Vulnerability archive: section 16, page 12
Open a report to review affected versions, available fixes and original sources. Each report covers a specific issue; its presence does not establish whether your website is affected.
- Betheme <= 27.1.1 - Missing Authorization
- HTML5 Lyrics Karaoke Player <= 2.4 - Reflected Cross-Site Scripting
- Message ticker <= 9.2 - Authenticated (Subscriber+) SQL Injection via Shortcode
- Woody code snippets <= 2.4.5 - Reflected Cross-Site Scripting
- Royal Elementor Addons <= 1.7.1001 - Missing Authorization
- Premium Packages <= 6.2.0 - Unauthenticated SQL Injection
- EU DSGVO Helper <= 1.0.6.1 - Reflected Cross-Site Scripting
- Motors - Car Dealer, Rental & Listing WordPress theme <= 5.6.65 - Unauthenticated Arbitrary Shortcode Execution
- Amministrazione Aperta <= 3.7.3 - Admin+ Local File Inclusion
- Advanced WooCommerce Product Sales Reporting <= 4.1.1 - Unauthenticated SQL Injection
- Kirki <= 6.1.1 - Missing Authorization to Authenticated (Subscriber+) Sensitive Information Disclosure via 'context' Parameter
- Raider Spirit <= 1.1.4 - Unauthenticated Local File Inclusion
- Whizz Plugins <= 1.9 - Reflected Cross-Site Scripting
- Popular Posts by Webline <= 1.1.1 - Authenticated (Contributor+) Stored Cross-Site Scripting
- Alojapro Widget <= 1.1.15 - Authenticated (Admin+) Stored Cross-Site Scripting
- Bold Page Builder <= 5.6.9 - Authenticated (Contributor+) Stored Cross-Site Scripting
- EventPrime – Events Calendar, Bookings and Tickets <= 4.3.2.0 - Missing Authorization
- Ultimate Membership Pro <= 8.6 - Cross-Site Request Forgery
- Count per Day < 3.2.6 - Reflected Cross-Site Scripting
- Dropbox Folder Share <= 1.9.7 - Unauthenticated Server-Side Request Forgery via 'link'
- Watu Quiz <= 3.4.5 - Missing Authorization
- Easy Form Builder 4.0.0 - 4.1.3 - Unauthenticated Stored Cross-Site Scripting
- WPO365 | SEAMLESS WORDPRESS + MICROSOFT INTEGRATION (WPO365 | LOGIN) <= 44.1 - Unauthenticated Stored Cross-Site Scripting via 'id_token' Parameter (iss / unique_name JWT claims)
- Pay with Contact Form 7 <= 1.0.4 - Unauthenticated Information Exposure
- Namaste! LMS <= 2.5.9.1 - Authenticated (Admin+) Stored Cross-Site Scripting
- Live Chat from ClickDesk – Live Chat – Help Desk Plugin for Websites <= 2.0 - Cross-Site Scripting
- The Moneytizer <= 9.6.3 - Cross-Site Request Forgery via multiple AJAX actions
- JetElements For Elementor <= 2.7.7 - Authenticated (Subscriber+) Information Disclosure
- AR for WooCommerce <= 8.40 - Unauthenticated Path Traversal to Arbitrary File Read via 'file' Parameter
- Events Manager <= 5.3.6 - Multiple Cross-Site Scripting
- Smart Sections Theme Builder - WPBakery Page Builder Addon <= 1.7.8 - Unauthenticated PHP Object Injection
- Client Portal – Private user pages and login <= 1.1.8 - Cross-Site Request Forgery via cp_create_private_pages_for_all_users function
- miniOrange's Google Authenticator <= 5.4.39 - Cross-Site Scripting
- MTCaptcha WordPress Plugin <= 2.7.2 - Cross-Site Request Forgery to Settings Update
- Recip.ly Plugin <= 1.1.8 - Reflected Cross-Site Scripting
- NextGen Gallery <= 2.1.7 - Path Traversal
- Real Estate 7 WordPress <= 3.5.1 - Unauthenticated Privilege Escalation to Administrator
- WooCommerce AWeber Newsletter Subscription <= 4.0.2 - Missing Authorization to Access Token Modification
- Jobify - Job Board WordPress Theme < 4.3.0 - Cross-Site Request Forgery
- TranslatePress <= 3.2.5 - Reflected Cross-Site Scripting
- Visualizer <= 3.10.5 - Reflected Cross-Site Scripting
- Global Translator <= 2.0.2 - Authenticated (Administrator+) Stored Cross-Site Scripting
- User Login History <= 1.7.0 - SQL Injection via OrderBy
- Driving Directions <= 1.4.4 - Reflected Cross-Site Scripting
- Classified Listing <= 6.1.0 - Authenticated (Subscriber+) Insecure Direct Object Reference
- Magnific Popup <= 1.0 - Authenticated (Author+) Stored Cross-Site Scripting
- SureForms <= 2.2.1 - Missing Authorization
- Easy2Map Photos <= 1.0.9 - SQL Injection
- Event Organiser <= 3.12.9 - Authenticated (Contributor+) Stored Cross-Site Scripting via eo_events Shortcode
- ID-SK Toolkit <= 1.7.2 - Authenticated (Author+) Stored Cross-Site Scripting via SVG File Upload
- Appy Pie Connect for WooCommerce <= 1.1.2 - Missing Authorization to Unauthenticated Privilege Escalation via reset_user_password
- The Ultimate WordPress Toolkit – WP Extended <= 3.0.11 - Missing Authorization to Authenticated (Subscriber+) Remote Code Execution
- Admin Log <= 1.50 - Cross-Site Request Forgery
- WP Project Manager <= 2.6.17 - Missing Authorization to Authenticated (Subscriber+) Limited Arbitrary Options Update
- Simple Login Registration <= 1.0.2 - Cross-Site Scripting
- Feedweb < 1.9 - Authenticated (Admin+) Stored Cross-Site Scripting
- Century ToolKit <= 1.2.1 - Cross-Site Request Forgery to Arbitrary Plugin Activation
- Simple Membership <= 4.8.1 - Unauthenticated Authentication Bypass to Administrator Account Takeover via Multisite Identity Binding
- WP Booking System Free version < 1.5.2 - Cross-Site Request Forgery
- MStore API <= 4.0.6 - Authenticated (Subscriber+) SQL Injection
- Passwords Manager <= 1.4.8 - Authenticated (Subscriber+) SQL Injection
- WordPress 淘宝客插件 <= 1.1.2 - Reflected Cross-Site Scripting
- WPMobile.App — Android and iOS Mobile Application <= 11.52 - Unauthenticated Arbitrary Shortcode Execution
- GD Security Headers <= 1.7 - Authenticated (Admin+) SQL Injection
- MapFig Studio <= 0.2.1 - Cross-Site Request Forgery to Stored Cross-Site Scripting
- Better Random Redirect <= 1.3.20 - Authenticated (Administrator+) Stored Cross-Site Scripting
- WP System Information <= 1.5 - Authenticated (Subscriber+) Sensitive Information Exposure
- JetBlocks For Elementor <= 1.3.16 - Missing Authorization
- Advanced Booking Calendar <= 1.7.1 - Unauthenticated SQL Injection
- Revamp CRM for WooCommerce <= 1.1.2 - Reflected Cross-Site Scripting
- Advanced Ads <= 1.17.3 - Reflected Cross-Site Scripting
- Photoswipe Masonry Gallery <= 1.2.14 Stored Cross-Site Scripting
- Royal Elementor Addons <= 1.7.1056 - Missing Authorization
- DD Roles <= 4.1 - Authenticated (Subscriber+) Privilege Escalation
- Vixus - Business Startup Elementor Template Kit <= 1.0.16 - Unauthenticated Local File Inclusion
- User Registration <= 2.3.2.1 - PHP Object Injection
- SyncFields < 4.1 - Reflected Cross-Site Scripting
- Advanced WooCommerce Product Sales Reporting <= 4.1.2 - Unauthenticated Information Exposure
- LA-Studio Element Kit for Elementor <= 1.6.2 - Authenticated (Contributor+) Server-Side Request Forgery
- Frontend File Manager & Sharing – User Private Files <= 1.1.0 - Sensitive Information Disclosure
- AN_GradeBook <= 5.0.1 - Authenticated (Subscriber+) SQL Injection via 'id'
- OAuth Single Sign On – SSO (OAuth Client) <= 7.1.2 - Unauthenticated Authentication Bypass
- Drag and Drop Multiple File Upload for Contact Form 7 <= 1.3.9.7 - Unauthenticated Stored Cross-Site Scripting
- WP Statistics <= 12.6.3 - Referer Cross-Site Scripting
- Gateway for Pasargad Bank <= 2.5.2 - Reflected Cross-Site Scripting
- Photo Gallery by 10Web <= 1.8.28 - Authenticated (Administrator+) Stored Cross-Site Scripting
- Ozisti <= 1.1.10 - Unauthenticated Local File Inclusion
- Squelch Tabs and Accordions Shortcodes <= 0.4.7 - Cross-Site Request Forgery
- Angel – Fashion Model Agency WordPress CMS Theme <= 3.2.3 - Authenticated (Subscriber+) Stored Cross-Site Scripting
- PDPA Consent for Thailand <= 1.1.1 - Authenticated (Administrator+) Stored Cross-Site Scripting
- WPshop 2 – E-Commerce < 1.3.9.6 - Arbitrary File Upload
- Anti-Malware Security and Brute-Force Firewall <= 4.23.87 - Authenticated (Contributor+) PHP Object Injection
- ProfileGrid – User Profiles, Groups and Communities <= 6.0.0.2 - Authenticated (Subscriber+) SQL Injection
- Daily Prayer Time <= 2023.10.13 - Authenticated (Contributor+) Stored Cross-Site Scripting via shortcode
- Edit Comments <= 0.3 - Unauthenticated SQL Injection
- WP Last Modified Info <= 1.6.5 - Stored Cross-Site Scripting
- Stumble! for WordPress <= 1.1.1 - Reflected Cross-Site Scripting via $_SERVER['PHP_SELF']
- Strong Testimonials <= 3.1.11 - Authenticated (Contributor+) Stored Cross-Site Scripting
- Wp-FileManager <= 1.2 - Arbitrary File Upload
- Category and Taxonomy Meta Fields <= 1.0.0 - Authenticated (Administrator+) Stored Cross-Site Scripting