Vulnerability archive: section 16, page 13
Open a report to review affected versions, available fixes and original sources. Each report covers a specific issue; its presence does not establish whether your website is affected.
- Text Slider Widget <= 1.0 - Authenticated (Subscriber+) Stored Cross-Site Scripting
- Transposh WordPress Translation <= 1.0.9.6 - Sensitive Information Disclosure
- Gravityforms <= 1.9.15.11 - Cross-Site Scripting
- WPLMS <= 4.970 - Missing Authorization
- WP Hotel Booking <= 2.1.2 - Authenticated (Subscriber+) Arbitrary File Upload
- ACPT (Premium) <= 2.0.63 - Authenticated (Subscriber+) SQL Injection
- Recipe Card Blocks by WPZOOM <= 2.8.2 - Authenticated Stored Cross-Site Scripting
- Site Reviews <= 6.11.8 - IP Address Spoofing to Blocking Bypass
- Bang tinh vay <= 1.0.1 - Authenticated (Administrator+) Stored Cross-Site Scripting
- Mingle Forum <= 1.0.33.3 - SQL Injection
- WP All Import <= 3.6.7 - Authenticated (Administrator+) Arbitrary Code Execution
- Post Saint: ChatGPT, GPT4, DALL-E, Stable Diffusion, Pexels, Dezgo AI Text & Image Generator <= 1.3.1 - Missing Authorization to Authenticated (Subscriber+) Arbitrary File Upload
- Bulk Posts Editing For WordPress <= 4.2.3 - Cross-Site Request Forgery
- WC Vendors – WooCommerce Multivendor, WooCommerce Marketplace, Product Vendors <= 2.7.2.1 - Authenticated (Administrator+) SQL Injection
- WP Go Maps (formerly WP Google Maps) <= 9.0.46 - Cross-Site Request Forgery to Plugin Settings Update
- New Simple Gallery <= 8.0 - Authenticated (Contributor+) SQL Injection
- Ovatheme Events Manager <= 1.8.6 - Missing Authorization
- Moova for WooCommerce <= 3.5 - Reflected Cross-Site Scripting
- Easy Embed for HubSpot Forms, CTAs, Links, Files & add HubSpot to WP Search Results <= 1.1.0 - Missing Authorization to Arbitrary Options Update
- Weedles <= 1.1.12 - Unauthenticated Local File Inclusion
- SMS Alert Order Notifications – WooCommerce <= 3.7.8 - Unauthenticated SQL Injection
- Legal Pages <= 1.3.8 - Cross-Site Request Forgery via moveToTrash and fetch_and_insert_template_data
- WP Dispensary <= 4.5.0 - Authenticated (Contributor+) Stored Cross-Site Scripting
- LifterLMS <= 8.0.0 - Reflected Cross-Site Scripting
- Store Toolkit for WooCommerce <= 1.5.6 - Missing Authorization
- Royal MCP <= 1.4.25 - Missing Authorization to Unauthenticated MCP Tool Use
- Dashboard Widgets Suite <= 3.4.1 - Authenticated (Administrator+) Stored Cross-Site Scripting
- Advanced Sermons <= 3.3 - Authenticated (Contributor+) Stored Cross-Site Scripting
- RapidLoad Power-Up for Autoptimize <= 1.7.1 - Cross-Site Request Forgery via 'queue_posts'
- CP Image Store with Slideshow <= 1.0.67 - Unauthenticated SQL Injection
- Plum: Spin Wheel & Email Pop-up <= 2.0 - Missing Authorization
- Active Directory Integration / LDAP Integration <= 4.1.4 - Cross-Site Request Forgery to SQL Injection
- Cartify <= 1.3.0.1 - Missing Authorization
- Embed Images in Comments < 0.6 - Cross-Site Scripting
- Bit integrations <= 2.8.7 - Unauthenticated Server-Side Request Forgery via Form Field Upload Mapping
- User IP and Location <= 2.2 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode
- WP Extra Fields <= 1.0.1 - Reflected Cross-Site Scripting
- Comparison Slider <= 1.0.5 - Cross-Site Request Forgery
- loader-utils (JS package) < 3.2.1 - Regular Expression Denial of Service
- WP-DownloadManager Plugin < 1.61 - Cross-Site Scripting
- Eventin <= 4.1.23 - Missing Authorization
- ONLYOFFICE Docs 1.1.0 - 2.2.0 - Missing Authorization to Unauthenticated Privilege Escalation via callback Function
- Booster for WooCommerce <= 7.2.5 - Reflected Cross-Site Scripting
- Bonus for Woo <= 5.8.2 - Reflected Cross-Site Scripting
- Chamber Dashboard Business Directory <= 3.3.8 - Authenticated (Contributor+) Stored Cross-Site Scripting
- Widget Logic Visual <= 1.52 - Authenticated (Subscriber+) Remote Code Execution via 'nwlv[cod-tag]' Parameter
- Spectra – WordPress Gutenberg Blocks <= 2.3.1 - Missing Authorization to Captcha Setting Update
- WP Product Review Lite <= 3.7.5 - Unauthenticated Stored Cross Site Scripting
- Dokan Pro <= 5.0.4 - Unauthenticated SQL Injection via 'latitude' and 'longitude' Parameters
- Paytm Payment Gateway <= 2.7.3 - Authenticated (Editor+) SQL Injection via 'post'
- Event Booking Manager for WooCommerce <= 5.5.0 - Missing Authorization
- Gallery Styles <= 1.3.4 - Authenticated (Contributor+) Stored Cross-Site Scripting
- FormFacade <= 1.0.0 - Authenticated (Contributor+) Stored Cross-Site Scripting via shortcode
- Tutor LMS <= 1.9.1 - Authenticated Stored Cross-Site Scripting
- Visualizer – Tables & Charts Manager with Built-in AI Generator 4.0.0 - 4.0.5 - Authenticated (Contributor+) Insecure Direct Object Reference
- Smash Balloon Social Photo Feed <= 1.11.3 - Cross-Site Request Forgery to Back-Up Deletion
- Menu Duplicator <= 1.0 - Missing Authorization
- wpForo Forum <= 3.1.5 - Authenticated (Subscriber+) Stored Cross-Site Scripting
- StoreGrowth: Smart Sales Booster for WooCommerce | BOGO, Upsells, Direct Checkout, Quick View, Side Cart <= 2.1.0 - Missing Authorization to Unauthenticated Options Update via create_popup AJAX Action
- WooCommerce Coming Soon Product with Countdown <= 5.0 - Authenticated (Subscriber+) Local File Inclusion
- WP Job Openings <= 3.4.1 - Missing Authorization
- AM LottiePlayer <= 3.6.3 - Authenticated (Author+) Stored Cross-Site Scripting via SVG
- ZoloBlocks <= 2.3.2 - Authenticated (Subscriber+) Local File Inclusion
- GD bbPress Attachments <= 4.7.2 - Reflected Cross-Site Scripting
- Ad Injection <= 1.2.0.19 - Authenticated (Admin+) Stored Cross-Site Scripting
- Booking Calendar <= 10.9.2 - Authenticated (Contributor+) DOM-Based Stored Cross-Site Scripting via 'booking' Shortcode
- WordPress Core < 4.7.1 - Cross-Site Request Forgery via Uploading Flash File
- Responsive Thumbnail Slider < 1.1.53 - Reflected Cross-Site Scripting via 'id' Parameter
- Weaver Xtreme <= 6.3.0 - Authenticated (Contributor+) Stored Cross-Site Scripting
- WPBot <= 8.4.9 - Unauthenticated Stored Cross-Site Scripting via 'conversation' Parameter
- Icegram Engage <= 3.1.31 - Authenticated (Administrator+) Stored Cross-Site Scripting
- PDF for WPForms <= 6.5.0 - Authenticated (Subscriber+) PHP Object Injection
- gSlideShow <= 0.1 - Cross-Site Request Forgery
- Shortcodes and extra features for Phlox theme <= 2.17.2 - Authenticated (Contributor+) Stored Cross-Site Scripting via Staff Widget
- uListing <= 2.1.9 - Authenticated (Administrator+) SQL Injection
- WP Ticket Ultra Help Desk & Support Plugin <= 1.0.5 - Unauthenticated Local File Inclusion
- Spectra <= 2.19.17 - Missing Authorization
- Cardealer <= 1.6.4 - Arbitrary Theme Option Update to Authenticated (Subscriber+) Privilege Escalation
- WooCommerce Registration Fields Plugin - Custom Signup Fields <= 3.2.3 - Authenticated (Subscriber+) Privilege Escalation
- Clerk <= 3.8.2 - Authorization Bypass via Insufficient Validation
- Author Bio Shortcode <= 2.5.3 - Authenticated (Contributor+) Stored Cross-Site Scripting
- Cozy Blocks <= 2.1.29 - Unauthenticated Arbitrary Shortcode Execution
- WordPress Core < 4.6 - Cross-Site Request Forgery
- eMember <= 10.2.2 - Missing Authorization
- Magical Products Display <= 1.1.29 - Authenticated (Contributor+) Stored Cross-Site Scripting via MPD Pricing Table Widget
- Music Player for WooCommerce <= 1.5.1 - Missing Authorization
- Appointment Booking Calendar <= 1.4.02 - Missing Authorization to Authenticated (Contributor+) Sensitive Information Disclosure
- Most And Least Read Posts Widget <= 2.5.18 - Cross-Site Request Forgery via most_and_least_read_posts_options
- Advanced Access Manager <= 5.9.8.1 - Unauthenticated Arbitrary File Read
- WP Joomag <= 2.5.2 - Authenticated (Contributor+) Stored Cross-Site Scripting
- WordPress Core < 5.4.1 - Authenticated (Author+) Cross-Site Scripting via File Uploads
- Image Slider <= 1.1.119 - Subscriber+ SQL Injection
- Piotnet Forms <= 1.0.25 - Missing Authorization via multiple AJAX actions
- Addi – Cuotas que se adaptan a ti <= 2.0.4 - Missing Authorization
- WordPress Core < 2.8.3 - Authorization Bypass
- PPWP – Password Protect Pages <= 1.9.15 - Missing Authorization
- WP Editor <= 1.2.7 - Sensitive Information Exposure via log file
- WP Youtube Video Gallery <= 1.0 - Cross-Site Request Forgery to Plugin Settings Update
- Packlink PRO shipping module <= 3.4.6 - Missing Authorization
- Orbit Fox <= 3.0.8 - Authenticated (Contributor+) Stored Cross-Site Scripting