Vulnerability archive: section 16, page 20
Open a report to review affected versions, available fixes and original sources. Each report covers a specific issue; its presence does not establish whether your website is affected.
- Admin and Site Enhancements (ASE) <= 7.6.2 - Missing Authorization
- Slider Revolution <= 6.7.7 - Authenticated (Author+) Stored Cross-Site Scripting via htmltag Parameter
- My auctions allegro <= 3.6.32 - Unauthenticated Stored Cross-Site Scripting
- Kirki – Freeform Page Builder, Website Builder & Customizer <= 6.3.1 - Authenticated (Subscriber+) Arbitrary Shortcode Execution via 'display_name'
- Newscrunch <= 1.8.4 - Cross-Site Request Forgery to Arbitrary File Upload
- Idyllic <= 1.1.8 - Authenticated (Contributor+) Stored Cross-Site Scripting
- ThemeREX Addons < 2.45.0 - Authenticated (Subscriber+) Stored Cross-Site Scripting
- Giveaways and Contests by RafflePress <= 1.12.16 - Authenticated (Admin+) Stored Cross-Site Scripting
- WordPress Infinite Scroll – Ajax Load More <= 5.5.3 - Authenticated (Admin+) Arbitrary File Read
- Themedy Toolbox <= 1.0.15 - Authenticated (Contributor+) Stored Cross-Site Scripting via Multiple Shortcodes
- Cart Lift – Abandoned Cart Recovery for WooCommerce and EDD <= 3.1.57 - Unauthenticated Stored Cross-Site Scripting
- Advanced Product Information for WooCommerce <= 1.1.4 - Authenticated (Contributor+) Stored Cross-Site Scripting
- WP Githuber MD <= 1.16.2 - Authenticated (Author+) Arbitrary File Upload
- Marveland <= 1.3.0 - Unauthenticated Local File Inclusion
- Simple Contact Forms <= 1.6.4 - Unauthenticated Local File Inclusion
- Notification for Telegram <= 3.5.1 - Missing Authorization
- Auto-hyperlink URLs <= 5.4.1 - Tab Nabbing
- ARForms <= 6.4.1 - Missing Authorization to Plugin Settings Change
- ELEX WordPress HelpDesk & Customer Ticketing System <= 3.3.0 - Missing Authorization to Authenitcated (Subscriber+) to Scheduled Trigger Deletion
- Ultimate Member <= 2.8.3 - Unauthenticated Stored Cross-Site Scripting
- RokIntroScroller <= 1.8 - Full Path Disclosure
- TuriTop Booking System <= 1.0.11 - Authenticated (Subscriber+) PHP Object Injection
- Login by Auth0 <= 3.11.3 - CSV Injection
- Widget Context <= 1.3.3 - Cross-Site Request Forgery to Settings Update via 'wl' Parameter
- Fancier Author Box by ThematoSoup <= 1.4 - Authenticated (Admin+) Stored Cross-Site Scripting
- Quiz and Survey Master (QSM) <= 11.2.0 - Authenticated (Custom+) SQL Injection via 'pages' Parameter
- PDF Generator Addon for Elementor Page Builder <= 1.7.4 - Authenticated (Contributor+) Stored Cross-Site Scripting
- Ninja Forms <= 2.9.10 - Reflected Cross-Site Scripting
- Piotnet Addons For Elementor <= 2.4.36 - Authenticated (Contributor+) Stored Cross-Site Scripting
- Stylish Price List <= 6.9.0 - Missing Authorization
- Printful Integration for WooCommerce <= 2.2.2 - Cross-Site Request Forgery
- Sliper for Elementor <= 1.0.10 - Missing Authorization
- Profile Builder <= 3.9.7 - Missing Authorization to Initial Page Creation
- Simple Custom CSS and JS <= 3.3 - Cross-Site Scripting
- WPJobBoard <= 4.5.1 - Cross-Site Scripting
- Real Estate 7 Theme <= 3.3.4 - Unauthenticated Arbitrary Email Sending
- TablePress <= 3.2 - Authenticated (Contributor+) Stored Cross-Site Scripting via shortcode_debug Parameter
- Login Widget for Ultimate Member <= 1.1.2 - Authenticated (Contributor+) Local File Inclusion
- Link Library <= 7.2.7 - Missing Authorization Checks
- User Frontend: AI Powered Frontend Posting, User Directory, Profile, Membership & User Registration <= 4.3.1 - Unauthenticated Insecure Direct Object Reference to Arbitrary User Subscription Overwrite
- Favorites <= 2.3.4 - Authenticated (Admin+) Stored Cross-Site Scripting
- Appointment Booking Plugin & Scheduling System – Webba Booking Calendar <= 6.5.0 - Authenticated (Subscriber+) Insecure Direct Object Reference
- GoDAM <= 1.4.6 - Missing Authorization
- Academist Membership <= 1.1.6 - Authentication Bypass via Account Takeover
- Hostel <= 1.1.5.1 - Authenticated (Administrator+) Stored Cross-Site Scripting
- BuddyBoss Media <= 3.2.3 - Stored Cross-Site Scripting
- Notification for Telegram <= 3.5.2 - Unauthenticated Stored Cross-Site Scripting
- Liquido <= 1.0.1.2 - Authenticated (Contributor+) Stored Cross-Site Scripting
- Rentic <= 1.1 - Unauthenticated Local File Inclusion
- WordPress Action Network 1.4.3 -Authentcated (Admin+) SQL Injection
- Twitget <= 3.3.2 - Stored Cross-Site Scripting
- Custom Metas <= 1.5.1 - Reflected Cross-Site Scripting
- Forminator Plugin <= 1.5.4 - Cross-Site Scripting
- Form Builder <= 1.9.9.0 - Unauthenticated CSV Injection
- WP File Download <= 6.3.6 - Unauthenticated Stored Cross-Site Scripting
- Catch Dark Mode <= 2.0 - Authenticated (Contributor+) Local File Inclusion
- Responsive Tabs For WPBakery Page Builder <= 1.1 - Authenticated(Contributor+) Stored Cross-Site Scripting via shortcode
- Search & Filter Pro <= 2.5.17 - Authenticated (Admin+) Stored Cross-Site Scripting
- BuddyForms <= 2.9.0 - Missing Authorization
- WP Post Author <= 3.6.7 - Authenticated (Contributor+) Stored Cross-Site Scripting
- Ali2Woo Lite <= 3.4.6 - Cross-Site Request Forgery to Stored Cross-Site Scripting
- Ultimate Member <= 2.0.6 - Multiple Cross-Site Request Forgery Issues
- VikRentCar Car Rental Management System <= 1.3.1 - Cross-Site Request Forgery
- Classiera <= 4.0.34 - Unauthenticated SQL Injection
- Easy Appointments < 3.12.28 - Authenticated (Subscriber+) Information Exposure
- WordPress Core <= 3.5.1 - Denial of Service via wp-postpass cookie
- Royal Elementor Addons and Templates <= 1.3.87 - Cross-Site Request Forgery via add_to_wishlist
- MDTF – Meta Data and Taxonomies Filter <= 1.3.8 - Unauthenticated Local File Inclusion
- JetEngine <= 3.8.10.2 - Unauthenticated SQL Injection
- Videojs HTML5 Player <= 1.1.8 - Authenticated (Contributor+) Stored Cross-Site Scripting
- WP Custom Post Popup <= 1.0.1 - Authenticated (Contributor+) Stored Cross-Site Scripting
- Verge3D <= 4.8.0 - Reflected Cross-Site Scripting
- Gutenberg Blocks with AI by Kadence WP <= 3.6.1 - Missing Authorization to Authenticated (Contributor+) Unauthorized Media Upload
- Biolife <= 3.2.3 - Missing Authorization
- WebberZone Top 10 <= 4.5.2 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'other_attributes' Block Attribute
- Unique UX <= 0.9.2 - Reflected Cross-Site Scripting
- WP Document Revisions <= 3.8.1 - Missing Authorization
- WP Query Creator <= 1.0 - Reflected Cross-Site Scripting
- Cookie Scanner <= 1.1 - Cross-Site Request Forgery to Stored Cross-Site Scripting
- Action Network <= 1.4.2 - Reflected Cross-Site Scripting via 'search'
- LatePoint <= 5.6.2 - Cross-Site Request Forgery
- WP Featured Entries <= 1.0 - Authenticated (Contributor+) SQL Injection
- LearnPress <= 4.2.6.8.2 - Cross-Site Request Forgery
- Email Users <= 4.8.8 - Arbitrary Settings Update via Cross-Site Request Forgery
- PublishPress Revisions: Duplicate Posts, Submit, Approve and Schedule Content Changes <= 3.7.23 - Unauthenticated SQL Injection
- Payment Plugins for Stripe WooCommerce <= 4.0.11 - Unauthenticated Information Exposure
- Materialis Companion <= 1.3.41 - Authenticated (Contributor+) Store Cross-Site Scripting via materialis_contact_form Shortcode
- WordPress Meta Data and Taxonomies Filter (MDTF) <= 1.3.3 - Missing Authorization
- AI Magic <= 1.0.4 - Unauthenticated Privilege Escalation
- AB Press Optimizer <= 1.1.1 - Authenticated (Administrator+) Stored Cross-Site Scripting
- Course Booking System <= 6.1.5 - Missing Authorization to Unauthenticated Booking Data Export
- Helpdesk Support Ticket System for WooCommerce <= 2.1.0 - Unauthenticated Arbitrary File Upload
- Enable Media Replace <= 4.1.5 - Reflected Cross-Site Scripting
- SysBasics Customize My Account for WooCommerce – Live My Account Customizer <= 4.3.9 - Reflected Cross-Site Scripting
- Awesome Support <= 6.1.6 - Insufficient Authorization via wpas_can_delete_attachments()
- Flatsome | Multi-Purpose Responsive WooCommerce Theme <= 3.18.7 - Authenticated (Contributor+) Stored Cross-Site Scripting via Multiple Shortcodes
- WooCommerce PDF Invoices & Packing Slips <= 2.15.0 - Reflected Cross-Site Scripting
- Premium Blocks – Gutenberg Blocks for WordPress <= 2.1.33 - Authenticated (Contributor+) Stored Cross-Site Scripting
- Bakes And Cakes <= 1.2.9 - Missing Authorization
- ArtPlacer Widget <= 2.20.6 - Authenticated (Editor+) SQL Injection