Vulnerability archive: section 15, page 13
Open a report to review affected versions, available fixes and original sources. Each report covers a specific issue; its presence does not establish whether your website is affected.
- JobBank <= 1.2.2 - Reflected Cross-Site Scripting
- Raptive Ads <= 3.7.3 - Reflected Cross-Site Scripting
- LiteSpeed Cache <= 6.5.1 - Unauthenticated Privilege Escalation
- Philantro – Donations and Donor Management <= 5.3 - Authenticated (Contributor+) Stored Cross-Site Scripting via donate Shortcode
- Exclusive Addons for Elementor <= 2.6.9 - Authenticated (Contributor+) Stored Cross-Site Scripting via Covid-19 Stats Widget
- Elementor Website Builder – More than Just a Page Builder <= 3.23.4 - Authenticated (Contributor+) Stored Cross-Site Scripting in the URL Parameter in Multiple Widgets
- Frontend File Manager <= 23.2 - Missing Authorization to Authenticated (Subscriber+) Content Injection
- Advanced Order Export For WooCommerce <= 3.3.2 - Cross-Site Request Forgery
- PDF Smart Viewer for Elementor <= 1.0.4 - Unauthenticated Server-Side Request Forgery
- WooCommerce <= 2.3.5 - Stored Cross-Site Scripting
- Breakdance <= 2.7.1 - Unauthenticated Stored Cross-Site Scripting
- Bfres <= 1.2.1 - Unauthenticated Local File Inclusion
- Futurio Extra <= 1.9.0 - Cross-Site Request Forgery
- Button Generator – easily Button Builder <= 2.3.8 - Cross-Site Request Forgery
- Visual Builder <= 1.2.2 - Missing Authorization
- Booking for Appointments and Events Calendar – Amelia <= 1.2.38 - Missing Authorization to Unauthenticated Multiple AJAX Actions
- Quiz and Survey Master (QSM) <= 11.2.1 - Authenticated (Contributor+) SQL Injection via 'randon_category' Quiz Option
- Theme Demo Import <= 1.1.3 - Authenticated (Administrator+) Arbitrary File Upload
- 404 to Start <= 1.6.1 - Authenticated (Administrator+) Stored Cross-Site Scripting
- Envira Gallery <= 1.16.1 - Authenticated (Admin+) Arbitrary Plugin Installation
- Newsletter, SMTP, Email marketing and Subscribe forms by Brevo (formely Sendinblue) <= 3.1.77 - Reflected Cross-Site Scripting
- Download Manager <= 3.2.93 - Authenticated (Contributor+) Stored Cross-Site Scripting via wpdm_modal_login_form Shortcode
- WP Responsive Menu <= 3.1.7 - Missing Authorization to Settings Update & Stored Cross-Site Scripting
- Logo Slider <= 4.9.0 - Authenticated (Author+) Stored Cross-Site Scripting via 'logo-slider' Shortcode
- Elementor Addon Elements <= 1.13.8 - Authenticated (Contributor+) Sensitive Information Exposure via table_saved_sections
- Featured Image from URL (FIFU) <= 5.2.7 - Missing Authorization to Password Protected Post Disclosure
- Administrator Z <= 2025.03.24 - Missing Authorization to Authenticated (Subscriber+) Arbitrary Options Update
- SimpleCharm <= 1.4.3 - Reflected Cross-Site Scripting
- Yandex.Metrica <= 1.2.2 - Missing Authorization
- Vertex Addons for Elementor <= 1.6.4 - Missing Authorization to Authenticated (Subscriber+) Arbitrary Plugin Installation and Activation via 'afeb_activate_required_plugins'
- Tevolution < 2.3.0 - Arbitrary File Upload
- W3 Total Cache <= 2.10.3 - Unauthenticated Stored Cross-Site Scripting via Comment Author Name
- AnalyticsWP <= 2.0.0 - Missing Authorization
- EELV Newsletter <= 4.8.2 - Cross-Site Request Forgery
- Visual Email Designer for WooCommerce <= 1.7.1 - Authenticated (Author+) SQL Injection
- WP FEvents Book <= 0.46 - Authenticated (Subscriber+) Insecure Direct Object Reference to Booking Manipulation
- Integration Opvius AI for WooCommerce <= 1.3.0 - Unauthenticated Arbitrary File Deletion/Read via Path Traversal
- Mingle Forum <= 1.0.32.1 - SQL Injection
- Orbit Fox by ThemeIsle <= 2.10.34 - Authenticated (Contributor+) Stored Cross-Site Scripting via Services and Post Type Grid Widgets
- LA-Studio Element Kit for Elementor <= 1.3.7.4 - Authenticated (Contributor+) Stored Cross-Site Scripting
- School Management System for Wordpress <= 93.0.0 - Authenticated (Student+) Account Takeover and Privilege Escalation
- Everest Backup <= 2.3.5 - Missing Authorization to Unauthenticated Information Exposure
- Ultimate Member <= 2.4.0 - Subscriber+ Stored Cross-Site Scripting
- Advanced Post Manager <= 4.5.1 - PHP Object Injection
- Sendinblue for WooCommerce <= 4.0.17 - Authenticated (Editor+) Arbitrary File Download and Deletion
- Simple File List <= 6.3.7 - Missing Authorization to Unauthenticated File Modification via simplefilelist_edit_job AJAX Action
- Optin Forms <= 1.3.6 - Authenticated (Administrator+) Stored Cross-Site Scripting
- Newspack Blocks <= 3.0.8 - Authenticated (Contributor+) Arbitrary File Upload
- Hustle <= 7.8.9.2 - Authenticated (Subscriber+) Arbitrary File Upoload via Module Import
- WordPress Survey & Poll – Quiz, Survey and Poll Plugin for WordPress <= 1.7.5 - Authenticated (Contributor+) SQL Injection
- Paymob for WooCommerce <= 4.1.13 - Unauthenticated Payment Bypass
- Drag and Drop File Upload for Elementor Forms <= 1.4.3 - Unauthenticated Arbitrary File Deletion
- FV Thoughtful Comments <= 0.3.5 - Missing Authorization
- Seriously Simple Stats <= 1.6.0 - Reflected Cross-Site Scripting
- Ultimate Addons for WPBakery Page Builder < 3.21.4 - Unauthenticated Custom Icon Font Deletion
- Views for WPForms <= 3.2.2 - Missing Authorization via create_view
- Dropdown Multisite selector < 0.9.4 - Authenticated (Contributor+) Stored Cross-Site Scripting
- Appointment Hour Booking <= 1.3.72 - CSV Injection
- Avada <= 7.11.6 - Authenticated (Contributor+) Server-Side Request Forgery via form_to_url_action
- qTranslate <= 2.5.39 - Cross-Site Request Forgery
- AMP for WP – Accelerated Mobile Pages <= 1.0.99.1 - Cross-Site Request Forgery to Privilege Escalation
- UpdraftPlus <= 1.13.4 - Stored Cross-Site Scripting
- Massive Dynamic <= 8.2 - Unauthenticated Local File Inclusion
- Schedule Post Changes With PublishPress Future: Unpublish, Delete, Change Status, Trash, Change Categories 4.10.1 - 4.10.5 - Authenticated (Contributor+) Stored Cross-Site Scripting
- Ultimate Addons for Contact Form 7 <= 3.5.12 - Authenticated (Administrator+) Arbitrary File Upload via 'save_options'
- All in One SEO Pack <= 2.3.7 - Unauthenticated Stored Cross-Site Scripting
- SupportCandy <= 2.2.6 - Stored Cross-Site Scripting via Shortcode
- Order Tip for WooCommerce < 1.6.0 - Authenticated (Shop Manager+) Arbitrary File Deletion
- Sailthru Triggermail <= 1.1 - Authenticated (Admin+) Stored Cross-Site Scripting
- ChatBot <= 7.3.9 - Missing Authorization
- Quick Interest Slider <= 3.1.5 - Unauthenticated Stored Cross-Site Scripting
- Support Helpdesk Ticket System Lite <= 4.5.2 - Reflected Cross-Site Scripting
- Lawyer Directory <= 1.3.4 - Missing Authorization
- Short URL <= 1.6.4 - Authenticated(Admin+) Stored Cross-Site Scripting
- Penci Pay Writer <= 1.5 - Authenticated (Contributor+) Stored Cross-Site Scripting
- Lingotek Translation <= 1.1.8 - Cross-Site Scripting
- Reloadly <= 2.0.1 - Cross-Site Request Forgery
- Ultimate Multisite <= 2.15.0 - Unauthenticated Authentication Bypass via 'checkout_form' Parameter
- Add Admin CSS <= 2.0.1 - Unauthenticated Full Path Dislcosure
- Business Contact Widget <= 2.7.0 - Authenticated (Administrator+) Stored Cross-Site Scripting
- GiveWP <= 2.23.2 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode
- Paid Membership Plugin, Ecommerce, User Registration Form, Login Form, User Profile & Restrict Content – ProfilePress <= 4.17.1 - Unauthenticated Arbitrary Plugin Installation via Brute Force
- Wishlist for WooCommerce <= 3.3.0 - Authenticated (Contributor+) Stored Cross-Site Scripting
- Social Share Icons & Social Share Buttons <= 3.6.2 - Missing Authorization to Notice Dismissal
- DethemeKit For Elementor <= 2.1.5 - Authenticated (Contributor+) Stored Cross-Site Scripting via URL Parameter of the De Gallery Widget
- Consulting - Business, Finance WordPress Theme <= 6.7.16 - Authenticated (Subscriber+) Privilege Escalation via AJAX
- SellKit <= 1.8.1 - Authenticated (Subscriber+) Arbitrary File Download
- Advanced Custom Fields (ACF®) <= 6.7.0 - Unauthenticated Missing Authorization to Arbitrary Post/Page Disclosure via AJAX Field Query Parameters
- WordPress Core < 4.5.3 - Revision History Disclosure
- ProfileGrid – User Profiles, Groups and Communities <= 5.9.8.1 - Authenticated (Subscriber+) Stored Cross-Site Scripting
- Restaurant Menu by MotoPress <= 2.4.1 - Admin+ Stored Cross Site Scripting
- Knowledge Base <= 2.1.1 - Authenticated (Contributor+) Stored Cross-Site Scripting via Block
- BitPay Checkout for WooCommerce <= 4.1.0 - Missing Authorization
- Donorbox – Free Recurring Donation Form <= 7.1.6 - Cross-Site Scripting
- The Pack Elementor addons <= 2.1.6 - Authenticated (Contributor+) Stored Cross-Site Scripting
- NikanWP WooCommerce Reporting <= 1.0.0 - Cross-Site Request Forgery
- Contact Builder by Themify <= 1.4.5 - Email Injection
- WordPress File Upload <= 4.16.2 - Authenticated (Contributor+) Stored Cross-Site Scripting via Malicious SVG
- Striking <= 2.3.4 - Reflected Cross-Site Scripting
- Snazzy Maps <= 1.1.4 - Multiple Cross-Site Scripting