Vulnerability archive: section 15, page 15
Open a report to review affected versions, available fixes and original sources. Each report covers a specific issue; its presence does not establish whether your website is affected.
- Newsmag <= 2.4.4 - Reflected Cross-Site Scripting
- Jannah <= 7.6.0 - Unauthenticated Local File Inclusion
- InstaWP Connect <= 0.1.0.38 - Unauthenticated Arbitrary File Upload
- FG Drupal to WordPress <= 3.70.3 - Sensitive Information Exposure
- WP JS <= 2.0.6 - Reflected Cross-Site Scripting
- Archivist – Custom Archive Templates <= 1.7.4 - Cross-Site Request Forgery
- PIXNET Plugin <= 2.9.10 - Authenticated (Subscriber+) Stored Cross-Site Scripting
- WordPress Core < 4.5.3 - Denial of Service via oEmbed Protocol
- Post Gallery <= 2.3.12 - Cross-Site Request Forgery
- Facebook for WordPress <= 3.0.3 - Cross-site Request Forgery to Stored Cross-site Scripting and Settings Deletion via wp_ajax_(save|delete)_fbe_settings
- Scheduling Plugin – Online Booking for WordPress <= 3.5.10 - Missing Authorization to Unauthenticated Service Disconnection
- WPAchievements Free <= 1.2.0 - Authenticated (Contributor+) Stored Cross-Site Scripting
- Proxy & VPN Blocker <= 3.5.8 - Unauthenticated Stored Cross-Site Scripting
- W3SPEEDSTER <= 7.19 - Cross-Site Request Forgery via launch
- Sogrid <= 1.5.2 - Cross-Site Request Forgery to Arbitrary Options Update
- OpenStation <= 1.1.7 - Missing Authorization to Authenticated (Subscriber+) Sensitive Information Disclosure via AI Copilot Search Endpoint
- Mediabay <= 1.6 - Missing Authorization via AJAC actions
- Frontend Uploader <= 1.3.2 - Unauthenticated Stored Cross-Site Scripting
- JetBackup – WP Backup, Migrate & Restore <= 1.4.1 - Missing Authorization to Unauthorized Backup Location Change
- WpEvently <= 5.0.8 - Authenticated (Contributor+) PHP Object Injection
- Database Backup for WordPress <= 2.5 - Admin+ SQL Injection
- User Login Log <= 2.2.2 - Authenticated (Subscriber+) Stored Cross-Site Scripting
- Toolset Blocks <= 1.6.26 - Unauthenticated Stored Cross-Site Scripting
- Redirect By Cookie <= 1.06 - Reflected Cross-Site Scripting
- OptinMonster <= 2.12.1 - Authenticated (Subscriber+) Sensitive Information Disclosure via Shortcode
- Veeqo for WooCommerce <= 2.2.8 - Authenticated (Subscriber+) Arbitrary File Upload
- Cozy Blocks <= 2.2.11 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'postMeta.font.size' Block Attribute
- WP Map Block <= 3.0.0 - Missing Authorization to Authenticated (Contributor+) Arbitrary Map Publish/Unpublish/Delete via set_status() and bulk() REST Endpoints
- DocumentPress <= 2.1 - Reflected Cross-Site Scripting
- OTP Login Woocommerce & Gravity Forms <= 2.0 - Cross-Site Scripting
- Online Scheduling and Appointment Booking System – Bookly <= 27.0 - Unauthenticated Price Manipulation via 'tips'
- PostX <= 5.0.8 - Authenticated (Administrator+) Server-Side Request Forgery via REST API Endpoints
- Rox Appointment Booking <= 1.2.7 - Unauthenticated Information Exposure
- Onepage Builder – Easiest Landing Page Builder For WordPress <= 2.4.1 - Authenticated (Administrator+) SQL Injection
- Smartsupp – live chat, chatbots, AI and lead generation <= 3.6 - Cross-Site Request Forgery
- External Videos <= 2.0.1 - Authenticated (Administrator+) Stored Cross-Site Scripting
- PCRecruiter Extensions <= 1.4.22 - Authenticated (Contributor+) Stored Cross-Site Scripting
- Case Theme User <= 1.0.3 - Authentication Bypass via Social Login
- PayPlus Payment Gateway <= 8.2.5 - Missing Authorization
- Medical Addon for Elementor <= 1.6.4 - Authenticated (Contributor+) Stored Cross-Site Scripting via Typewriter Widget
- Abandoned Cart Lite for WooCommerce <= 6.8.0 - Authenticated (Shop manager+) Stored Cross-Site Scripting
- WordPress Spreadsheet <= 0.62 - SQL Injection
- Simple Newsletter Plugin <= 4.3.10 - Unauthenticated Stored Cross-Site Scripting via Subscriber Custom Field via Manage Preferences Form + Campaign Preview noptin_key Pivot
- Loco Translate <= 2.6.9 - Cross-Site Request Forgery
- Breeze Cache <= 2.5.2 - Unauthenticated Exposure of Sensitive Information to an Unauthorized Actor via Crafted Login Cookie
- Gallery Blocks with Lightbox <= 2.2.0 - Authenticated Stored Cross-Site Scripting
- Namaste! LMS <= 2.6.1.1 - Reflected Cross-Site Scripting
- Rupantorpay <= 2.0.0 - Missing Authorization to Unauthenticated Order Status Modification
- Product Filter for WooCommerce by WBW < 3.1.3 - Unauthenticated SQL Injection
- User Registration <= 5.1.5 - Reflected Cross-Site Scripting
- myCred – Loyalty Points and Rewards plugin <= 2.7.5.2 - Authenticated (Contributor+) Stored Cross-Site Scripting via mycred_send Shortcode
- Qubely <= 1.8.12 - Authenticated (Contributor+) Stored Cross-Site Scripting
- ECT Add to Cart Button <= 1.4 - Cross-Site Request Forgery to Stored Cross-Site Scripting
- Employee Spotlight – Team Member Showcase & Meet the Team Plugin <= 5.1.2 - Authenticated (Contributor+) Stored Cross-Site Scripting
- Welcart e-Commerce <= 2.11.16 - Authenticated (Editor+) PHP Object Injection
- Login with phone number <= 1.6.93 - Missing Authorization
- Tourfic – AI Powered Travel Booking, Hotel Booking & Car Rental WordPress Plugin <= 2.22.5 - Authenticated (Subscriber+) SQL Injection
- Shield Security <= 18.5.7 - Unauthenticated Stored Cross-Site Scripting via getColumnContent_Page
- ADIF Log Search Widget <= 1.0f - Cross-Site Scripting
- Baggage Freight Shipping Australia <= 0.1.0 - Arbitrary File Upload
- Essential Real Estate <= 5.1.8 - Cross-Site Request Forgery
- Easy2Map <= 1.2.9 - Reflected Cross-Site Scripting
- Materialis Companion <= 1.3.52 - Missing Authorization
- WP Content Copy Protection & No Right Click (PRO) <= 15.0 - Authenticated (Admin+) Stored Cross-Site Scripting
- One Click Upsell Funnel for WooCommerce <= 3.4.9 - Authenticated (Contributor+) Stored Cross-Site Scripting via wps_wocuf_pro_yes Shortcode
- Couponis Demo < 2.2 - Unauthenticated SQL Injection
- weForms <= 1.6.25 - Missing Authorization
- Uncode Core <= 2.9.1.6 - Authenticated (Subscriber+) Arbitrary Shortcode Execution in uncode_get_medias
- Kento Post View Counter <= 2.8 - SQL Injection
- jQuery T(-) Countdown Widget <= 2.3.23 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortocde
- Shopping Cart & eCommerce Store <= 5.9.1 - Authenticated (Contributor+) SQL Injection
- SAML Single Sign On – SAML SSO Login <= 4.9.20 - Reflected Cross-Site Scripting
- Add Linked Images To Gallery <= 1.4 - Cross-Site Request Forgery to Stored Cross-Site Scripting
- Easy Amazon Product Information <= 4.0.1 - Cross-Site Request Forgery to Stored Cross-Site Scripting
- WP-FormAssembly <= 2.0.5 - Authenticated (Contributor+) Arbitrary File Read
- KiviCare <= 4.1.2 - Missing Authorization to Unauthenticated Privilege Escalation via Setup Wizard
- Mangboard <= 1.9.9 - SQL Injection
- Drag and Drop Multiple File Upload for Contact Form 7 <= 1.3.8.7 - Unauthenticated Arbitrary File Deletion
- Responsive Lightbox & Gallery <= 2.5.1 - Authenticated (Contributor+) Stored Cross-Site Scripting
- Image News Slider <= 3.3 - Arbitrary File Upload
- Fluid Responsive Slideshow < 2.2.7 - Cross-Site Request Forgery
- User Verification by PickPlugins <= 2.0.45 - Missing Authorization
- Donation <= 1.0 - Authenticated (Admin+) SQL Injection
- WP-Lister Lite for Amazon <= 2.6.11 - Authenticated (Administrator+) Stored Cross-Site Scripting
- InfiniteWP Client <= 1.13.9 - Authenticated (Admin+) SQL Injection via 'iwp_get_comments_*' Array Key
- Taskbuilder – Project Management & Task Management Tool With Kanban Board <= 6.0.5 - Authenticated (Subscriber+) SQL Injection
- WooCommerce – Store Exporter <= 1.8.3 - Missing Authorization
- Local Delivery Drivers for WooCommerce <= 1.9.0 - Missing Authorization to Driver Account Takeover
- ELEX WooCommerce Request a Quote <= 2.4.0 - Unauthenticated SQL Injection
- Botnet Attack Blocker <= 2.0.0 - Authenticated (Subscriber+) Stored Cross-Site Scripting
- Woocommerce Product Design <= 1.0.0 - Unauthenticated Arbitrary File Upload
- Enfold <= 7.1.3 - Authenticated (Contributor+) Stored Cross-Site Scripting
- Strong Testimonials <= 2.31.4 - Reflected Cross-Site Scripting
- FormLift for Infusionsoft Web Forms <= 7.5.17 - Unauthenticated SQL Injection
- WP Login and Logout Redirect <= 1.2 - Authenticated (Admin+) Stored Cross-Site Scripting
- ListingPro - WordPress Directory & Listing Theme < 2.5.4 - Cross-Site Scripting
- Salon Booking System and Salon Booking System Pro <= 7.6.2 - Sensitive Information Disclosure
- FunnelKit <= 3.16.0.6 - Missing Authorization to Unauthenticated Sensitive Information Disclosure via 'order_id' / 'order' POST Parameter
- Coalition (All Versions) - Cross-Site Scripting
- Calendar < 1.3.8 - Reflected Cross-Site Scripting