Security
Microsoft security updates and public advisory evidence: affected products, fixing updates, exploitation and source coverage.
Advisory catalog
Public source statements across vendors. Explicit aliases connect records; each publisher keeps its own state, severity and affected-version evidence.
Collected statements
698142 source statements · aliases may refer to the same vulnerabilityWordPress Element Pack Elementor Addons plugin <= 8.8.6 - Cross Site Scripting (XSS) vulnerability
cve-program ·
https://wordpress.org/plugins: bdthemes-element-pack-lite
WordPress Media LIbrary Assistant plugin <= 3.41 - Cross Site Scripting (XSS) vulnerability
cve-program ·
https://wordpress.org/plugins: media-library-assistant
WordPress Element Pack Elementor Addons plugin <= 8.8.6 - Cross Site Scripting (XSS) vulnerability
cve-program ·
https://wordpress.org/plugins: bdthemes-element-pack-lite
WordPress Rocket Lazy Load plugin <= 2.4.0 - Cross Site Scripting (XSS) vulnerability
cve-program ·
https://wordpress.org/plugins: rocket-lazy-load
WordPress Hustle plugin <= 7.8.14.2 - Broken Access Control vulnerability
cve-program ·
https://wordpress.org/plugins: wordpress-popup
WordPress Quiz And Survey Master plugin <= 11.2.7 - Cross Site Scripting (XSS) vulnerability
cve-program ·
https://wordpress.org/plugins: quiz-master-next
WordPress Prime Slider – Addons For Elementor plugin <= 4.6.2 - Cross Site Scripting (XSS) vulnerability
cve-program ·
https://wordpress.org/plugins: bdthemes-prime-slider-lite
WordPress Happy Addons for Elementor plugin <= 3.50.0 - Cross Site Scripting (XSS) vulnerability
cve-program ·
https://wordpress.org/plugins: happy-elementor-addons
WordPress Modula Image Gallery plugin <= 3.0.11 - Sensitive Data Exposure vulnerability
cve-program ·
https://wordpress.org/plugins: modula-best-grid-gallery
WordPress Booktics plugin <= 1.0.27 - Broken Access Control vulnerability
cve-program ·
https://wordpress.org/plugins: booktics
WordPress WP Rentals theme <= 3.14.2 - Broken Access Control vulnerability
cve-program ·
https://wordpress.org/plugins: wprentals
Integration for Epos Now and WooCommerce 4.6.0 - 4.11.1 - Unauthenticated Action Scheduler Queue Disclosure
cve-program ·
Vendor product: Integration for Epos Now and WooCommerce
Geliver Akıllı Kargo Pazaryeri 3.0.0 - 3.1.0 - Unauthenticated API Key Disclosure via Public Log File
cve-program ·
Vendor product: Geliver Akıllı Kargo Pazaryeri
Frontend Dashboard < 3.0.0 - Subscriber+ Profile and Post Field Deletion via fed_user_profile_delete
cve-program ·
Vendor product: Frontend Dashboard
Academy LMS < 4.0.0 - Subscriber+ Arbitrary Lesson Content Disclosure via Topic REST Endpoint
cve-program ·
Vendor product: Academy LMS
Academy LMS < 4.0.0 - Subscriber+ Cross-Course Quiz Answer Disclosure via render_quiz_answers
cve-program ·
Vendor product: Academy LMS
Yaad Sarig Payment Gateway For WC < 2.2.13 - Subscriber+ Arbitrary Order Payment Manipulation via IDOR
cve-program ·
Vendor product: Yaad Sarig Payment Gateway For WC
If-So Dynamic Content 1.4.4 - 1.10.1 - Reflected XSS via 'message' Parameter
cve-program ·
Vendor product: If-So Dynamic Content
Koinonia Link 1.1.2 - 1.1.4 - Subscriber+ Privilege Escalation to Administrator
cve-program ·
Vendor product: Koinonia Link
WPCafe < 3.0.21 - Unauthenticated Product Data Disclosure via REST API
cve-program ·
Vendor product: WPCafe
Magee Shortcodes <= 2.1.1 - Reflected XSS via live_preview and magee_create_shortcode Actions
cve-program ·
Vendor product: Magee Shortcodes
MPG < 4.2.3 - Editor+ SQLi via Project Import
cve-program ·
Vendor product: MPG
CP Media Player < 1.3.4 - Contributor+ Media Player Settings Update
cve-program ·
Vendor product: CP Media Player
WP Coder 4.0 - 4.5.1 - Editor+ RCE via Global PHP
cve-program ·
Vendor product: WP Coder
Animated Number Counters < 3.1 - Editor+ Second-Order SQLi via Counter Order
cve-program ·
Vendor product: Animated Number Counters
Envira Gallery < 1.16.1 - Author+ Stored XSS via Gallery Crop Dimensions
cve-program ·
Vendor product: Envira Gallery
Envira Gallery < 1.16.1 - Author+ Stored XSS via Gallery Image ID
cve-program ·
Vendor product: Envira Gallery
Optimole 4.0.0 - 4.2.14 - Subscriber+ Sensitive Data Disclosure via Dashboard Widget
cve-program ·
Vendor product: Optimole
A catalog match establishes published evidence, not applicability to your environment. Check resolved package dependencies, or open a Microsoft CVE for fixing KBs, releases and planning.