Vulnerability archive: section 15, page 9
Open a report to review affected versions, available fixes and original sources. Each report covers a specific issue; its presence does not establish whether your website is affected.
- RTMKit <= 2.1.5 - Authenticated (Contributor+) PHP Object Injection
- POS Entegratör – Gurmehub Ödeme Eklentisi <= 3.7.103 - Missing Authorization
- MStore API – Create Native Android & iOS Apps On The Cloud <= 4.15.3 - Authenticated (Subscriber+) Limited Arbitrary File Upload
- Frontend Admin by DynamiApps <= 3.19.4 - Improper Missing Encryption Exception Handling to Form Manipulation
- Direct Payments for WooCommerce – Bank Transfer, Mobile Money, Crypto and Peer-to-Peer (P2P) Payments < 2.5.3 - Missing Authorization
- Wechat Social login <= 1.3.0 - Unauthenticated Arbitrary File Upload
- User Profile Builder – Beautiful User Registration Forms, User Profiles & User Role Editor <= 3.12.9 - Unauthenticated Stored Cross-Site Scripting
- WordPress Core < 4.0.1 - Cross-Site Scripting
- The Plus Addons for Elementor - Pro <= 5.0.6 - SQL Injection
- Frontend File Manager Plugin <= 23.6 - Authenticated (Subscriber+) Stored Cross-Site Scripting
- AppMySite <= 3.15.3 - Authenticated (Subscriber+) Stored Cross-Site Scripting via save_ams_license_key AJAX Handler
- Macro Calculator with Admin Email Optin & Data <= 1.0 - Unauthenticated Information Disclosure
- WP Media File Type Manager <= 2.3.0 - Cross-Site Request Forgery to Settings Update
- Controlled Admin Access < 1.5.6 - Privilege Escalation
- Header Footer Script Adder <= 2.1 - Authenticated (Author+) Stored Cross-Site Scripting via 'asm_code' Snippet Meta
- PostLists <= 2.0.2 - Reflected Cross-Site Scripting
- Streamit <= 4.0.1 - Authenticated (Subscriber+) Arbitrary File Upload
- Himer <= 2.1.0 - Cross-Site Request Forgery to Group Leave
- iMember360 < 3.9.001 - Missing Authorization and Sensitive Data Exposure
- AI Content Creator <= 1.2.6 - Cross-Site Request Forgery
- Ai Image Alt Text Generator for WP <= 1.1.5 - Authenticated (Subscriber+) Sensitive Information Exposure
- Credit Tracker <= 1.1.17 - Authenticated (Contributor+) Stored Cross-Site Scripting
- Simple 301 Redirects by BetterLinks <= 2.0.7 - Missing Authorization via clicked
- Ultimate Addons for Beaver Builder <= 1.24.3 - Cross-Site Scripting
- Xpro Addons — 140+ Widgets for Elementor <= 1.4.20 - Authenticated (Contributor+) Stored Cross-Site Scripting
- Simple Social Media Share Buttons <= 5.1.0 - Unauthenticated Password Protected Post Disclosure
- Quick PayPal Payments: Payment Button & Form <= 6.0.3 - Missing Authorization
- Kadence Blocks <= 3.1.10 - Unauthenticated Arbitrary File Upload
- Restaurant and Cafe <= 1.2.5 - Missing Authorization
- Related Videos for JW Player <= 1.2.0 - Reflected Cross-Site Scripting
- Custom 404 Pro <= 3.8.0 - Unauthenticated SQL Injection via 's'
- WPC Name Your Price for WooCommerce <= 2.1.9 - Unauthenticated Price Alteration
- Post Grid <= 2.2.74 - Reflected Cross-Site Scripting
- TeraWallet – For WooCommerce <= 1.3.24 - Cross-Site Request Forgery via admin_options
- Image Optimizer, Resizer and CDN – Sirv <= 7.2.7 - Authenticated(Subscriber+) Missing Authorization to Plugin Settings Update
- RS-Members <= 1.0.3 - Authenticated (Subscriber+) Privilege Escalation
- Tainacan <= 0.21.14 - Unauthenticated Arbitrary File Deletion
- WordPress File Uploader <= 1.1 - Arbitrary File Upload
- HitPay Payment Gateway for WooCommerce <= 4.1.3 - Information Exposure via Log Files
- Vayu Blocks – Gutenberg Blocks for WordPress & WooCommerce 1.0.4 - 1.2.1 - Missing Authorization to Unauthenticated Limited Arbitrary Options Update
- Wise Analytics <= 1.1.9 - Missing Authorization to Unauthenticated Arbitrary Analytics Database Disclosure via 'name' Parameter
- pixelstats <= 0.8.2 - Reflected Cross-Site Scripting
- OTP Login Woocommerce & Gravity Forms <= 2.2 - Authentication Bypass to Privilege Escalation
- Landing pages and Domain aliases for WordPress <= 0.8 - Authenticated (Administrator+) Stored Cross-Site Scripting
- افزونه پرداخت امن زرینپال برای ووکامرس (ZarinPal for WooCommerce) <= 5.1.0 - Cross-Site Request Forgery
- User Submitted Posts <= 20241026 - Authenticated (Admin+) Stored Cross-Site Scripting
- Safe SVG <= 2.2.5 - Authenticated (Author+) Stored Cross-Site Scripting via SVG
- Chat Bubble <= 2.3 - Cross-Site Request Forgery via cbb_submit_settings_data
- WP FuneralPress <= 1.1.6 - Cross-Site Scripting
- Cardea <= 2.3 - Unauthenticated Local File Inclusion
- ColibriWP Theme framework <= (Various Versions) - Missing Authorization
- MStore API – Create Native Android & iOS Apps On The Cloud <= 4.17.5 - Missing Authorization to Authenticated (Subscriber+) Posts Creation
- WP Easy Pay – Payment and Donation Form Builder for Square <= 4.5.0 - Authenticated (Subscriber+) Arbitrary Content Deletion
- WP Twitter Auto Publish <= 1.7.4 - Reflected Cross-Site Scripting via PostMessage
- Search Cloud One <= 2.2.5 - Authenticated (Administrator+) Stored Cross-Site Scripting
- Make Paths Relative <= 1.3.0 - Cross-Site Request Forgery via 'admin/class-make-paths-relative-admin.php'
- Tour & Activity Operator Plugin for TourCMS <= 1.7.0 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode Attributes
- Shopping Cart & eCommerce Store <= 5.9.4 - Authenticated (Contributor+) SQL Injection
- Forms for Mailchimp by Optin Cat – Grow Your MailChimp List <= 2.5.7 - Reflected Cross-Site Scripting
- GeoPlaces <= 4 - Arbitrary File Upload
- True Ranker <= 2.2.9 - Cross-Site Request Forgery to Unauthorized True Ranker Disconnection
- AntiVirus < 1.1 - Full Path Disclosure
- MyBrain Utilities <= 1.0.8 - Authenticated (Contributor+) Stored Cross-Site Scripting
- Accessibility Press <= 1.0.2 - Authenticated (Administrator+) Stored Cross-Site Scripting
- MasterStudy LMS <= 3.6.20 - Authenticated (Instructor+) Sensitive Information Exposure
- Winters <= 1.4.3 - Prototype Pollution to Reflected Cross-Site Scripting
- ElementsKit Pro <= 3.7.8 - Authenticated (Contributor+) DOM-Based Stored Cross-Site Scripting via url Parameter
- YouTube Embed <= 2.6.3 - Authenticated (Admin+) Stored Cross-Site Scripting
- Flatsome <= 3.18.7 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode
- Logo Carousel < 1.7.2 - Stored Cross-Site Scripting
- EventON - Subscriber <= 1.4.5 - Unauthenticated SQL Injection via 'email' Parameter
- Advanced Custom Fields: Font Awesome Field <= 5.0.2 - Authenticated (Subscriber+) Stored Cross-Site Scripting via JSON Field
- Site Reviews <= 6.5.1 - Missing Authorization
- LTL Freight Quotes – Estes Edition <= 3.3.7 - Unauthenticated SQL Injection
- 404 to 301 <= 3.0.7 - Missing Authorization to Redirect Creation
- WP Page Builder <= 1.2.3 - Insecure Default to Unauthorized Page Editing
- Secure Copy Content Protection and Content Locking <= 4.9.2 - Cross-Site Request Forgery to Data Export
- Icegram Engage <= 3.1.42 - Authenticated (Contributor+) Second-Order SQL Injection via 'messages[][id]' Parameter
- Points and Rewards for WooCommerce <= 2.10.1 - Missing Authorization to Authenticated (Subscriber+) Arbitrary Modification via Multiple AJAX Actions
- WordPress Core <= 7.0.2 - Unauthenticated Sensitive Information Exposure via Comment Feeds
- Broken Link Checker < 2.4.12 - Unauthenticated Remote Code Execution
- Spam protection, AntiSpam, FireWall by CleanTalk < 5.22 - Reflected Cross-Site Scripting
- Simple Share Buttons Adder <= 8.4.11 - Authenticated(Administrator+) Stored Cross-Site Scripting via CSS Settings
- PSW Front-end Login & Registration <= 1.12 - Authentication Bypass
- Category Specific RSS feed Subscription <= 2.1 - Cross-Site Request Forgery
- WPMobile.App <= 11.77 - Missing Authorization
- Wp cycle text announcement <= 8.1 - Authenticated (Contributor+) SQL Injection
- Ultimate Member <= 2.10.0 - Unauthenticated SQL Injection via search Parameter
- Dynamic URL SEO <= 1.0 - Cross-Site Request Forgery
- Userpro <= 5.1.9 - Missing Authorization
- Extra Product Options Builder for WooCommerce <= 1.2.167 - Missing Authorization
- UpSolution Core <= 8.44 - Unauthenticated Stored Cross-Site Scripting
- ColorFolio - Freelance Designer WordPress <= 1.3 - Authenticated (Subscriber+) PHP Object Injection
- WP Activity Log <= 4.6.1 - Unauthenticated Stored Cross-Site Scripting
- IFrame Admin Pages <= 0.1 - Reflected Cross-Site Scripting
- WishList Member X < 3.26.7 - Missing Authorization to Information Disclosure
- WP Widget Changer <= 1.2.5 - Reflected Cross-Site Scripting via $_SERVER['PHP_SELF']
- AtomChat <= 1.1.7 - Missing Authorization
- User Login History <= 1.7.0 - SQL Injection via Order By
- FundEngine – Donation and Crowdfunding Platform <= 1.7.9 - Unauthenticated PHP Object Injection