
- semver-regex <= 3.1.3 and 4.0.0-4.0.3 - Regular Expression Denial of Service (ReDoS)
- Power Ups for Elementor <= 1.2.2 - Authenticated (Contributor+) Stored Cross-Site Scripting
- DK PDF <= 1.9.6 - Reflected Cross-Site Scripting
- AI Engine <= 3.6.5 - Cross-Site Request Forgery to Privilege Escalation via REQUEST_URI Substring Match
- Pondol Carousel <= 1.0 - Reflected Cross-Site Scripting
- Greenshift <= 12.8.9 - Authenticated (Contributor+) Stored Cross-Site Scripting via disablelazy Attribute
- 소셜 공유 버튼 By 코스모스팜 <= 1.9 - Authenticated (Contributor+) Stored Cross-Site Scripting
- Gutenberg Blocks by Kadence Blocks – Page Builder Features <= 3.2.36 - Authenticated (Contributor+) Stored Cross-Site Scripting
- Testimonial Slider <= 2.0.15 - Missing Authorization
- Get Youtube Subs <= 3.5 - Authenticated (Contributor+) Stored Cross-Site Scripting via subscribe_link_att Function
- Simple Theme Changer <= 1.0 - Cross-Site Request Forgery to Arbitrary Theme Switcher Configuration Update
- Community by PeepSo – Social Network, Membership, Registration, User Profiles < 1.6.1 - Privilege Escalation
- Microblog Poster < 1.6.2 - Authenticated Blind SQL Injection
- BA Book Everything <= 1.6.20 - Cross-Site Request Forgery to Email Address Update/Account Takeover
- IP Based Login <= 2.4.2 - Authenticated (Administrator+) Stored Cross-Site Scripting
- Woffice Core <= 5.4.8 - Missing Authorization
- Featured Image from URL <= 4.8.1 - Missing Authorization
- go Social <= 1.0 - Cross-Site Request Forgery to Stored Cross-Site Scripting
- WP-jScrollPane <= 2.0.3 - Reflected Cross-Site Scripting
- Funnelforms Free <= 3.3.9 - Unauthenticated Stored Cross-Site Scripting
- wpForo Forum <= 3.1.6 - Authenticated (Subscriber+) Stored Cross-Site Scripting via 'telegram' Profile Field
- Teddy Bear Customize Addon <= 1.0.5 - Unauthenticated Privilege Escalation via Account Takeover
- Tutor LMS – eLearning and online course solution <= 2.6.2 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'tutor_instructor_list' Shortcode
- WP Maintenance <= 6.0.7 - Authenticated (Admin+) Cross-Site Scripting
- Fantastic Content Protector Free <= 2.6 - Missing Authorization via update_setting_fantastic_content_protector
- Timeline and History slider <= 2.3 - Authenticated (Contributor+) Local File Inclusion
- Mission <= 1.22 - Unauthenticated PHP Object Injection
- WP Travel Engine <= 5.7.9 - Authenticated (Administrator+) SQL Injection
- Frontend Admin by DynamiApps <= 3.29.9 - Authenticated (Subscriber+) Arbitrary Password Reset via Encrypted Object Token
- Journey Analytics <= 1.0.12 - Cross-Site Request Forgery
- Kali Forms <= 2.1.1 - Unauthenticated Arbitrary Post Deletion
- Multiple Plugins and Themes <= (Various Versions) - Authenticated (Contributor+) DOM-Based Stored Cross-Site Scripting via lightGallery JavaScript Library
- Absolute Reviews <= 1.0.8 - Cross-Site Request Forgery Bypass
- WP Extended Search <= 2.1.1 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode
- Flags Widget <= 1.0.7 - Cross-Site Request Forgery to Stored Cross-Site Scripting
- SP Project & Document Manager <= 4.59 - Reflected Cross-Site Scripting
- Vikinger <= 1.9.30 - Authenticated (Subscriber+) Privilege Escalation via 'vikinger_user_meta_update_ajax'
- RegistrationMagic – User Registration Plugin with Custom Registration Forms <= 6.0.2.6 - Unauthenticated Privilege Escalation via Password Recovery
- Zoho Billing – Embed Payment Form <= 4.0 - Authenticated (Contributor+) Stored Cross-Site Scripting
- Post and Page Builder by BoldGrid <= 1.27.9 - Missing Authorization
- Sticky Buttons <= 4.1.1 - Cross-Site Request Forgery to Settings Update
- Awake <= 3.3 - Arbitrary File Download
- Pootle Pagebuilder – WordPress Page builder <= 5.7.1 - Authenticated (Contributor+) Stored Cross-Site Scripting
- Spacious <= 1.9.11 - Missing Authorization to Autheticated (Subscriber+) Demo Data Import
- Steel <= 1.3.0 - Authenticated (Contributor+) Stored Cross-Site Scripting via btn Shortcode
- Royal Elementor Addons <= 1.3.59 - Insufficient Access Control to Plugin Deactivation
- WP Statistics – Simple, privacy-friendly Google Analytics alternative <= 14.16.13 - Unauthenticated Stored Cross-Site Scripting
- Dark Mode for WP Dashboard <= 1.2.3 - Cross-Site Request Forgery
- WP Statistics <= 13.1.5 - Unauthenticated Stored Cross-Site Scripting via IP
- Tagembed: Social Media Feeds and Customer Reviews Widget <= 7.4 - Unauthenticated Stored Cross-Site Scripting
- Auto ThickBox Plus <= 1.9 - Reflected Cross-Site Scripting
- HT Mega <= 2.3.3 - Cross-Site Request Forgery via Several Functions
- Membership & User Roles for WooCommerce (Automatic Role Changer) <= 20260828 - Authenticated (Subscriber+) Privilege Escalation to Stale Foreign Role Cache
- My IDX Home Search <= 2.1.1 - Authenticated (Contributor+) Stored Cross-Site Scripting
- WP Docs <= 2.3.3 - Authenticated (Subscriber+) Stored Cross-Site Scripting
- Preserve Code Formatting <= 4.0.1 - Authenticated (Contributor+) PHP Object Injection
- FancyTabs <= 1.1.0 - Authenticated (Contributor+) Stored Cross-Site Scripting via title Parameter
- MasterStudy LMS Pro < 4.7.16 - Missing Authorization
- Kali Forms <= 2.1.1 - Cross-Site Request Forgery
- Custom WooCommerce Checkout Fields Editor <= 1.3.4 - Cross-Site Request Forgery
- Bonway Static Block Editor <= 1.1.0 - Authenticated (Contributor+) Stored Cross-Site Scripting
- XO Event Calendar <= 2.3.6 - Reflected Cross-Site Scripting
- WP-BusinessDirectory <= 3.1.5 - Reflected Cross-Site Scripting
- MasterStudy LMS <= 3.6.20 - Missing Authorization
- Royal Elementor Addons <= 1.7.1001 - Reflected Cross-Site Scripting
- WP Photo Album Plus <= 9.3.02.002 - Unauthenticated Stored Cross-Site Scripting
- Simple Spoiler <= 1.2 - Authenticated (Admin+) Stored Cross-Site Scripting
- Wr Age Verification <= 2.0.0 - Authenticated (Subscriber+) SQL Injection
- Ultimate Member <= 2.0.17 - Authenticated Cross-Site Scripting
- Motors – Car Dealership & Classified Listings Plugin < 1.4.110 - Cross-Site Request Forgery
- Event Tickets and Registration <= 5.19.1.1 - Missing Authorization to Ticket Deletion
- JetEngine <= 3.8.6.1 - Unauthenticated SQL Injection via Listing Grid 'filtered_query' Parameter
- Photo Reviews for WooCommerce <= 1.2.30 - Unauthenticated Insecure Direct Object Reference
- Product Addons & Fields for WooCommerce <= 32.0.18 - Unauthenticated Arbitrary File Upload via ppom_upload_file
- pCloud WP Backup <= 2.0.7 - Cross-Site Request Forgery
- MStore API <= 3.9.1 - Authentication Bypass
- Email Tracker <= 5.3.15 - Authenticated (Admin+) SQL Injection
- OmniLeads Scripts and Tags Manager <= 1.3 - Cross-Site Request Forgery to Stored Cross-Site Scripting
- Advanced Database Cleaner <= 3.1.1 - Cross-Site Request Forgery via aDBc_save_settings_callback
- Import and export users and customers <= 1.14.0.2 - Cross-Site Request Forgery
- Popup Maker WP <= 1.4.5 - Missing Authorization
- Primary Addon for Elementor <= 1.5.8 - Authenticated (Contributor+) Stored Cross-Site Scripting
- Frames <= 1.5.7 - Missing Authorization