Vulnerability archive: section 15, page 6
Open a report to review affected versions, available fixes and original sources. Each report covers a specific issue; its presence does not establish whether your website is affected.
- Xhanch - My Advanced Settings <= 1.1.2 - Cross-Site Request Forgery to Settings Update
- Read and Understood < 2.2 - Cross-Site Scripting
- Newspaper - News & WooCommerce WordPress Theme <= 6.7 - Arbitrary Options Update
- NextScripts: Social Networks Auto-Poster < 4.4.8 - Reflected Cross-Site Scripting
- Featurific For WordPress <= 1.6.2 - Cross-Site Scripting
- Constant Contact Forms <= 2.0.2 - Missing Authorization via constant_contact_privacy_ajax_handler
- User Feedback – Create Interactive Feedback Form, User Surveys, and Polls in Seconds <= 1.8.0 - Missing Authorization to Information Disclosure
- Namaste! LMS <= 2.6.2 - Reflected Cross-Site Scripting
- Multiple Themes by axiomthemes, ThemeRex, and AncoraThemes <= 1.18.0 - Unauthenticated Local File Inclusion
- FraudLabs Pro SMS Verification <= 1.10.1 - Cross-Site Request Forgery to Stored Cross-Site Scripting
- Photospace Responsive <= 2.1.1 - Authenticated (Administrator+) Stored Cross-Site Scripting
- Fable Extra <= 1.0.6 - Authenticated (Contributor+) Stored Cross-Site Scripting
- Beaver Builder <= 2.7.4.4 - Authenticated (Contributor+) Stored Cross-Site Scripting
- Kalles Addons <= 1.0.6 - Unauthenticated PHP Object Injection
- Brizy – Page Builder <= 2.4.39 - Authenticated (Contributor+) Directory Traversal
- Mobile Events Manager <= 1.4.8.3 & MDJM Event Management < 1.7.8.5 - Missing Authorization
- GP Premium <= 2.5.5 - Authenticated (Contributor+) Arbitrary File Upload
- JS Restaurant (All Versions) - SQL Injection
- Simple Single Sign On <= 4.1.1 - Insecure OAuth Implementation to Authentication Bypass
- Google +1 by BestWebSoft < 1.3.4 - Reflected Cross-Site Scripting
- AllWebMenus WordPress Menu Plugin <= 1.1.3 - Remote File Inclusion
- Psychological tests & quizzes <= 0.21.19 - Authenticated (Contributor+) Cross-Site Scripting
- Hydra Booking 1.1.0 - 1.1.18 - Missing Authorization to Authenticated (Subscriber+) Privilege Escalation via tfhb_reset_password_callback Function
- InfiniteWP Client <= 1.9.4.4 - Authentication Bypass
- GeekyBot — AI Copilot, Chatbot, WooCommerce Lead Gen & Zero-Prompt Content <= 1.2.0 - Unauthenticated SQL Injection
- Essential Addons for Elementor Lite <= 5.0.8 - Reflected Cross-Site Scripting
- Responsive Pricing Table <= 5.1.10 - Authenticated (Author+) Stored Cross-Site Scripting
- The7 <= 11.6.0 - Reflected Cross-Site Scripting
- Variation Swatches for WooCommerce <= 2.3.7 - Reflected Cross-Site Scripting
- Admin Bar Remover <= 1.0.2.2 - Missing Authorization to Authenticated (Subscriber+) Settings Update
- wpDataTables – WordPress Tables & Table Charts Plugin <= 2.1.27 - Authenticated (Admin+) Stored Cross-Site Scripting
- Copypress Rest API 1.1 - 1.2 - Missing Configurable JWT Secret and File-Type Validation to Unauthenticated Remote Code Execution
- Greek Multi Tool – Fix peralinks, accents, auto create menus and more <= 2.3.1 - Missing Authorization
- Elementor Addon Elements <= 1.12.7 - Cross-Site Request Forgery
- Shared Files <= 1.7.28 - Unauthenticated Sensitive Information Exposure
- Site Kit by Google – Analytics, Search Console, AdSense, Speed <= 1.186.0 - Cross-Site Request Forgery
- Muzicon <= 1.9.0 - Unauthenticated Local File Inclusion
- WPBakery <= 7.7 - Authenticated (Author+) Local File Inclusion
- BuddyForms Moderation <= 1.4.16 - Authenticated Stored Cross-Site Scripting
- YourChannel <= 1.2.2 Authenticated (Contributor+) Cross-Site Scripting via Shortcode
- Penci Recipe <= 4.0 - Authenticated (Contributor+) Stored Cross-Site Scripting
- Duplicate Page <= 4.4.1 Authenticated (Admin+) Stored Cross-Site Scripting
- WorkScout-Core <= 1.7.06 - Unauthenticated Stored Cross-Site Scripting
- EMC2 Custom Help Videos <= 1.2 - Reflected Cross-Site Scripting
- KB Support <= 1.5.88 - Missing Authorization to Sensitive Data Exposure
- YayMail – WooCommerce Email Customizer <= 4.3.3 - Authenticated (Shop manager+) PHP Object Injection
- WP Airbnb Review Slider <= 3.2 - Cross-Site Request Forgery
- PixelYourSite – Your smart PIXEL (TAG) & API Manager <= 10.1.1.1 - Unauthenticated PHP Object Injection
- Essential Blocks <= 4.0.6 - Cross-Site Request Forgery via save
- Misiek Photo Album <= 1.4.3 - Cross-Site Request Forgery to Album Deletion
- Social Links <= 1.0.11 - Cross-Site Request Forgery to Stored Cross-Site Scripting
- GDPR Cookie Compliance <= 4.15.6 - Authenticated (Admin+) Stored Cross-Site Scripting
- WordPress Core <= 7.1 - Authenticated (Contributor+) Information Exposure via Sample Permalink AJAX Actions
- Dictionary <= 1.0 - Reflected Cross-Site Scripting
- Aperitif <= 1.6 - Unauthenticated PHP Object Injection
- Essential Grid <= 3.1.1 - Unauthenticated Private Post Disclosure
- Featured Posts with Multiple Custom Groups (FPMCG) <= 4.0 - Cross-Site Request Forgery
- JoomSport <= 5.3.0 - Missing Authorization
- GoDAM <= 1.12.2 - Unauthenticated Arbitrary File Upload via WPForms File Upload Field
- Gpx2Graphics <= 0.3 - Cross-Site Request Forgery to Arbitrary File Upload
- Slider Hero with Animation, Video Background & Intro Maker <= 8.2.6 - SQL Injection
- Happy Addons for Elementor <= 2.23.0 & Pro Version < 1.17.0 - Stored Cross-Site Scripting
- GarageSale < 1.2.3 - Cross-Site Scripting
- Ajax Comment Form CST <= 1.2 - Cross-Site Request Forgery to Stored Cross-Site Scripting
- X Addons for Elementor <= 1.0.23 - Authenticated (Contributor+) Stored Cross-Site Scripting
- Migration Backup Restore <= 3.4.3 - Authenticated (Administrator+) Server-Side Request Forgery
- Radio Station <= 2.5.12 - Cross-Site Request Forgery
- Forget About Shortcode Buttons <= 2.1.2 - Missing Authorization via fasc_buttons
- ND Booking <= 2.4 - Unauthenticated Arbitrary Options Update
- Integration for Pipedrive and Contact Form 7, WPForms, Elementor, Ninja Forms <= 1.2.0 - Cross-Site Request Forgery
- Counter Box <= 1.2 - Cross-Site Request Forgery
- Internal Links Manager <= 2.1.0 - Multiple Stored Cross-Site Scripting
- ACF Photo Gallery Field <= 1.7.4 - Reflected Cross-Site Scripting
- WP Spell Check <= 9.21 - Cross-Site Request Forgery
- WordPress Core < 4.6 - Authorization Bypass
- WoodMart <= 8.2.3 - Authenticated (Contributor+) Local File Inclusion
- SearchIQ – The Search Solution <= 3.8 - Unauthenticated Stored Cross-Site Scripting
- Curtain < 1.0.2 - Unauthenticated Maintenance Mode Enabled/Disable
- Asia Garden <= 1.3.1 - Unauthenticated Local File Inclusion
- Ultimate Addons for WPBakery Page Builder <= 3.21.4 - Authenticated (Contributor+) Stored Cross-Site Scripting
- WP Athletics <= 1.1.7 - Stored Cross-Site Scripting
- Premium Packages - Sell Digital Products Securely <= 5.7.4 - Arbitrary User Meta Update to Authenticated (Subscriber+) Privilege Escalation
- WP Mail Log <= 1.1.2 - Authenticated (Contributor+) SQL Injection via id
- Advanced Access Manager <= 6.9.20 - Reflected Cross-Site Scripting
- NEX-Forms – Ultimate Forms Plugin for WordPress <= 9.1.9 - Missing Authorization to Authenticated (Subscriber+) License Deactivation via deactivate_license
- Ambient <= 1.7 - Unauthenticated Local File Inclusion
- Podlove Podcast Publisher <= 4.1.0 - Missing Authorization
- Meta Field Block <= 1.5.2 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'tagName' Block Attribute
- Droit Elementor Addons <= 3.1.5 - Cross-Site Request Forgery
- OMFG Mobile Pro <= 1.1.26 - Cross-Site Scripting
- Registration Forms – User Registration Forms, Invitation-Based Registrations, Front-end User Profile, Login Form & Content Restriction Social Sites Login <= 1.7.9 - Authentication Bypass via WordPress.com OAuth provider
- Simple Fields <= 1.4.11 - Cross-Site Scripting
- VidMov <= 1.9.4 - Unauthenticated Local File Inclusion
- 10Web Map Builder for Google Maps <= 1.0.72 - Unauthenticated SQL Injection
- Yoast SEO <= 2.0.1 - Reflected Cross-Site Scripting
- VForm <= 3.1.14 - Authenticated (Administrator+) Stored Cross-Site Scripting
- Diamond <= 2.4.8 - Reflected Cross-Site Scripting
- Beacon Lead Magnets and Lead Capture <= 1.5.8 - Cross-Site Request Forgery
- Embed videos and respect privacy <= 1.2 - Reflected Cross-Site Scripting
- ProfileGrid <= 5.9.9.6 - Unauthenticated Payment Bypass