Vulnerability archive: section 14, page 9
Open a report to review affected versions, available fixes and original sources. Each report covers a specific issue; its presence does not establish whether your website is affected.
- Travel Booking WordPress Theme <= 3.2.9 - Unauthenticated SQL Injection
- Booking Package <= 1.6.27 - Unauthenticated Price Manipulation
- NitroPack <= 1.16.7 - Unauthenticated Arbitrary Shortcode Execution
- Content Manager Light <= 3.2 - Reflected Cross-Site Scripting
- 코드엠샵 소셜톡 <= 1.1.18 - Authenticated (Contributor+) Stored Cross-Site Scripting via add_plus_friends and add_plus_talk Shortcodes
- Bookster – WordPress Appointment Booking Plugin <= 2.1.1 - Authenticated (Administrator+) SQL Injection via 'raw'
- Easing Slider <= 2.2.0.6 - Cross-Site Scripting
- Email Marketing for WooCommerce by Omnisend <= 1.13.8 - Sensitive Information Exposure
- WP PHP Widget <= 1.0.2 - Full Path Disclosure
- Woocommerce – Loi Hamon <= 1.1.0 - Cross-Site Request Forgery to Stored Cross-Site Scripting
- Premium Packages – Sell Digital Products Securely <= 6.2.0 - Missing Authorization
- Eventin <= 4.1.19 - Authenticated (Editor+) Local File Inclusion
- Social Share With Floating Bar <= 1.0.3 - Reflected Cross-Site Scripting
- WP ULike <= 4.7.0 - Authenticated (Administrator+) Stored Cross-Site Scripting
- Metro <= 2.13 - Unauthenticated Local File Inclusion
- Link Shield <= 0.5.4 - Cross-Site Request Forgery to Stored Cross-Site Scripting
- IDonate 2.0.0 - 2.1.9 - Missing Authorization to Authenticated (Subscriber+) Sensitive Information Disclosure via admin_donor_profile_view Function
- 140+ Widgets | Xpro Addons For Elementor – FREE <= 1.4.7.1 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'Site Title' widget
- The Wound <= 0.0.1 - Unauthenticated Local File Inclusion
- WP Import – Ultimate CSV XML Importer for WordPress <= 7.27 - Missing Authorization to Authenticated (Subscriber+) FTP/SFTP Credential Exposure
- EventPrime – Events Calendar, Bookings and Tickets <= 3.4.2 - Missing Authorization to Arbitrary Post Overwrite
- WP Responsive Auto Fit Text <= 0.2 - Authenticated (Contributor+) Stored Cross-Site Scripting
- Kcaptcha <= 1.0.1 - Cross-Site Request Forgery to Settings Update
- Auto Listings <= 2.7.1 - Authenticated (Contributor+) Stored Cross-Site Scripting
- Gallery From Files <= 1.60 - Arbitrary File Upload
- Simple Payment <= 2.5.4 - Unauthenticated Stored Cross-Site Scripting
- Analytics Reduce Bounce Rate <= 2.3 - Cross-Site Request Forgery
- AudioTube <= 0.0.3 - Authenticated (Contributor+) Stored Cross-Site Scripting
- Integration for Mailchimp and Contact Form 7, WPForms, Elementor, Ninja Forms <= 1.2.2 - Missing Authorization
- Master Currency WP <= 1.1.61 - Authenticated (Contributor+) Stored Cross-Site Scripting via Currency Converter Form Shortcode
- WP RSS Images <= 1.1 - Cross-Site Request Forgery
- BEAR – Bulk Editor for WooCommerce Professional. AI assistant on board (MCP Server) < 1.2.2 - Authenticated (Custom Role+) Insecure Direct Object Reference
- GDY Modular Content <= 0.9.92 - Reflected Cross-Site Scripting
- Simply Schedule Appointments <= 1.6.12.10 - Unauthenticated Stored Cross-Site Scripting
- PageLayer <= 1.9.4 - Authenticated (Contributor+) Stored Cross-Site Scripting
- Kadence WooCommerce Email Designer <= 1.5.14 - Authenticated (Admin+) Arbitrary File Upload
- Tainacan <= 1.3.0 - Authenticated (Custom Role+) PHP Object Injection
- Advanced Typekit <= 1.0.1 - Authenticated (Subscriber+) Stored Cross-Site Scripting
- Wikilookup <= 1.1.5 - Authenticated (Administrator+) Stored Cross-Site Scripting via 'Popup Width' Setting
- JetTabs <= 2.2.9.1 - Authenticated (Contributor+) Stored Cross-Site Scripting
- Ninja Forms Contact Form – The Drag and Drop Form Builder for WordPress <= 3.4.27 - Cross-Site Request Forgery to Plugin Installation
- NEX-Forms <= 9.2.3 - Authenticated (Admin+) Arbitrary File Deletion via Path Traversal via 'location' Parameter
- Auto Coupons for WooCommerce <= 3.0.14 - Reflected Cross-Site Scripting
- SingleMalt <= 1.5 - Unauthenticated PHP Object Injection
- AMO Team Showcase <= 1.1.4 - Authenticated (Contributor+) Stored Cross-Site Scripting via amoteam_skills Shortcode
- GutenKit <= 2.4.4 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'postBodyCss'
- FoodBakery | Delivery Restaurant Directory WordPress Theme <= 2.1 - Reflected Cross-Site Scripting
- WP SVG Images <= 4.3 - Authenticated (Author+) Stored Cross-Site Scripting via SVG
- Events Manager <= 7.4.0.1 - Reflected Cross-Site Scripting via 'header_format' Parameter
- WP AdCenter <= 2.5.8 - Authenticated (Contributor+) Stored Cross-Site Scripting
- WP Fastest Cache < 0.9.5 - Authenticated (Subscriber+) SQL Injection
- Mini Program API <= 1.4.5 - Authenticated (Contributor+) Stored Cross-Site Scripting
- Ajax Search Pro <= 4.18.7 - Cross-Site Request Forgery to Cross-Site Scripting
- Photo Gallery by 10Web – Mobile-Friendly Image Gallery <= 1.8.38 - Authenticated (Editor+) Stored Cross-Site Scripting
- Blog Settings <= 1.0 - Reflected Cross-Site Scripting via 'page' Parameter
- Minimum and Maximum Quantity for WooCommerce <= 2.1.2 - Authenticated (Author+) PHP Object Injection
- CF7 WOW Styler <= 1.7.2 - Unauthenticated Local File Inclusion
- UpdraftPlus: WP Backup & Migration Plugin < 1.26.7 - Cross-Site Request Forgery
- Templately <= 3.7.1 - Authenticated (Contributor+) Arbitrary File Upload to Remote Code Execution via Gutenberg Cloud Import Attachment Filename Mismatch
- Eventin – Event Calendar, Tickets, Registration, Booking & WooCommerce < 4.1.19 - Unauthenticated Order Completion
- Kadence Blocks – Gutenberg Blocks for Page Builder Features <= 3.5.10 - Authenticated (Contributor+) Stored Cross-Site Scripting via `redirectURL` Parameter
- Community Events <= 1.5.1 - Unauthenticated SQL Injection
- Themify – WooCommerce Product Filter <= 1.5.5 - Reflected Cross-Site Scripting
- Zoho CRM Lead Magnet <= 1.7.5.8 - Missing Authorization to Authenticated (Subscriber+) Arbitrary Options Update
- TH Variation Swatches <= 1.2.7 - Cross-Site Request Forgery via delete_settings
- Cookies and Content Security Policy <= 2.34 - Unauthenticated Information Exposure
- Photo Gallery Slideshow & Masonry Tiled Gallery <= 1.0.3 - Authenticated (Admin+) SQL Injection
- SmartEmailing.cz <= 2.2.0 - Reflected Cross-Site Scripting
- Easy Table <= 1.6 - Authenticated (Admin+) Stored Cross-Site Scripting
- Easy Appointments <= 3.11.0 - Authenticated (Administrator+) Stored Cross-Site Scripting
- Crowdsignal Dashboard – Polls, Surveys & more <= 3.1.3 - Cross-Site Request Forgery
- Paid Memberships Pro – Restrict Member Access to Content, Courses, Communities – Free or Paid Subscriptions <= 2.5.9.1 - Cross-Site Scripting
- Tiled Gallery Carousel Without JetPack <= 3.1 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'data-image-title'
- Uncanny Automator – Easy Automation, Integration, Webhooks & Workflow Builder Plugin <= 7.0.0.3 - Authenticated (Administrator+) Server-Side Request Forgery to Arbitrary File Upload
- Animated Counters <= 1.7 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode
- reCaptcha by BestWebSoft < 1.28 - Reflected Cross-Site Scripting
- Fense Proxy & VPN Blocker <= 3.0.1 - Missing Authorization to Unauthenticated Plugin Option/Transient Deletion via fense_bpvt_save_settings AJAX Action
- AFI – The Easiest Integration Plugin <= 1.99.0 - Authenticated (Admin+) Stored Cross-Site Scripting
- Download Monitor <= 5.2.5 - Missing Authorization
- ProfilePress <= 4.5.3 - Authenticated (Administrator+) Stored Cross-Site Scripting
- Error Log Viewer <= 1.0.5 - Authenticated (Subscriber+) SQL Injection
- WP-DBManager <= 2.80.7 - Authenticated (Admin+) Remote Code Execution on Multi-Site
- AmaDiscount <= 1.0 - Authenticated (Contributor+) SQL Injection
- Hummingbird Performance – Cache & Page Speed Optimization for Core Web Vitals | Critical CSS | Minify CSS | Defer CSS Javascript | CDN < 3.21.2 - Authenticated (Administrator+) Remote Code Execution
- FileBird <= 6.4.9 - Improper Authorization to Authenticated (Author+) Settings Reset
- Surbma | Premium WP <= 9.0 - Authenticated (Contributor+) Stored Cross-Site Scripting
- AIO Performance Profiler, Monitor, Optimize, Compress & Debug <= 1.2 - Missing Authorization
- WhatsApp click to chat <= 3.0.4 - Reflected Cross-Site Scripting
- Secret Meta <= 1.2.1 - Reflected Cross-Site Scripting
- Tutor LMS – eLearning and online course solution <= 3.9.3 - Missing Authorization to Authenticated (Subscriber+) Arbitrary Course Completion
- Quizzin <= 1.01.4 - Reflected Cross-Site Scripting
- Travel Diaries <= 1.2.4 - Missing Authorization
- ProfileGrid – User Profiles, Groups and Communities <= 5.9.7.2 - Missing Authorization to Authenticated (Subscriber+) Arbitrary User Suspension
- Paid Downloads <= 3.15 - Unauthenticated SQL Injection
- Social Auto Poster <= 5.3.14 - Unauthenticated Stored Cross-Site Scripting
- reCaptcha by WebDesignBy < 2.0 - Authenticated (Administrator+) Stored Cross-Site Scripting
- Advanced Contact form 7 DB <= 2.0.2 - Sensitive Information Exposure
- WCFM - WooCommerce Frontend Manager <= 6.7.24 - Authenticated (Shop Manager+) Arbitrary Options Update
- Template Debugger <= 3.1.2 - Cross-Site Request Forgery
- RT Easy Builder <= 2.3 - Authenticated (Contributor+) Stored Cross-Site Scripting