Vulnerability archive: section 15, page 2
Open a report to review affected versions, available fixes and original sources. Each report covers a specific issue; its presence does not establish whether your website is affected.
- WordPress Gallery Plugin – NextGEN Gallery <= 3.38 - Authenticated (Admin+) Local File Inclusion
- Custom Colors for Real Estate Manager <= 1.0 - Authenticated (Subscriber+) Stored Cross-Site Scripting
- Tutor LMS <= 3.9.12 - Authenticated (Instructor+) Insecure Direct Object Reference
- MpOperationLogs <= 1.0.1 - Unauthenticated Stored Cross-Site Scripting
- Houzez <= 3.2.4 - Authenticated (Subscriber+) Privilege Escalation
- Meks ThemeForest Smart Widget <= 1.5 - Authenticated (Admin+) Stored Cross-Site Scripting
- Newsletters <= 4.11 - Unauthenticated PHP Object Injection
- WordPress Exit Box Lite <= 1.0.6 - Cross-Site Request Forgery
- WordPress Core < 5.4.1 - Private Post Disclosure
- WP Highlight Box <= 1.0 - Authenticated (Contributor+) Stored Cross-Site Scripting
- FancyPost – Best Ultimate Post Block, Post Grid, Layouts, Carousel, Slider For Gutenberg & Elementor <= 5.3.1 - Authenticated (Author+) Stored Cross-Site Scripting
- WP Rentals - Booking Accommodation WordPress Theme <= 3.14.2 - Missing Authorization
- Noisa <= 2.6.0 - Unauthenticated PHP Object Injection
- TS Webfonts for SAKURA <= 3.1.2 - Cross-Site Request Forgery
- ElementsKit Elementor addons <= 3.0.7 - Authenticated (Contributor+) Stored Cross-Site Scripting via Countdown Widget
- Download Alt Text AI <= 1.10.15 - Missing Authorization
- Contact Form to DB by BestWebSoft – Messages Database Plugin For WordPress <= 1.7.6 - Unauthenticated Stored Cross-Site Scripting
- Penci Recipe <= 4.1 - Authenticated (Contributor+) Stored Cross-Site Scripting
- EventON <= 2.2.15 - Missing Authorization to Unauthenticated Stored Cross-Site Scripting and Plugin Settings Updates
- Simple Membership <= 4.8.4 - Authenticated (Subscriber+) Stored Cross-Site Scripting via Country Field
- MAZ Loader – Preloader Builder for WordPress <= 1.4.0 - Cross-Site Request Forgery
- The Moneytizer <= 10.0.9 - Authenticated (Contributor+) Stored Cross-Site Scripting
- HAPPY <= 1.0.9 - Missing Authorization
- Etsy Importer <= 1.4.2 - Authenticated (Contributor+) Stored Cross-Site Scripting
- ZoloBlocks <= 2.3.11 - Unauthenticated Sever-Side Request Forgery
- Redirection for Contact Form 7 <= 2.3.3 - Authenticated PHP Object Injection
- WP Bannerize Pro <= 1.9.0 - Authenticated (Editor+) Stored Cross-Site Scripting
- WP Spell Check <= 7.1.9 - Cross-Site Request Forgery
- Subscribe to Download Lite <= 1.2.9 - Authenticated (Subscriber+) Local File Inclusion
- User Registration – Custom Registration Form, Login Form, and User Profile WordPress Plugin <= 3.1.4 - Unauthenticated Stored Self-Based Cross-Site Scripting
- Joli FAQ SEO – WordPress FAQ Plugin <= 1.3.2 - Cross-Site Request Forgery
- Easy Upload Files During Checkout <= 2.9.8 - Unauthenticated Arbitrary JavaScript File Upload
- Relevanssi <= 4.28.1 - Reflected Cross-Site Scripting
- Atarim <= 3.31 - Authenticated (Administrator+) Stored Cross-Site Scripting
- File Manager Pro – Filester <= 1.8.2 - Authenticated Plugin Settings Update
- Folders <= 3.1.5 - Incorrect Authorization to Authenticated (Contributor+) Folder Content Manipulation
- Joy Of Text Lite <= 2.3.1 - Cross-Site Request Forgery
- Music Request Manager <= 1.3 - Unauthenticated Stored Cross-Site Scripting
- WPFAQBlock– FAQ & Accordion Plugin For Gutenberg <= 1.2.1 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'class' Shortcode Attribute
- Grand Conference <= 5.2 - Unauthenticated PHP Object Injection
- Directorist 8.5 - 8.9.4 - Authenticated (Subscriber+) Insecure Direct Object Reference
- Printcart Web to Print Product Designer for WooCommerce <= 2.4.0 - Authenticated (Subscriber+) SQL Injection
- RTMKit Addons for Elementor <= 2.0.2 - Authenticated (Author+) Local File Inclusion via 'path'
- Happyforms <= 1.21.1 - Authenticated (Contributor+) Stored Cross-Site Scripting via Blocks
- GoUrl Bitcoin Payment Gateway & Paid Downloads & Membership <= 1.6.6 - Authenticated (Administrator+) Stored Cross-Site Scripting
- Classified Listing – AI-Powered Classified ads & Business Directory Plugin <= 5.3.4 - Authenticated (Subscriber+) Sensitive Data Exposure
- Stop Spammers Security <= 2021.17 - Authenticated (Admin+) Stored Cross-Site Scripting
- Events Manager <= 5.9.7.3 - Cross-Site Scripting
- Betheme | Responsive Multipurpose WordPress & WooCommerce Theme <= 27.5.5 - Authenticated (Author+) Stored Cross-Site Scripting via SVG File
- Porto <= 7.1.0 - Authenticated (Contributor+) Local File Inclusion via Post Meta
- Login Lockdown – Protect Login Form <= 2.08 - Missing Authorization
- Total Security <= 3.4.0 - Unauthenticated Settings Change
- Smart Manager <= 8.45.0 - Missing Authorization
- GMap Targeting <= 1.1.7 - Unauthenticated Stored Cross-Site Scripting
- Breakdance <= 1.7.2 - Missing Authorization
- WPC Smart Wishlist for WooCommerce <= 5.0.4 - Missing Authorization to Authenticated (Subscriber+) Information Exposure
- MP Customize Login Page <= 1.0 - Cross-Site Request Forgery to Settings Update
- Rara Academic <= 1.2.2 - Missing Authorization
- AutomatorWP <= 1.7.5 - Privilege Escalation
- Videopack <= 4.10.3 - Authenticated (Contributor+) Stored Cross-Site Scripting
- Sala <= 1.1.6 - Unauthenticated Local File Inclusion
- WP Crowdfunding < 2.2.1 - Unauthenticated Insecure Direct Object Reference
- Subscribe to Comments <= 2.3 - Reflected Cross-Site Scripting
- MStore API – Create Native Android & iOS Apps On The Cloud <= 4.15.3 - Unauthorized User Registration
- Pit Login Welcome <= 1.1.5 - Reflected Cross-Site Scripting
- DyaPress ERP/CRM <= 18.0.2.0 - Unauthenticated Local File Inclusion
- New User Approve <= 3.2.3 - Missing Authorization
- HT Contact Form <= 2.8.2 - Unauthenticated Stored Cross-Site Scripting via File Upload Field
- JetBooking <= 4.0.3 - Unauthenticated SQL Injection via 'check_in_date' Parameter
- Real Spaces - WordPress Properties Directory Theme <= 3.5 - Authenticated (Subscriber+) Privilege Escalation to Administrator via 'change_role_member'
- DevKit Pro <= 2.3.0 - Missing Authorization to Authenticated (Subscriber+) Arbitrary Theme Installation / Remote Code Execution via 'qqfile' Parameter
- Post Gallery <= 1.0.6 - Cross-Site Scripting
- Responsive Gallery Grid <= 2.3.13 - Cross-Site Request Forgery
- RapidResult <= 1.2 - Authenticated (Contributor+) SQL Injection
- LearnPress <= 4.3.9.1 - Insecure Direct Object Reference to Authenticated (Subscriber+) Sensitive Information Disclosure via 'userId' Parameter
- TheCartPress eCommerce Shopping Cart <= 1.5.3.6 Cross-Site Request Forgery
- Testimonials Creator 1.6 - Authenticated (Admin+) Stored Cross-Site Scripting
- WP Fast Total Search <= 1.68.232 - Unauthenticated Stored Cross-Site Scripting
- Visitor Maps Extended Referer Field <= 1.2.6 - Reflected Cross-Site Scripting
- Exit Intent Popup <= 1.0.1 - Unauthenticated Server-Side Request Forgery
- GamiPress – Gamification plugin to reward points, badges & ranks in WordPress, now with AI 7.9.5 - 8.0.5 - Missing Authorization
- PowerPress <= 8.3.7 - Arbitrary File Upload
- Wishlist for WooCommerce <= 2.1.2 - Authenticated (Administrator+) Stored Cross-Site Scripting
- Smart Docs <= 1.1.1 - Authenticated (Admin+) Stored Cross-Site Scripting
- Kargo Entegratör <= 1.1.14 - Authenticated (Shop Manager+) SQL Injection
- WordPress Simple PayPal Shopping Cart <= 5.1.2 - Unauthenticated Product Price Manipulation
- Contact Form by Supsystic <= 1.7.36 - Reflected Cross-Site Scripting
- teachPress <= 9.0.12 - Cross-Site Request Forgery
- Borderless – Elementor Addons and Templates <= 1.7.1 - Authenticated (Contributor+) Stored Cross-Site Scripting
- Pods - Custom Content Types and Fields - Authenticated (Contributor+) Remote Code Execution
- Directorist <= 8.9.4 - Authenticated (Subscriber+) Server-Side Request Forgery
- Car Rental Manager <= 1.3.9 - Authenticated (Editor+) PHP Object Injection
- User Password Reset <= 1.0 - Reflected Cross-Site Scripting
- 爱采集数据采集和发布插件 <= 1.0.0 - Unauthenticated Arbitrary File Read
- Butcher <= 2.40 - Unauthenticated Local File Inclusion
- AI Engine – The Chatbot, AI Framework & MCP for WordPress <= 3.6.8 - Unauthenticated Stored Cross-Site Scripting
- LetsRecover <= 1.1.0 - Authenticated (Admin+) SQL Injection
- NewStatPress < 1.2.5 - Unauthenticated Stored Cross-Site Scripting
- root Cookie <= 1.6 - Cross-Site Request Forgery to Stored Cross-Site Scripting
- NitroPack <= 1.19.3 - Missing Authorization