Timeline Event History <= 3.2 - Reflected Cross-Site Scripting

wpdiscover Timeline Event History

SurveyJS: Drag & Drop WordPress Form Builder to create, style and embed multiple forms of any complexity <= 1.12.20 - Cross-Site Request Forgery to Survey Renaming

devsoftbaltic SurveyJS: Drag & Drop Form Builder

JavaScript Notifier <= 1.2.8 - Authenticated (Administrator+) Stored Cross-Site Scripting via Plugin Settings

freemp JavaScript Notifier

Friendly Functions for Welcart <= 1.2.5 - Cross-Site Request Forgery to Settings Update

mainichiweb Friendly Functions for Welcart

LeadBI Plugin for WordPress <= 1.7 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'form_id' Shortcode Attribute

leadbi LeadBI Plugin for WordPress

Responsive Header Plugin <= 1.0 - Authenticated (Administrator+) Stored Cross-Site Scripting via Settings Parameters

mehtevas Responsive Header Plugin

SurveyJS: Drag & Drop WordPress Form Builder <= 1.12.20 - Cross-Site Request Forgery to Survey Creation

devsoftbaltic SurveyJS: Drag & Drop Form Builder

CM CSS Columns <= 1.2.1 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'tag' Shortcode Attribute

codemacher CM CSS Columns

MetForm – Contact Form, Survey, Quiz, & Custom Form Builder for Elementor <= 4.1.0 - Unauthenticated Form Submission Exposure via Forgeable Cookie Value

roxnor MetForm – Contact Form, Survey, Quiz, & Custom Form Builder for Elementor

Meta-box GalleryMeta <= 3.0.1 - Authenticated (Editor+) Stored Cross-Site Scripting via Image Caption

shahinurislam Meta-box GalleryMeta

AdminQuickbar <= 1.9.3 - Cross-Site Request Forgery to Settings Update

rtowebsites AdminQuickbar

Meta-box GalleryMeta <= 3.0.1 - Missing Authorization to Authenticated (Author+) Gallery Management

shahinurislam Meta-box GalleryMeta

Postalicious <= 3.0.1 - Authenticated (Administrator+) Stored Cross-Site Scripting via Plugin Settings

neop Postalicious

Moderate Selected Posts <= 1.4 - Cross-Site Request Forgery to Plugin Settings Update

hallsofmontezuma Moderate Selected Posts

All-in-One Video Gallery 4.1.0 - 4.6.4 - Missing Authorization to Authenticated (Subscriber+) Limited User Meta Update

plugins360 All-in-One Video Gallery

User Submitted Posts – Enable Users to Submit Posts from the Front End <= 20251210 - Unauthenticated Stored Cross-Site Scripting via Custom Field

specialk User Submitted Posts – Enable Users to Submit Posts from the Front End

Login Page Editor <= 1.2 - Cross-Site Request Forgery to Settings Update

zero1zerouk Login Page Editor

JustClick registration plugin <= 0.1 - Reflected Cross-Site Scripting via PHP_SELF

ostin654 JustClick registration plugin

Administrative Shortcodes <= 0.3.4 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'login' and 'logout' Shortcode Attributes

shazdeh Administrative Shortcodes

Wise Analytics <= 1.1.9 - Missing Authorization to Unauthenticated Arbitrary Analytics Database Disclosure via 'name' Parameter

marcinlawrowski Wise Analytics