Vulnerability archive: section 15, page 4
Open a report to review affected versions, available fixes and original sources. Each report covers a specific issue; its presence does not establish whether your website is affected.
- IMPress for IDX Broker <= 3.3.1 - Authenticated (Contributor+) Stored Cross-Site Scripting
- Visionary Core <= 1.4.9 - Authenticated (Subscriber+) PHP Object Injection
- Simple Giveaways <= 2.45.0 - Authenticated(Admin+) Stored Cross-Site Scripting via form fields
- Migration, Backup, Staging – WPvivid <= 0.9.107 - Unauthenticated PHP Object Injection
- Broadcast Live Video – Live Streaming : HTML5, WebRTC, HLS, RTSP, RTMP < 4.29.5 - Cross-Site Scripting
- FluentSMTP <= 2.2.2 - Authenticated (Author+) Stored Cross-Site Scripting via Email Logs
- WebAuthn Provider for Two Factor <= 2.5.5 - Two-Factor Authentication Bypass
- Contact Forms by Cimatti Plugin <= 1.9.8 - Cross-Site Request Forgery
- WooCommerce Shipping Per Product <= 2.5.4 - Missing Authorization
- Elevio <= 4.4.1 - Cross-Site Request Forgery
- Ultimate Member <= 2.1.6 - Open Redirect
- WP Finance <= 1.3.6 - Reflected Cross-Site Scripting
- Assistant <= 1.4.3 - Authenticated (Editor+) Server Side Request Forgery
- SAML Single Sign On <= 5.4.7 - Unauthenticated Privilege Escalation
- CleverReach WP <= 1.5.20 - Unauthenticated SQL Injection via title Parameter
- Cart Lift – Abandoned Cart Recovery for WooCommerce and EDD <= 3.1.5 - Reflected Cross-Site Scripting via cart_search
- Groups <= 3.7.0 - Authenticated (Subscriber+) Insecure Direct Object Reference to Arbitrary Group Join
- Nmedia MailChimp <= 5.4 - Authenticated (Subscriber+) Stored Cross-Site Scripting
- EC Authorize.net <= 0.3.3 - Reflected Cross-Site Scripting
- Flexmls® IDX Plugin <= 3.14.26 - Authenticated (Contributor+) Stored Cross-Site Scripting via API parameters
- Highlight Focus <= 1.1 - Authenticated (Administrator+) Stored Cross-Site Scripting
- Tailored Tools <= 3.0.2 - Authenticated (Contributor+) Stored Cross-Site Scripting
- Bug Library <= 2.1.1 - Authenticated (Admin+) Stored Cross-Site Scripting
- Hotel Booking < 3.3 - Authenticated (Contributor+) Stored Cross-Site Scripting
- Klamra Paycal for Aspaclaria <= 1.1.4 - Insecure Direct Object Reference to Authenticated (Subscriber+) Sensitive Information Exposure via 'invoice_id' Parameter
- Shortcode Cleaner Lite <= 1.0.9 - Missing Authorization to Authenticated (Subscriber+) Arbitrary Options Export
- Photo Gallery by 10Web <= 1.1.30 - Reflected Cross-Site Scripting
- SocialGrid <= 2.4 - Cross-Site Scripting
- Coachify <= 1.1.5 - Cross-Site Request Forgery
- WP Job Board <= 4.4.4 - SQL Injection
- kStats Reloaded <= 0.7.4 - Reflected Cross-Site Scripting
- Newsletter Manager < 1.4 - Cross-Site Request Forgery
- Cryptocurrency Prijsvergelijking Widget <= 1.0 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'width' Shortcode Attribute
- WooCommerce Amazon Affiliates - Wordpress Plugin < 14.1.00 - Authenticated (Subscriber+) Privilege Escalation
- teachPress <= 9.0.12 - Authenticated (Contributor+) Stored Cross-Site Scripting
- aThemes Addons for Elementor <= 1.1.2 - Authenticated (Contributor+) Stored Cross-Site Scripting
- MasterStudy LMS <= 3.2.1 - Cross-Site Request Forgery
- Contact Form and Calls To Action by vcita <= 2.7.1 - Authenticated (Contributor+) Stored Cross-Site Scripting
- Gift Cards (Gift Vouchers and Packages) (WooCommerce Supported) <= 4.7.0 - Unauthenticated Stored Cross-Site Scripting
- Rencontre – Dating Site <= 3.10.1 - Unauthenticated Arbitrary File Upload
- Post Grid Master <= 3.4.10 - Reflected Cross-Site Scripting
- BuddyPress Notification Widget <= 1.3.3 - Authenticated (Contributor+) Stored Cross-Site Scripting
- CubeWP Forms <= 1.1.5 - Missing Authorization
- Jetpack Feedback Exporter <= 1.23 - Unauthenticated Sensitive Information Exposure
- MemberDash <= 1.8.5 - Unauthenticated Account Takeover via Insecure Direct Object Reference via 'id' Parameter
- BuddyPress Customer.io Analytics Integration <= 1.1.6 - Cross-Site Request Forgery
- Chaplin <= 2.6.8 - Missing Authorization
- Video Posts Webcam Recorder <= 1.55.4 - Reflected Cross-Site Scripting
- JAY Login & Register <= 2.6.03 - Authenticated (Subscriber+) Privilege Escalation via jay_panel_ajax_update_profile
- Side Menu Lite <= 4.0 - Cross-Site Request Forgery to Item Deletion
- GiveWP – Donation Plugin and Fundraising Platform <= 4.18.0 - Missing Authorization
- Listdom: AI-powered Business Directory with Classifieds Ads Listings <= 5.6.0 - Unauthenticated SQL Injection
- GiveWP <= 2.25.1 - Cross-Site Request Forgery to Cross-Site Scripting via render_dropdown
- Advanced 301 and 302 Redirect <= 1.6.9 - Unauthenticated SQL Injection
- Catfolders Document Gallery Pro < 2.0.7 - Missing Authorization
- Instant Image Generator <= 1.5.2 - Unauthenticated Arbitrary File Upload
- Passwordless WP – Login with your glance or fingerprint <= 1.1.6 - Reflected Cross-Site Scripting
- miniOrange Social Login and Register (Discord, Google, Twitter, LinkedIn) <= 7.7.0 - Unauthenticated Authentication Bypass to Administrator Account Takeover via Profile Completion OTP Flow
- WP Social AutoConnect <= 4.6.1 - Cross-Site Request Forgery via jfb_admin_page
- WP eCommerce <= 3.8.9 - SQL Injection
- Contact Form Plugin by Fluent Forms for Quiz, Survey, and Drag & Drop WP Form Builder <= 5.1.15 - PHP Object Injection via extractDynamicValues
- WordPress Button Plugin MaxButtons <= 9.2 - Cross-Site Request Forgery
- Brafton < 3.4.8 - Reflected Cross-Site Scripting
- School Management System – WPSchoolPress <= 2.2.16 - Missing Authorization to Arbitrary User Deletion
- MainWP White Label Extension <= 4.1.1 - Missing Authorization to Plugin Settings Change
- Profile Builder/Profile Builder Pro <= 3.3.2 - Authenticated Blind SQL Injection
- Easy Menu Manager | WPZest <= 1.0.1 - Authenticated (Author+) Stored Cross-Site Scripting via SVG File Upload
- wpForo Forum <= 3.0.4 - Unauthenticated SQL Injection
- Hacklog Remote Attachment <= 1.3.2 - Cross-Site Request Forgery
- Endless Scroll <= 1.0.0 - [Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')]
- Duplicator < 0.5.10 - Arbitrary Backup Creation and Download
- Custom Admin Menu <= 1.0.0 - Reflected Cross-Site Scripting
- Open Close WooCommerce Store <= 4.9.5 - Authenticated (Contributor+) Local File Inclusion
- Suggestion Engine for WooCommerce <= 2.0.11 - Authenticated (Contributor+) SQL Injection
- Next-Cart Store to WooCommerce Migration <= 3.9.2 - Reflected Cross-Site Scripting
- Search Atlas SEO <= 1.8.2 - Authenticated (Administrator+) Stored Cross-Site Scripting
- MyQtip – easy qTip2 <= 2.0.5 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode
- BuddyPress WooCommerce My Account Integration. Create WooCommerce Member Pages <= 3.4.25 - Cross-Site Request Forgery to Limited Settings Update
- Import XML and RSS Feeds <= 2.1.5 - Authenticated (Administrator+) Arbitrary File Upload
- FloLaunch <= 2.4 - Missing Authorization
- Gutenverse Form <= 2.3.1 - Missing Authorization
- Woffice <= 5.4.30 - Reflected Cross-Site Scripting
- Putler Connector for WooCommerce <= 2.12.0 - Missing Authorization via 'putler_connector_sync_complete'
- WP SpreadPlugin < 3.8.6.2 - Cross-Site Scripting
- Premmerce User Roles <= 1.0.12 - Missing Authorization via role management functions
- Media File Renamer < 1.9.4 - Stored Cross-Site Scripting
- Simple Download Monitor <= 3.9.33 - Simple Download Monitor <= 3.9.33 – Authenticated (Contributor+) SQL Injection via order parameter in Log Export functionality
- Social button <= 1.3 - Authenticated (Contributor+) Stored Cross-Site Scripting
- FrescoChat Live Chat <= 3.2.6 - Cross-Site Request Forgery to Stored Cross-Site Scripting
- Smart Icons For WordPress <= 1.0.4 - Authenticated (Author+) Stored Cross-Site Scripting via SVG File Upload
- WP Touch Slider <= 2.2 - Reflected Cross-Site Scripting
- Sanzo < 2.4.3 - Authenticated (Subscriber+) Stored Cross-Site Scripting
- Raychat <= 2.2.1 - Cross-Site Request Forgery
- Request a Quote <= 2.4.0 - Authenticated (Admin+) Stored Cross-Site Scripting
- Menu Image, Icons made easy <= 3.0.7 - Authenticated Cross-Site Scripting
- Semrush Content Toolkit <= 1.1.32 - Cross-Site Request Forgery
- Everest Forms <= 3.4.0 - Unauthenticated Missing Authorization
- WPNakama <= 0.6.3 - Unauthenticated SQL Injection via 'order_by' Parameter
- Gallery - Video Gallery and YouTube Gallery <= 2.0.3 - Cross-Site Request Forgery
- Daily Edition <= 1.6.2 - SQL Injection