Vulnerability archive: section 15, page 17
Open a report to review affected versions, available fixes and original sources. Each report covers a specific issue; its presence does not establish whether your website is affected.
- MStore API <= 3.9.8 - Unauthenticated Privilege Escalation
- SparkPost <= 3.2.7 - Authenticated (Administrator+) Stored Cross-Site Scripting via plugin settings
- AI Responsive Gallery Album <= 1.4 - Reflected Cross-Site Scripting
- All Bootstrap Blocks <= 1.3.31 - Authenticated (Subscriber+) Information Exposure
- WordPress Simple PayPal Shopping Cart < 3.6 - Cross-Site Request Forgery
- Uncanny Toolkit Pro for LearnDash <= 4.1.4 - Reflected Cross-Site Scripting
- Go Night Pro | WordPress Dark Mode Plugin <= 1.1.0 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'margin' Shortcode Attribute
- Mini Mail Dashboard Widget < 1.43 - Cross-Site Scripting
- Wp EMember <= 10.2.2 - Reflected Cross-Site Scripting
- User Registration PRO <= 6.2.9 - Unauthenticated Stored Cross-Site Scripting via HTTP Referer Header
- Login with phone number <= 1.4.2 - Reflected Cross-Site Scripting
- TaxoPress <= 3.6.4 - Authenticated (Editor+) Stored Cross-Site Scripting
- DZS Video Gallery <= 12.39 - Unauthenticated PHP Object Injection
- Nexos - Real Estate WordPress Theme <= 1.7 - SQL Injection
- 10WebMapBuilder <= 1.0.63 - Unauthenticated Stored Cross-Site Scripting via Plugin Settings Change
- ShopLentor – WooCommerce Builder for Elementor & Gutenberg +12 Modules – All in One Solution (formerly WooLentor) <= 2.8.7 - Authenticated (contributor+) Stored Cross-Site Scripting via _id
- WOLF - WordPress Posts Bulk Editor and Manager <= 1.0.0 - Unauthenticated Stored Cross-Site Scripting
- Medilazar Core < 1.4.7 - Authenticated (Contributor+) Local File Inclusion
- InstaWP Connect <= 0.1.0.82 - Unauthenticated Local File Inclusion
- Total Upkeep – WordPress Backup Plugin plus Restore & Migrate by BoldGrid <= 1.17.2 - Missing Authorization
- Premium Packages <= 7.0.5 - Unauthenticated Stored Cross-Site Scripting via 'order_email'
- Realty Workstation <= 1.0.45 - Authentication Bypass to Account Takeover
- AccessPress Anonymous Post Pro <= 3.1.9 - Unauthenticated Arbitrary File Upload
- Easy Digital Downloads <= 3.1.5 - Missing Authorization
- LearnPress – WordPress LMS Plugin for Create and Sell Online Courses <= 4.3.5 - Authenticated (Subscriber+) Payment Bypass to Free Course Enrollment via 'quantity' Parameter
- Mobile builder <= 1.4.2 - Authentication Bypass
- CodePen Embedded Pens Shortcode <= 1.0.0 - Authenticated (Contributor+) Stored Cross-Site Scripting
- BuddyPress Docs <= 2.2.3 - Reflected Cross-Site Scripting
- Accio | Responsive Onepage Parallax Agency WordPress Theme <= 1.1.0 - Sensitive Information Disclosure
- 微信机器人高级版 <= 6.2.1 - Reflected Cross Site Scripting
- Zephyr Project Manager <= 3.2.42 - Missing Authorization to Cross-Site Scripting
- WooCommerce <= 10.9.4 - Authenticated (Shop Manager+) SQL Injection
- Unlimited Elements For Elementor (Free Widgets, Addons, Templates) <= 1.5.112 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'email'
- DethemeKit For Elementor <= 1.5.5.4 - Authenticated Stored Cross-Site Scripting
- Media Library Assistant <= 3.41 - Authenticated (Contributor+) SQL Injection
- CSV to SortTable <= 4.2 - Authenticated (Contributor+) Local File Inclusion
- Disable User Login <= 1.0.1 - Missing Authorization to Unauthenticated Settings Update
- Online Marksheet Creator : eMarksheet <= 5.4.3 - Reflected Cross-Site Scripting
- Echo Knowledge Base – Documentation, FAQs, AI Chat & AI Search <= 16.011.0 - Missing Authorization
- Estatik Real Estate Plugin <= 4.1.0 - Unauthenticated PHP Object Injection
- Downloable by American Osteopathic Association <= 0.1.0 - Unauthenticated Server-Side Request Forgery
- WordPress Core <= 7.0.3 - Authenticated (Author+) Remote Code Execution via Malicious File Upload
- Custom Dashboard & Login Page < 6.9.5 - Admin+ Stored Cross-Site Scripting
- Import Export Suite for CSV and XML Datafeed <= 7.19 - Authenticated (Subscriber+) Arbitrary File Deletion
- IndieWeb <= 4.0.5 - Authenticated (Author+) Stored Cross-Site Scripting via 'Telephone' Parameter
- Advanced Custom Fields : CPT Options Pages <= 2.0.9 - Cross-Site Request Forgery
- Booster for WooCommerce <= 3.7.0 - Cross-Site Scripting
- WS Contact Form <= 1.3.7 - Authenticated (Administrator+) Stored Cross-Site Scripting
- CSV Sumotto <= 1.0 - Reflected Cross-Site Scripting
- APCu Manager <= 4.4.0 - Unauthenticated Stored Cross-Site Scripting
- Premmerce Product Search for WooCommerce <= 2.2.7 - Authenticated (Administrator+) Stored Cross-Site Scripting
- WordPress Core < 6.0.3 - Shared User Instance Weakness
- Contact Form 7 <= 5.9 - Reflected Cross-Site Scripting
- Ultimate Store Kit Elementor Addons, Woocommerce Builder, EDD Builder, Elementor Store Builder, Product Grid, Product Table, Woocommerce Slider <= 2.0.3 - Unauthenticated PHP Object Injection
- Appointment Hour Booking <= 1.3.72 - CAPTCHA Bypass
- WP Table Builder – Drag & Drop Table Builder <= 2.2.0 - Missing Authorization
- Campaign URL Builder <= 1.8.1 - Authenticated (Admin+) Stored Cross-Site Scripting via Create Link
- Easy Social Icons <= 3.1.2 - Reflected Cross-Site Scripting
- Metform Elementor Contact Form Builder <= 2.1.3 - Sensitive Information Disclosure
- Highlight and Share <= 5.2.0 - Missing Authorization
- Membership <= 1.6.4 - Missing Authorization
- Ultimate Member <= 2.0.3 - Directory Traversal
- Booking Package < 1.7.25 - Unauthenticated Price Manipulation
- Product Import Export for WooCommerce <= 2.4.1 - Authenticated(Shop Manager+) Arbitrary File Upload
- FormCraft - Premium WordPress Form Builder <= 3.9.11 - Unauthenticated Stored Cross-Site Scripting via SVG File Upload
- Wibiya Toolbar <= 2.0 - Cross-Site Request Forgery to Stored Cross-Site Scripting
- Anthologize <= 0.8.2 - Cross-Site Request Forgery
- MC4WP: Mailchimp for WordPress <= 4.8.4 - Open Redirect
- Image Mapper <= 0.2.5.3 - Reflected Cross-Site Scripting
- Redirect After Login <= 0.1.9 - Authenticated (Administrator+) Stored Cross-Site Scripting via plugin settings
- CataBlog <= 1.7.0 - Authenticated (Editor+) Arbitrary File Upload
- ThumbPress <= 6.2.1 - Missing Authorization
- SMS Alert Order Notifications – WooCommerce <= 3.7.6 - Missing Authorization to Authenticated (Subscriber+) Arbitrary Options Update
- WooCommerce Shipping – DPD baltic <= 1.2.8 - Authenticated (Admin+) Stored Cross-Site Scripting
- Sassy Social Share 3.3.23 - Object Injection
- Team Showcase <= 1.22.15 - Object Injection
- Ajax Search Lite <= 4.12.4 - Authenticated (Admin+) Stored Cross-Site Scripting
- Purge Varnish Cache <= 2.6 - Cross-Site Request Forgery
- Parallax Scrolling Enllax.js <= 0.0.6 - Cross-Site Request Forgery
- WordPress Users <= 1.4 - Cross-Site Request Forgery to Settings Update
- Database Addon for Contact Form 7 <= 1.4.1 - Unauthenticated Limited File Deletion via Injected 'attackcfdb7_file' Submission Field
- Gallery Blocks with Lightbox <= 3.0.7 - Missing Authorization in pgc_sgb_action_wizard
- Tealium <= 2.1.20 - Authenticated (Administrator+) Stored Cross-Site Scripting
- StaffList <= 3.2.6 - Unauthenticated Sensitive Information Exposure
- Ivory Search – WordPress Search Plugin <= 5.5.5 - Missing Authorization to Authenticated (Subscriber+) Index Creation
- Photo Engine <= 6.4.3 - Cross-Site Request Forgery
- NextMove Lite <= 2.18.1 - Cross-Site Request Forgery
- Eventin <= 4.1.20 - Missing Authorization
- Drag and Drop Multiple File Upload (Pro) - WooCommerce <= 5.0.6 - Unauthenticated Arbitrary File Upload
- WordPress Core < 5.3.1 - Authorization Bypass
- AI ChatBot for WordPress <= 7.1.0 - Authenticated (Admin+) Stored Cross-Site Scripting
- Cooked <= 1.11.3 - Missing Authorization
- SureDash <= 1.12.1 - Authenticated (Subscriber+) Stored DOM-Based Cross-Site Scripting via Image 'alt' Attribute in Community Post Content
- KiviCare <= 4.4.0 - Missing Authorization to Unauthenticated Payment Bypass and Appointment Status Manipulation via /payment-success REST Endpoint
- Testimonials <= 2.6 - Authenticated (Administrator+) Stored Cross-Site Scripting
- Prodigy Commerce <= 3.3.0 - Unauthenticated Local File Inclusion via parameters[template_name]
- Maps <= 4.9.6 - Authenticated (Subscriber+) Local File Inclusion
- Easy Hide Login <= 1.0.7 - Authenticated (Administrator+) Stored Cross-Site Scripting
- Adblocker Blocker <= 0.0.1 - Arbitrary File Upload
- Greenshift <= 11.5.5 - Authenticated (Contributor+) Stored Cross-Site Scripting