Security
Microsoft security updates and public advisory evidence: affected products, fixing updates, exploitation and source coverage.
Advisory catalog
Public source statements across vendors. Explicit aliases connect records; each publisher keeps its own state, severity and affected-version evidence.
Collected statements
694914 source statements · aliases may refer to the same vulnerabilityDatabase Addon for Contact Form 7 <= 1.4.1 - Unauthenticated Limited File Deletion via Injected 'attackcfdb7_file' Submission Field
cve-program ·
Vendor product: Database Addon for Contact Form 7 – CFDB7
Membership & User Roles for WooCommerce (Automatic Role Changer) <= 20260828 - Authenticated (Subscriber+) Privilege Escalation to Stale Foreign Role Cache
cve-program ·
Vendor product: Membership & User Roles for WooCommerce (Automatic Role Changer)
Click to Chat <= 4.44 - Unauthenticated Arbitrary Shortcode Execution via REQUEST_URI via {url} Placeholder
cve-program ·
Vendor product: Click to Chat – HoliThemes
Snazzy Social Media Feed <= 2.5 - Unauthenticated Arbitrary File Upload via 'pluginURL' Parameter
cve-program ·
Vendor product: Snazzy Social Media Feed
Abandoned Cart Pro for WooCommerce <= 10.8.0 - Unauthenticated SQL Injection via Guest Persistent Cart meta_value
cve-program ·
Vendor product: Abandoned Cart Pro for WooCommerce
Abandoned Cart Pro for WooCommerce <= 10.8.0 - Unauthenticated SQL Injection via AES-CTR Ciphertext Forgery in 'validate' Parameter
cve-program ·
Vendor product: Abandoned Cart Pro for WooCommerce
AGE-GATE <= 1.0 - Unauthenticated Remote Code Execution via PHP Code Injection via 'width'/'height' Parameters to Standalone admin.php
cve-program ·
Vendor product: AGE-GATE
Document Gallery <= 5.1.1 - Unauthenticated Stored Cross-Site Scripting
cve-program ·
Vendor product: Document Gallery
Cryptocurrency Donation Box <= 2.2.13 - Unauthenticated Stored Cross-Site Scripting via data_object Parameter
cve-program ·
Vendor product: Cryptocurrency Donation Box – Bitcoin & Crypto Donations
Smart Forms <= 2.6.104 - Unauthenticated Stored Cross-Site Scripting via 'formString' Parameter
cve-program ·
Vendor product: Smart Forms – when you need more than just a contact form
Contact Form DB for Enfold <= 2.0.2 - Unauthenticated Stored Cross-Site Scripting via Contact Form Field Values
cve-program ·
Vendor product: Contact Form DB for Enfold
Directorist: AI-Powered Business Directory, Listings & Classified Ads <= 8.10.2.1 - Authenticated (Subscriber+) Stored Cross-Site Scripting via 'phone' Listing Field
cve-program ·
Vendor product: Directorist: AI-Powered Business Directory, Listings & Classified Ads
Avada (Fusion) Builder <= 3.16.1 - Unauthenticated Sensitive Information Exposure in 'args[link_target]' Parameter via {user_meta} Dynamic Data Token
cve-program ·
Vendor product: Avada (Fusion) Builder
WordPress Restricted Site Access plugin <= 7.6.2 - Broken Access Control vulnerability
cve-program ·
https://wordpress.org/plugins: restricted-site-access
Appointment Booking Plugin <= 5.7.3 - Insecure Direct Object Reference to Unauthenticated Sensitive Information Disclosure via 'booking[id]' and 'cart[id]' Parameters
cve-program ·
Vendor product: Appointment Booking Plugin – LatePoint | Calendar & Scheduling for WordPress
Appointment Booking Plugin <= 5.7.3 - Authenticated (Subscriber+) Sensitive Information Exposure in 'first_name' Parameter Template Re-expansion
cve-program ·
Vendor product: Appointment Booking Plugin – LatePoint | Calendar & Scheduling for WordPress
PeproDev Branches Map <= 3.0.1 - Authenticated (Contributor+) Stored Cross-Site Scripting
cve-program ·
Vendor product: PeproDev Branches Map (Mapify)
LifterLMS <= 10.3.1 - Authenticated (Contributor+) Local File Inclusion via 'lifterlms_checkout' Shortcode Attributes
cve-program ·
Vendor product: LifterLMS – WP LMS for eLearning, Online Courses, & Quizzes
Mang Board <= 2.4.3 - Unauthenticated Stored Cross-Site Scripting via 'user_name' Parameter
cve-program ·
Vendor product: Mang Board
Record of Consent Extension for Complianz <= 2.5 - Unauthenticated Stored Cross-Site Scripting via 'uid' Parameter
cve-program ·
Vendor product: Record of Consent Extension for Complianz
SimpleForm <= 3.10.0 - Unauthenticated Privilege Escalation to wp_capabilities Mass Assignment via simpleform_wp_register
cve-program ·
Vendor product: SimpleForm – Form Maker to Chat Apps with Quiz, Poll and Multi Lead Notifications
Post Export Import with Media <= 1.17.1 - Authenticated (Administrator+) PHP Object Injection via 'page_data[meta]' Parameter
cve-program ·
Vendor product: Post Export Import with Media
WordPress Email Template Customizer for WooCommerce plugin <= 1.3.4 - Content Injection vulnerability
cve-program ·
https://wordpress.org/plugins: email-template-customizer-for-woo
WordPress SureCart plugin <= 4.9.3 - Cross Site Scripting (XSS) vulnerability
cve-program ·
https://wordpress.org/plugins: surecart
WordPress Broadcast Live Video plugin <= 7.3.2 - Session Hijacking vulnerability
cve-program ·
https://wordpress.org/plugins: videowhisper-live-streaming-integration
WordPress JetProductTables plugin <= 1.2.4 - Cross Site Scripting (XSS) vulnerability
cve-program ·
https://crocoblock.com: jet-product-tables
WordPress Bus Ticket Booking with Seat Reservation plugin <= 5.9.7 - Broken Access Control vulnerability
cve-program ·
https://wordpress.org/plugins: bus-ticket-booking-with-seat-reservation
WordPress Affiliates plugin <= 7.0.1 - PHP Object Injection vulnerability
cve-program ·
https://wordpress.org/plugins: affiliates
WordPress Push Notification for Post and BuddyPress plugin <= 3.23 - Broken Access Control vulnerability
cve-program ·
https://wordpress.org/plugins: push-notification-for-post-and-buddypress
WordPress JetEngine plugin <= 3.8.16 - Cross Site Scripting (XSS) vulnerability
cve-program ·
https://crocoblock.com: jet-engine
NGINX Gateway Fabric vulnerability
cve-program ·
Vendor product: NGINX Gateway Fabric
NGINX Ingress Controller vulnerability
cve-program ·
Vendor product: NGINX Ingress Controller
NGINX ngx_http_v3_module vulnerability
cve-program ·
Vendor product: NGINX Plus · Vendor product: NGINX Open Source
NGINX ngx_http_js_module vulnerability
cve-program ·
Vendor product: NGINX JavaScript
NGINX ngx_http_js_module vulnerability
cve-program ·
Vendor product: NGINX JavaScript
NGINX Ingress Controller vulnerability
cve-program ·
Vendor product: NGINX Ingress Controller
WordPress Salevo plugin <= 1.3.0 - Content Injection vulnerability
cve-program ·
https://wordpress.org/plugins: woo-boost-sales
WordPress MDTF plugin <= 1.3.9 - Arbitrary Code Execution vulnerability
cve-program ·
https://wordpress.org/plugins: wp-meta-data-filter-and-taxonomy-filter
WordPress Best Payments Plugin for WP plugin <= 4.6.27 - Cross Site Scripting (XSS) vulnerability
cve-program ·
https://wordpress.org/plugins: wp-payment-form
WordPress Skydropx plugin <= 2.1.4 - Broken Access Control vulnerability
cve-program ·
https://wordpress.org/plugins: skydropx
Checkov by Prisma Cloud: Server-Side Request Forgery Vulnerability
cve-program ·
Vendor product: Checkov by Prisma Cloud
PhastPress <= 3.10 - Unauthenticated Server-Side Request Forgery via 'src' Parameter
cve-program ·
Vendor product: PhastPress
10Web Booster <= 2.34.10 - Unauthenticated Arbitrary File Upload via 'page_id' Parameter
cve-program ·
Vendor product: 10Web Booster – Website speed optimization, Cache & Page Speed optimizer
Kirki <= 6.2.0 - Authenticated (Custom+) Stored Cross-Site Scripting via Page Builder Text Content
cve-program ·
Vendor product: Kirki – Freeform Page Builder, Website Builder & Customizer
Post and Page Builder by BoldGrid <= 1.27.13 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'data-label' Attribute
cve-program ·
Vendor product: Post and Page Builder by BoldGrid – Visual Drag and Drop Editor
Ocean Extra <= 2.6.0 - Unauthenticated Arbitrary Shortcode Execution via 'oceanwp_library' Shortcode Template
cve-program ·
Vendor product: Ocean Extra
Import and export users and customers <= 2.4.5 - Authenticated (Custom+) Stored Cross-Site Scripting via User Meta Profile Fields
cve-program ·
Vendor product: Import and export users and customers
Checkout Field Manager (Checkout Manager) for WooCommerce <= 7.9.6 - Missing Authorization to Authenticated (Subscriber+) Arbitrary Media Deletion via Checkout File Field Attachment ID
cve-program ·
Vendor product: Checkout Field Manager (Checkout Manager) for WooCommerce
Premium Packages <= 7.0.5 - Unauthenticated Stored Cross-Site Scripting via 'order_email'
cve-program ·
Vendor product: Premium Packages – Sell Digital Products Securely
A catalog match establishes published evidence, not applicability to your environment. Check resolved package dependencies, or open a Microsoft CVE for fixing KBs, releases and planning.