Vulnerability archive: section 15, page 22
Open a report to review affected versions, available fixes and original sources. Each report covers a specific issue; its presence does not establish whether your website is affected.
- Database Toolset <= 1.8.4 - Unauthenticated Arbitrary File Deletion
- RSS in Page <= 2.9.1 - Authenticated (Contributor+) Stored Cross-Site Scripting
- Frontend Dashboard <= 3.0.7 - Authenticated (Subscriber+) Privilege Escalation
- Auto Login After Registration <= 1.0.0 - Reflected Cross-Site Scripting
- Sweet Jane - Delightful Cake Shop Theme <= 1.2 - Unauthenticated Local File Inclusion
- WhyDoWork AdSense <= 1.2 - Cross-Site Request Forgery
- TWIPLA (Visitor Analytics IO) <= 1.2.0 - Authenticated (Admin+) Stored Cross-Site Scripting
- Hypotext <= 1.0.1 - Authenticated (Contributor+) Stored Cross-Site Scripting
- Events Manager < 5.3.9 - Cross-Site Scripting
- WP Captcha <= 2.0.0 - Cross-Site Request Forgery
- WP-Backgrounds Lite <= 2.3 - Cross-Site Request Forgery Bypass
- ACF Images Search And Insert <= 1.1.4 - Authenticated (Subscriber+) Arbitrary File Upload
- Fiorello - Florist and Flower Shop WordPress Theme <= 1.0 - Unauthenticated Local File Inclusion
- Favicon by RealFaviconGenerator <= 1.3.21 - Reflected Cross-Site Scripting
- WordPress Core <= 3.3.1 - Same Origin Policy Bypass
- WP Booking System – Booking Calendar <= 2.0.19.8 - Reflected Cross-Site Scripting
- Rootspersona <= 3.7.5 - Missing Authorization
- WP Food Manager <= 1.0.3 - Authenticated(Administrator+) Stored Cross-Site Scripting
- OMGF Pro <= 5.2.7 - Unauthenticated Arbitrary File Download
- Simple Gmail Login < 1.1.4 - Sensitive Information Disclosure
- Embed HTML5 Game <= 1.3 - Unauthenticated Arbitrary File Upload
- Dyn Business Panel <= 1.0.0 - Reflected Cross-Site Scripting
- Bookit — Booking & Appointment Calendar <= 2.6.0.3 - Missing Authorization
- RealPress – Real Estate Plugin <= 1.1.2 - Unauthenticated SQL Injection
- Html5 Audio Player <= 2.2.28 - Authenticated (Contributor+) Stored Cross-Site Scripting
- Essential Addons for Elementor – Best Elementor Addon, Templates, Widgets, Kits & WooCommerce Builders <= 6.0.9 - Authenticated (Contributor+) Sensitive Information Exposure
- WordPress Advanced Ticket System, Elite Support Helpdesk <= 1.0.63 - Authenticated (Admin+) Stored Cross-Site Scripting
- Directory Listings WordPress plugin – uListing <= 2.2.0 - Missing Authorization
- DB Backup < 5.0 - Directory Traversal
- ACL Floating Cart for WooCommerce <= 0.9 - Reflected Cross-Site Scripting
- Shortcodes and extra features for Phlox <= 2.17.13 - Unauthenticated Information Exposure
- Rank Math SEO <= 1.0.279 - Authenticated (Administrator+) Arbitrary File Upload
- Google Adsense & Banner Ads by AdsforWP <= 1.9.28 - Cross-Site Request Forgery
- Stackable <= 3.18.1 - Authenticated (Contributor+) Sensitive Information Exposure
- WPO365 | LOGIN <= 11.6 - Authentication Bypass
- Get Your Number <= 1.1.3 - Authenticated (Administrator+) Stored Cross-Site Scripting
- File Gallery <= 1.8.5.3 - Authenticated (Contributor+) Stored Cross-Site Scripting via file_gallery_shortcode
- Download Manager <= 3.3.08 - Authenticated (Author+) Path Traversal to Limited File Overwrite
- WPConsent <= 1.1.9 - Unauthenticated Stored Cross-Site Scripting via Comment Content via Simple HTML DOM Parser Noise-Key Restoration (mXSS)
- Directory Pro <= 2.5.5 - Authenticated (Contributor+) Stored Cross-Site Scripting
- WP OAuth Server <= 4.2.5 - Authenticated (Subscriber+) Arbitrary Client Deletion (wo_ajax_remove_client)
- WP DSGVO Tools (GDPR) <= 3.1.32 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode
- Media Player Addons for Elementor <= 1.0.5 - Authenticated (Contributor+) Stored Cross-Site Scripting via Multiple Widget Fields
- WP Edit <= 4.0.4 - Authenticated (Administrator+) Stored Cross-Site Scripting
- Zendesk Support for WordPress <= 1.8.4 - Cross-Site Request Forgery
- Enter Addons <= 2.1.6 - Authenticated (Contributor+) Stored Cross-Site Scripting
- GiveWP <= 4.16.1 - Authenticated (Give Worker+) Stored Cross-Site Scripting via Sequioa Form
- flickr-picture-backup <= 0.7 - Arbitrary file upload
- WordPress Core < 2.6.2 - Cryptographic Weakness
- HTML5 Audio Player – The Ultimate No-Code Podcast, MP3 & Audio Player <= 2.8.8 - Authenticated (Contributor+) Stored Cross-Site Scripting
- Prime Slider – Hero Slider, Carousel, WooCommerce & Post Slider Elementor Addons <= 4.6.2 - Authenticated (Contributor+) Stored Cross-Site Scripting
- Contact Form 7 Skins <= 2.5.0 - Reflected Cross-Site Scripting
- Responsive Block Control <= 1.3.0 - Authenticated (Contributor+) Stored Cross-Site Scripting
- Bold Page Builder <= 4.8.8 - Authenticated (Contributor+) Stored Cross-Site Scripting via Separator Element
- Silencesoft RSS Reader <= 0.6 - Unauthenticated Server-Side Request Forgery
- Limit Attempts by BestWebSoft – WordPress Anti-Bot and Security Plugin for Login and Forms < 1.1.1 - SQL Injection
- Video Grid <= 1.21 - Reflected Cross-Site Scripting
- External Markdown <= 0.0.1 - Authenticated (Contributor+) Stored Cross-Site Scripting
- Better WordPress reCAPTCHA <= 2.0.3 - Reflected Cross-Site Scripting
- Featured Posts Scroll <= 1.25 - Cross-Site Request Forgery to Stored Cross-Site Scripting
- Ultra Addons for WPForms <= 1.0.11 - Missing Authorization
- Smart Notification <= 10.3 - Unauthenticated SQL Injection
- Houzez <= 4.1.6 - Authenticated (Subscriber+) PHP Object Injection via Saved Search
- Sell Media <= 2.5.8.5 - Authenticated (Contributor+) Stored Cross-Site Scripting
- Invisible Anti-Spam & CAPTCHA <= 5.1 - Authenticated (Editor+) SQL Injection via Pattern JSON Keys/Values
- LMB^Box Smileys <= 3.2 - Cross-Site Request Forgery to Stored Cross-Site Scripting
- Audio Merchant <= 5.0.4 - Cross-Site Request Forgery to Settings Modifcation and Stored Cross-Site Scripting
- Eldon - Artist Portfolio WordPress Theme <= 1.4.1 - Unauthenticated PHP Object Injection
- Nomupay Payment Processing Gateway <= 7.1.7 - Authenticated (Shop Manager+) Arbitrary File Download
- Unyson <= 2.7.28 - Missing Authorization
- VikBooking Hotel Booking Engine & PMS <= 1.8.12 - Reflected Cross-Site Scripting via 'layoutstyle' Parameter
- tagDiv Composer <= 5.4.7 - Authenticated (Contributor+) Stored Cross-Site Scripting
- Kimili Flash Embed <= 2.5.3 - Authenticated (Contributor+) Stored Cross-Site Scripting
- Smart Maintenance Mode <= 1.5.1 - Authenticated (Admin+) Stored Cross-Site Scripting
- HD Quiz – Save Results Light <= 0.5 - Missing Authorization
- Custom Post Type Page Template <= 1.1 - Cross-Site Request Forgery
- WordPress to Buffer <= 3.8.1 - Authenticated (Admin+) Cross-Site Scripting
- Sina Extension for Elementor <= 3.6.0 - Authenticated (Contributor+) Stored Cross-Site Scripting via Fancy Text, Countdown Widget, and Login Form Shortcodes
- WPCOM Member <= 1.7.5 - Authentication Bypass via 'user_phone'
- Bricks Builder <= 1.12.4 - Unauthenticated SQL Injection via `p` Parameter
- AWP Classifieds <= 4.4.5 - Missing Authorization
- LearnPress <= 3.2.6.6 - Privilege Escalation
- Ditty – Responsive News Tickers, Sliders, and Lists <= 3.1.42 - Authenticated (Author+) Stored Cross-Site Scripting
- Quiz and Survey Master <= 7.0.0 - Arbitrary File Upload
- MasterStudy LMS <= 3.6.15 - Missing Authorization
- EnvíaloSimple: Email Marketing y Newsletters <= 2.3 - Cross-Site Request Forgery to Arbitrary File Upload
- Simple Banner <= 2.10.3 - Authenticated (Admin+) Stored Cross-Site Scripting
- Album and Image Gallery with Lightbox – Flagallery Photo Portfolio <= 6.1.2 - Authenticated (Admin+) Stored Cross-Site Scripting
- FooGallery <= 2.2.44 - Cross-Site Request Forgery
- SlimStat Analytics <= 5.3.4 - Unauthenticated Stored Cross-Site Scripting via 'notes/resource' Parameters
- WordPress Core < 3.9.2 - Deserialization via Widgets
- Structured Content (JSON-LD) #wpsc <= 1.6.4 - Authenticated (Contributor+) Stored Cross-Site Scripting via FAQ Block
- WP SuperBackup <= 2.3.3 - Authenticated (Subscriber+) PHP Object Injection
- Fixedly Media Gallery <= 1.3.1 - Reflected Cross-Site Scripting
- Hero Banner Ultimate <= 1.4.4 - Authenticated (Author+) Local File Inclusion
- GPXpress <= 1.3 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode Attributes
- Xpro Theme Builder <= 1.2.8.4 - Missing Authorization
- Related Posts for WordPress <= 4.0.3 - Cross-Site Request Forgery
- Spectra – WordPress Gutenberg Blocks <= 2.15.0 - Authenticated (Contributor+) Stored Cross-site Scripting
- Formidable Forms <= 6.28 - Unauthenticated Payment Amount Manipulation via 'item_meta' Parameter