Vulnerability archive: section 16, page 4
Open a report to review affected versions, available fixes and original sources. Each report covers a specific issue; its presence does not establish whether your website is affected.
- Pricing Table by Supsystic <= 1.8.1 - Unauthenticated Stored Cross-Site Scripting
- Bold Page Builder <= 5.1.3 - Missing Authorization
- BuddyForms ACF <= 1.3.8 - Authenticated (Contributor+) Cross-Site Scripting
- Caldera Forms <= 1.5.9.1 - Cross Site Scripting
- Church Admin <= 4.0.27 - Cross-Site Request Forgery
- Simple Featured Image <= 1.3.1 - Authenticated (Contributor+) Stored Cross-Site Scripting via slideshow Parameter
- DirectIQ Email Marketing <= 2.0 - Unauthenticated SQL Injection
- BetterDocs <= 4.1.1 - Missing Authorization to Private And Password-Protected Posts Information Disclosure
- Easy2Map <= 1.2.4 - SQL Injection
- Lazyest Backup < 0.2.2 - Reflected Cross-Site Scripting
- Google Forms < 0.85 - Cross-Site Scripting
- Builder for WooCommerce reviews shortcodes – ReviewShort <= 1.01.5 - Missing Authorization
- User Submitted Posts – Enable Users to Submit Posts from the Front End <= 20230811 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode
- WP BackItUp Community Edition <= 2.1.0 - Authenticated (Administrator+) Path Traversal to Arbitrary File Read via 'backup_file' Parameter
- Business Pro <= 1.10.4 - Reflected Cross-Site Scripting
- AI Infographic Maker <= 4.9.0 - Unauthenticated Arbitrary Shortcode Execution
- tagDiv Composer <= 4.8 - Authenticated (Contributor+) Stored Cross-Site Scripting via button Shortcode
- SpeakOut! Email Petitions <= 4.6.5 - Unauthenticated SQL Injection
- WP-Members Membership Plugin <= 3.5.5.1 - Authenticated (Contributor+) SQL Injection via 'order_by' Shortcode Attribute
- Five Star Business Profile and Schema <= 2.1.6 - Subscriber+ Page Creation & Settings Update to Stored Cross-Site Scripting
- WooCommerce Recover Abandoned Cart <= 24.4.0 - Unauthenticated PHP Object Injection
- ShareThis Share Buttons <= 2.3.0 - Authenticated (Contributor+) Stored Cross-Site Scripting via sharethis-inline-buttons Shortcode
- BookingPress <= 1.0.30 - Unauthenticated Insecure Direct Object Reference
- Wp-D3 < 2.4.1 - Cross-Site Request Forgery
- Popup Anything – A Marketing Popup and Lead Generation Conversions <= 2.1.6 - Reflected Cross-Site Scripting
- AB Google Map Travel (AB-MAP) < 4.0 - Cross-Site Request Forgery to Cross-Site Scripting
- WP Landing Page <= 0.9.3 - Cross-Site Request Forgery to Arbitrary Post Meta Update
- SuevaFree Essential Kit <= 1.1.3 - Authenticated (Contributor+) Stored Cross-Site Scripting
- Coming Soon Page – Responsive Coming Soon & Maintenance Mode <= 1.1.18 - Cross-Site Scripting via bg_color parameter
- Form Maker by 10Web <= 1.15.47 - Unauthenticated Stored Cross-Site Scripting via Mark on Map Longitude/Latitude Fields
- Atarim <= 4.0.1 - Missing Authorization via remove_feedbacktool_notice()
- Donation Forms WP by Givecloud <= 1.0.9 - Authenticated (Contributor+) Stored Cross-Site Scripting
- WordPress Core < 1.5.1.2 - SQL Injection
- Schema & Structured Data for WP & AMP <= 1.26 - Missing Authorization to reCaptcha Key Modification
- Ninja Forms – The Contact Form Builder That Grows With You <= 3.8.17 - Authenticated (Admin+) Stored Cross-Site Scripting
- Community by PeepSo <= 6.3.1.1 - Cross-Site Request Forgery to User Post Creation
- ShipTime: Discount Shipping <= 1.1.1 - Authenticated (Subscriber+) Information Exposure
- Slider & Popup Builder by Depicter – Add Image Slider, Carousel Slider, Exit Intent Popup, Popup Modal, Coupon Popup, Post Slider Carousel <= 3.1.1 - Authenticated (Contributor+) Arbitrary File Upload
- th23 Social <= 1.2.0 - Stored Cross-Site Scripting
- PPOM for WooCommerce <= 23.9 - Missing Authorization to Stored Cross-Site Scripting
- Admin Block Country <= 7.1.4 - Cross-Site Request Forgery via admin_block_country_initial_page
- Jetpack VideoPress <= 3.6 - Missing Authorization
- Duplicate Page and Post <= 2.9.5 - Authenticated (Contributor+) SQL Injection
- Post SMTP <= 2.6.0 - Authenticated (Administrator+) SQL Injection
- Automatic <= 3.92.0 - Unauthenticated Arbitrary File Download and Server-Side Request Forgery
- JetBlocks For Elementor <= 1.3.19 - Authenticated (Contributor+) Stored Cross-Site Scripting
- Yoo Slider plugin <= 2.0.0 - Cross-Site Request Forgery
- Icegram Engage <= 2.1.7 - Cross-Site Scripting
- SB Uploader <= 4.8 - Arbitrary File Upload
- Paid Memberships Pro < 1.7.15 - Directory Traversal
- Video Embed <= 1.0 - Authenticated (Subscriber+) SQL Injection
- Dashboard Notepads <= 1.2.1 - Cross-Site Request Forgery to Stored Cross-Site Scripting
- Updraft Plus <= 1.22.24 - Information Disclosure via updraft_ajaxrestore
- Featured Image with URL < 1.0.6 - Authenticated (Contributor+) Stored Cross-Site Scripting
- Ultimate Addons for WPBakery Page Builder < 3.21.1 - Authenticated (Contributor+) Stored Cross-Site Scripting
- Facebook Chat Plugin <= 1.5 - Missing Capabilities Check
- Real Estate Pro <= 2.1.5 - Missing Authorization
- Restaurant & Cafe Addon for Elementor <= 1.5.3 - Missing Authorization via multiple AJAX functions
- Analytics Insights <= 6.2 - Open Redirect
- Authenticator <= 1.3.0 - Missing Authorization
- WP Tabs <= 2.2.12 - Authenticated (Administrator+) PHP Object Injection
- Jetpack <= 13.7 & Jetpack Boost <= 3.4.7 - Authenticated (Contributor+) Stored Cross-Site Scripting
- Admin Menu Post List <= 2.0.7 - Authenticated (Administrator+) Stored Cross-Site Scripting
- Post Snippets <= 4.2.4 - Authenticated (Contributor+) Stored Cross-Site Scripting
- GiveWP <= 2.3.0 - Cross-Site Scripting
- MultiVendorX – The Ultimate WooCommerce Multivendor Marketplace Solution <= 4.2.14 - Unauthenticated Limited Local File Inclusion
- WP Church Center <= 1.3.3 - Reflected Cross-Site Scripting
- RokNewsPager <= 1.17 - Path Disclosure
- EmbedPress – PDF Embedder, 3D PDF FlipBook, Google Reviews, YouTube Videos, Upload & Embed PDF documents 4.6.0 - 4.6.3 - Missing Authorization
- HollerBox <= 2.1.3 - Authenticated (edit_popups+) SQL Injection
- WPC Countdown Timer for WooCommerce <= 3.1.4 - Authenticated (Contributor+) Stored Cross-Site Scripting
- Marketing Automation by AZEXO <= 1.27.80 - Authenticated (Subscriber+) Privilege Escalation
- Zephyr Project Manager <= 3.3.101 - Authenticated (Subscriber+) Limited Privilege Escalation
- CM Tooltip Glossary <= 4.3.9 - Authenticated (Contributor+) Stored Cross-Site Scripting
- Store Locator WordPress <= 1.5.1 - Authenticated (Administrator+) SQL Injection
- Simple Org Chart <= 2.3.4 - Missing Authorization
- Photo Gallery by 10Web <= 1.6.8 - Authenticated (Admin+) Cross-Site Scripting
- Bestbooks <= 2.6.3 - Unauthenticated SQL Injection
- WP Ajax Contact Form <= 2.2.2 - Cross-Site Request Forgery to Arbitrary Email Deletion
- InstaWP Connect <= 0.1.0.8 - Cross-Site Request Forgery via create_file_db_manager
- Amelia Booking 8.3 - 9.1.2 - Authenticated (Customer+) Insecure Direct Object Reference to Arbitrary User Password Change
- Simply Poll <= 1.4.1 - Cross-Site Request Forgery and Stored Cross-Site Scripting
- Smart Image Gallery <= 1.0.18 - Cross-Site Request Forgery
- Activity Plus Reloaded for BuddyPress <= 1.1.1 - Authenticated (Subscriber+) Blind Server-Side Request Forgery
- Simple Payment <= 2.5.2 - Missing Authorization
- ExactMetrics <= 9.1.2 - Authenticated (Editor+) Arbitrary Plugin Installation/Activation via exactmetrics_connect_process
- AhaChat Messenger Marketing <= 1.1 - Authentication Bypass
- WebToffee WP Backup and Migration <= 1.6.0 - Missing Authorization
- All-in-One Video Gallery <= 4.6.4 - Missing Authorization to Unauthenticated Bunny Stream Video Creation/Deletion
- Widget BUY.BOX <= 3.1.5 - Authenticated (Contributor+) Stored Cross-Site Scripting
- WP-Polls <= 2.73 - Cross-Site Scripting
- pb-embedFlash <= 1.5.1 - Remote File Inclusion
- PropertyHive <= 2.0.6 - Missing Authorization via activate_pro_feature
- Quads Ads Manager for Google AdSense 3.0.4 - Authenticated (Subscriber+) Payment Bypass to Unpaid Ad Placement Acquisition
- EG-Attachments <= 2.1.3 - Reflected Cross-Site Scripting via 'paged'
- GdeSlon Affiliate Shop <= 1.5.5 - Open Redirect
- WPZOOM Shortcodes <= 1.0.5 - Authenticated (Contributor+) Stored Cross-Site Scripting via box Shortcode
- Academy LMS <= 3.8.0 - Insecure Direct Object Reference to Authenticated (Subscriber+) Note/Progress Modification
- WooCommerce Order Search <= 1.1.0 - Reflected Cross-Site Scripting
- Blaze Slideshow <= 2.4 - Arbitrary File Upload