Vulnerability archive: section 15, page 21
Open a report to review affected versions, available fixes and original sources. Each report covers a specific issue; its presence does not establish whether your website is affected.
- Gutenberg Blocks by Kadence Blocks <= 3.3.1 - Missing Authorization
- AIomatic - Automatic AI Content Writer <= 2.0.5 - Unauthenticated Arbitrary Email Sending
- Amr Ical Events Lists <= 6.6 - Authenticated (Administrator+) Stored Cross-Site Scripting
- Forminator <= 1.22.1 - Missing Authorization on 'load_recaptcha_preview' AJAX function
- Molla <= 1.5.13 - Unauthenticated Remote Code Execution
- 3D Product configurator for WooCommerce <= 2.16.2 - Unauthenticated Remote Code Execution via 'xpv_image' Parameter
- Appointment Booking Calendar <= 1.1.7 - Multiple Reflected Cross-Site Scripting
- Who Hit The Page – Hit Counter <= 1.4.14.3 - Reflected Cross-Site Scripting
- Meow Gallery <= 5.4.4 - Missing Authorization to Authenticated (Author+) Shortcode creation
- Popup by Supsystic <= 1.10.29 - Authenticated (Admin+) Remote Code Execution
- Mobile Menu 2.7.4 - 2.8.8 - Cross-Site Request Forgery to Stored Cross-Site Scripting
- 3DPrint Lite <=2.1.3.6 - Authenticated (Admin+) SQL Injection via 'material_text'
- Monitor.chat <= 1.1.1 - Reflected Cross-Site Scripting
- Login with phone number <= 1.7.49 - Authenticated (Subscriber+) Authorization Bypass to Privilege Escalation
- Simple Stripe Checkout <= 1.1.28 - Reflected Cross-Site Scripting
- Crafthemes Demo Import <= 3.3 - Authenticated (Admin+) Arbitrary File Upload in process_uploaded_files
- Download Manager <= 3.2.49 - Authenticated (Contributor+) PHAR Deserialization
- HT Event <= 1.4.5 - Cross-Site Request Forgery leading to Arbitrary Plugin Activation
- Visitors Online by BestWebSoft <= 0.3 - SQL Injection
- ShortPixel Image Optimizer <= 5.4.1 - Authenticated(Editor+) PHP Object Injection
- Animation Addons for Elementor <= 2.4.5 - Authenticated (Contributor+) Arbitrary Content Deletion
- Sunshine Photo Cart <= 3.2.9 - Missing Authorization
- Platform.ly Official <= 1.1.3 - Cross-Site Request Forgery to Stored Cross-Site Scripting
- Xavin's Review Ratings <= 1.4.0 - Authenticated (Contributor+) Stored Cross-Site Scripting
- Pie Register – User Registration Forms < 2.0.19 - Authenticated SQL Injection
- پارسی دیت – Parsi Date <= 6.3 - Unauthenticated Stored Cross-Site Scripting
- EPROLO-Dropshipping <= 2.4.2 - Missing Authorization
- aThemes Addons for Elementor <= 1.1.5 - Authenticated (Contributor+) Stored Cross-Site Scripting via Call To Action Widget
- AWEOS WP Lock <= 1.4.8 - Authenticated (Administrator+) Stored Cross-Site Scripting
- LabTools <= 1.0 - Missing Authorization
- WordPress Core < 4.8.2 - Cross-Site Scripting via Shortcodes
- WP Abstracts <= 2.7.2 - Cross-Site Request Forgery to Reflected Cross-Site Scripting
- ViewMedica 9 <= 1.4.18 - Authenticated (Contributor+) Stored Cross-Site Scripting
- Evon <= 3.4 - Unauthenticated Local File Inclusion
- Primary Addon for Elementor <= 1.5.7 - Authenticated (Contributor+) Stored Cross-Site Scripting
- Contact Form With Shortcode <= 4.2.5 - Reflected Cross-Site Scripting
- Team Members <= 8.7 - Authenticated (Administrator+) Stored Cross-Site Scripting via 'custom_css' Parameter
- WP Event Manager <= 3.1.50 - Unauthenticated Stored Cross-Site Scripting via 'organizer_name'
- Mobile Smart <= v1.3.16 - Reflected Cross-Site Scripting
- NextGen Gallery <= 2.1.56 - Remote File Inclusion
- Login with Cognito <= 1.4.6 - Authentication Bypass
- GDPR Personal Data Reports <= 1.0.5 - Authenticated (Contributor+) Stored Cross-Site Scripting
- Advanced Sermons <= 3.4 - Authenticated (Contributor+) Stored Cross-Site Scripting
- Save as Image plugin by Pdfcrowd <= 2.16.0 - Authenticated (Administrator+) Stored Cross-Site Scripting via settings
- ElementsKit Lite <= 3.10.0 - Authenticated (Subsite administrator+) Stored Cross-Site Scripting
- Contact Us Simple Form <= 1.0 - Authenticated (Administrator+) Stored Cross-Site Scripting via Plugin Settings
- Simple Giveaways <= 2.46 - Cross-Site Request Forgery
- MainWP Rocket Extension <= 4.0.3 - Missing Authorization to Arbitrary Plugin Activation
- AI Infographic Maker <= 4.6.7 - Authenticated (Contributor+) Stored Cross-Site Scripting
- LazyLoad Plugin – Lazy Load Images, Videos, and Iframes <= 2.4.0 - Authenticated (Contributor+) Stored Cross-Site Scripting
- Contact Form Builder by Bit Form <= 2.1.0 - Authenticated (Admin+) Stored Cross-Site Scripting
- NewPath WildApricotPress Add-on – Member Directory <= 1.0.0 - Unauthenticated Information Exposure
- Restrict – membership, site, content and user access restrictions for WordPress <= 2.2.8 - Unauthenticated Content Restriction Bypass to Sensitive Information Exposure
- WPBookit Pro <= 1.6.18 - Authenticated (Subscriber+) Privilege Escalation
- Constructor <= 1.6.5 - Missing Authorization
- Show All Comments <= 7.0.0 - Reflected Cross-Site Scripting
- Dolcino <= 1.6 - Authenticated (subscriber+) Insecure Direct Object Reference
- Responsive Logo Slideshow < 1.2 - Cross-Site Scripting
- Top Comments <= 1.0 - Authenticated (Admin+) Stored Cross-Site Scripting
- WP Statistics – Simple, privacy-friendly Google Analytics alternative <= 14.16.6 - Unauthenticated Stored Cross-Site Scripting
- Attractive Donations System - Easy Stripe & Paypal donations <= 1.25 - Missing Authorization to Unauthenticated Arbitrary Content Deletion
- FLOWFACT WP Connector <= 2.1.8 - Reflected Cross-Site Scripting
- Responsive Lightbox & Gallery <= 2.4.7 - Authenticated (Author+) Stored Cross-Site Scripting via File Upload
- Snow Mountain <= 1.4.3 - Unauthenticated Local File Inclusion
- WP Users Masquerade <= 2.0.0 - Authenticated (Subscriber+) Authentication Bypass
- Profile Builder <= 2.0.2 - Reflected Cross-Site Scripting
- WP-Members Membership Plugin <= 3.5.7 - Missing Authorization
- eShipper Commerce <= 2.16.12 - Missing Authorization
- Good & Bad Comments <= 1.0.0 - Authenticated (Admin+) Stored Cross-Site Scripting
- TypeSquare Webfonts <= 2.0.7 - Missing Authorization via typesquare_admin_init()
- eCommerce Product Catalog <= 3.3.26 - Sensitive Information Exposure via CSV Files
- DW Question & Answer < 1.4.2.3 - Stored Cross-Site Scripting
- FormLayer < 1.0.9 - Unauthenticated Information Exposure
- Jabbernotification <= 0.99-RC2 - Reflected Cross-Site Scripting via admin.php PATH_INFO
- Chained Quiz <= 1.3.2.4 - Cross-Site Request Forgery to Submitted Response Deletion
- SMM API <= 6.0.30 - Unauthenticated Stored Cross-Site Scripting
- Menu Image, Icons made easy <= 3.10 - Authenticated (Administrator+) Stored Cross-Site Scripting via settings
- My Calendar <= 3.4.3 - Cross-Site Request Forgery
- Car Park Booking System for WordPress <= 2.6 - Missing Authorization
- Auto Affiliate Links <= 6.4.3 - Missing Authorization via aalAddLink
- WP-Click-Tracker <= 0.7.3 - Reflected Cross-Site Scripting
- JobCareer <= 7.3 - Authenticated (Subscriber+) Arbitrary File Deletion
- NewsmanApp <= 2.7.7 - Cross-Site Request Forgery
- EventON <= 2.2.14 - Authenticated (Administrator+) Stored Cross-Site Scripting
- Legal Text Connector of the IT-Recht Kanzlei <= 1.0.13 - Missing Authorization
- AWP Classifieds <= 4.3.1 - Missing Authorization
- Widget Settings Importer/Exporter Plugin <= 1.5.3 - Unauthorized Widget Import to Stored Cross-Site Scripting
- Stargaze <= 1.10 - Unauthenticated PHP Object Injection
- Ajax Search Pro <= 4.26.1 - Reflected Cross-Site Scripting
- WP Projects Portfolio with Client Testimonials <= 3.0 - Cross-Site Request Forgery to Stored Cross-Site Scripting
- Duplicate Title Checker <= 1.2 - Authenticated (Subscriber+) SQL Injection
- Gallery Manager <= 1.5.12 - Cross-Site Scripting
- CM Ad Changer <= 1.7.7 - Cross-Site Request Forgery to Stored Cross-Site Scripting
- Youtube Video Grid | Youmax <= 1.9 - Reflected Cross-Site Scripting
- Filr – Secure document library <= 1.2.13 - Authenticated (Contributor+) Arbitrary File Uploads
- EMI Calculator <= 1.1 - Missing Authorization to Unauthenticated Settings Change
- TCBD Tooltip <= 1.0 - Authenticated (Contributor+) Stored Cross-Site Scripting
- RDFa Breadcrumb <= 2.3 - Authenticated (Administrator+) Stored Cross-Site Scripting
- wpDataTables (Premium) <= 3.4 - SQL Injection
- AppMySite <= 3.11.0 - Unauthenticated Information Disclsoure