Vulnerability archive: section 1, page 10

Open a report to review affected versions, available fixes and original sources. Each report covers a specific issue; its presence does not establish whether your website is affected.

• Extensions for Leaflet Map <= 4.14 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'elevation-track' Shortcode
• GD Rating System <= 3.7.1 - Unauthenticated Stored Cross-Site Scripting via 'title' and 'url' Render Args in gdrts_live_handler AJAX
• PGS Core <= 5.8.0 - Unauthenticated SQL Injection
• Greenshift – animation and page builder blocks <= 12.2.7 - Authenticated (Contributor+) Stored Cross-Site Scripting via Chart Data Attributes
• Booking Calendar <= 10.14.1 - Authenticated (Contributor+) Stored Cross-Site Scripting
• Turbo Manager < 4.0.8 - Authenticated (Contributor+) Local File Inclusion
• Booking calendar, Appointment Booking System <= 3.2.3 - Missing Authorization
• WP-Asambleas <= 2.85.0 - Unauthenticated Arbitrary Shortcode Execution
• WP Import Export Lite <= 3.9.26 - Authenticated (Administrator+) PHP Object Injection
• JTRT Responsive Tables <= 4.1.9 - Cross-Site Request Forgery
• Razorpay Payment Links for WooCommerce <= 2.1.5 - Cross-Site Request Forgery
• Users Ultra Membership Plugin <= 1.5.63 - Authenticated Blind SQL Injection
• Membership For WooCommerce <= 2.1.6 - Unauthenticated Arbitrary File Upload
• Brands for WooCommerce <= 3.8.8 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'style' Shortcode Attribute
• MPG – Multiple Page Generator, Bulk Landing Pages & Programmatic SEO <= 4.2.3 - Unauthenticated Information Exposure
• Restaurant Menu – Food Ordering System – Table Reservation <= 2.3.0 - Missing Authorization on AJAX Actions
• Slugs Manager <= 2.6.7 - Cross-Site Request Forgery
• WP User Frontend <= 4.2.4 - Missing Authorization to Unauthenticated Arbitrary Attachment Deletion
• Gutenberg Blocks with AI by Kadence WP – Page Builder Features <= 3.2.45 - Authenticated (Contributor+) Stored DOM-Based Cross-Site Scripting via HTML Data Attributes
• Unlimited Page Sidebars <= 0.2.6 - Cross-Site Request Forgery to Stored Cross-Site Scripting
• Contact Form by Bit Form: Multi Step Form, Calculation Contact Form, Payment Contact Form & Custom Contact Form builder 2.0 - 2.13.9 - Authenticated (Administrator+) Arbitrary JavaScript File Uploads
• Testimonial Slider <= 2.0.13 - Authenticated (Contributor+) PHP Object Injection
• Punnel <= 1.3.1 - Missing Authorization to Authenticated (Subscriber+) Settings Update via 'punnel_save_config' AJAX Action
• Bridge Core <= 3.3 - Missing Authorization
• Add Shortcodes Actions And Filters <= 2.0.9 - Reflected Cross-Site Scripting
• Admin Custom Login <= 3.6.4 - Authenticated (Administrator+) Stored Cross-Site Scripting via 'Message Above Login Form' Setting
• Esotera <= 1.2.5.1 - Authenticated (Contributor+) Stored Cross-Site Scripting
• Masteriyo - LMS <= 1.18.3 - Authenticated (Contributor+) Stored Cross-Site Scripting
• PayGreen – Ancienne version <= 4.10.2 - Cross-Site Request Forgery
• Pie Register – User Registration, Profiles & Content Restriction <= 3.8.4.13 - Unauthenticated Information Exposure
• wp-twitpic <= 1.0 - Authenticated (Contributor+) Stored Cross-Site Scripting
• WP Church Donation <= 1.7 - Cross-Site Request Forgery
• Translator <= 0.3 - Cross-Site Request Forgery to Stored Cross-Site Scripting
• Javo Spot < 3.0.0 - Directory Traversal
• WowPress <= 1.0.0 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode Attributes
• Featured Image from URL (FIFU) Free & Premium <= 6.0.7 - Cross-Site Request Forgery
• RSVPMarker <= 10.6.5 - Authenticated (Administrator+) Stored Cross-Site Scripting via admin settings
• Order Export for WooCommerce <= 3.24 - Unauthenticated Sensitive Information Exposure Through Unprotected Directory
• Soledad <= 8.6.7 - Authenticated (Contributor+) Local File Inclusion via 'header_layout'
• WikiPop <= 2.0 - Cross-Site Scripting
• DethemeKit For Elementor <= 2.1.10 - Missing Authorization
• Hydra Booking — Appointment Scheduling & Booking Calendar <= 1.1.44 - Unauthenticated Stored Cross-Site Scripting
• Poll Maker <= 4.6.2 - Authenticated (Admin+) Server-Side Request Forgery
• GD bbPress Attachments <= 2.5 - Stored Cross-Site Scripting
• Image Photo Gallery Final Tiles Grid <= 3.6.12 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'delay' Shortcode Attribute
• Essential Blocks for Gutenberg <= 3.8.5 - Cross-Site Request Forgery
• Wordpress File Upload 4.24.0 - Cross-Site Request Forgery
• YITH WooCommerce Quick View <= 2.7.0 - Authenticated (Contributor+) Stored Cross-Site Scripting via yith_quick_view Shortcode
• Post Grid Master <= 3.4.12 - Authenticated (Contributor+) Local File Inclusion
• Yozi <= 2.0.63 - Unauthenticated Local File Inclusion
• Starter Templates <= 4.4.0 - Authenticated (Author+) Stored Cross-Site Scripting
• twitterDash <= 2.1 - Cross-Site Request Forgery to Cross-Site Scripting
• GiveWP <= 3.3.1 - Reflected Cross-Site Scripting
• TS Comfort DB <= 2.0.7 - Reflected Cross-Site Scripting
• Admin debug wordpress – enable debug <= 1.0.13 - Cross-Site Request Forgery
• Drozd – Addons for Elementor <= 1.1.1 - Authenticated (Contributor+) Stored Cross-Site Scripting
• Shopping Cart & eCommerce Store < 3.0.16 - Arbitrary File Upload
• Propovoice <= 1.7.6.7 - Unauthenticated Arbitrary File Read
• Cryptocurrency Widgets Pack <= 2.0.1 - Missing Authorization
• Gravity Forms <= 2.7.3 - Unauthenticated PHP Object Injection
• LionScripts: IP Blocker Lite <= 10.4 - Cross-Site Request Forgery to Arbitrary File Upload
• ProfileGrid <= 5.5.1 - Missing Authorization to User Import
• WP Matterport Shortcode <= 2.1.5 - Reflected Cross-Site Scripting
• Post Form – Registration Form – Profile Form for User Profiles – Frontend Content Forms for User Submissions (UGC) <= 2.8.7 - Missing Authorization to Unauthenticated Media Upload
• Extensions For CF7 <= 3.4.0 - Authenticated (Contributor+) Insecure Direct Object Reference
• All in One SEO < 4.9.9 - Missing Authorization
• WooCommerce Shipping – DPD baltic <= 1.2.54 - Missing Authorization to Arbitrary Options Deletion
• Uncanny Toolkit for LearnDash <= 3.7.0.1 - Authenticated (Contributor+) Stored Cross-Site Scripting
• Master Addons for Elementor <= 3.2.2 - Missing Authorization to Authenticated (Contributor+) Arbitrary Post Modification/Deletion via 'popup_id' Parameter
• Better Search <= 3.1.0 - Cross-Site Request Forgery
• Captcha <= 3.8.1 - Captcha Bypass
• NEX-Forms – Ultimate Form Builder – Contact forms and much more <= 8.5.5 - Authenticated (Admin+) SQL Injection
• OS BXSlider <= 2.6 - Authenticated (Contributor+) Stored Cross-Site Scripting
• Photonic Gallery & Lightbox for Flickr, SmugMug & Others <= 3.21 - Authenticated (Contributor+) Stored Cross-Site Scripting via Caption Attribute
• WP Booking System <= 2.0.19.10 - Missing Authorization via wpbs_refresh_calendar_editor
• IP Blacklist Cloud <= 5.00 - Reflected Cross-Site Scripting
• Ecwid Ecommerce Shopping Cart <= 6.10.22 - Insufficient Access Control on Multiple AJAX Actions
• New User Approve <= 2.4 - Cross-Site Request Forgery
• Flexible Shipping <= 4.24.15 - Missing Authorization
• Newsletters <= 4.14 - Unauthenticated Stored Cross-Site Scripting
• Essential Addons for Elementor <= 5.9.19 - Authenticated (Contributor+) DOM-Based Stored Cross-Site Scripting via Several Widgets
• Responsive Blocks <= 2.0.6 - Authenticated (Contributor+) Stored Cross-Site Scripting
• Forty Four – 404 Plugin for WordPress <= 1.4 - Authenticated (Administrator+) Stored Cross-Site Scripting
• Greenmart <= 2.5.1 - Reflected Cross-Site Scripting
• Secudeal Payments for Ecommerce <= 1.1 - Unauthenticated PHP Object Injection
• EventON - WordPress Virtual Event Calendar Plugin <= 5.0.11 - Unauthenticated Blind SQL Injection via Search Parameter
• WP Live Chat Support <= 8.0.17 - Cross-Site Scripting
• FooGallery Captions <= 1.0.2 - Reflected Cross-Site Scripting
• Antideo Email Validator <= 1.0.10 - Unauthenticated SQL Injection
• Classified Listing – AI-Powered Classified ads & Business Directory <= 6.1.2 - Authenticated (Subscriber+) Stored Cross-Site Scripting
• Prodigy Commerce <= 3.0.8 - Authenticated (Contributor+) Stored Cross-Site Scripting
• ShopConstruct – Product Catalog, Shopping Cart and eCommerce solution for Store <= 1.1.2 - Reflected Cross-Site Scripting via multiple parameters
• smart SEO <= 2.9 - Unauthenticated Local File Inclusion
• WP Job Portal <= 2.0.1 - Cross-Site Request Forgery to Settings Modification
• Wallet System for WooCommerce <= 2.5.13 - Information Exposure via Log Files
• MailChimp Forms by MailMunch <= 3.2.7 - Missing Authorization to Authenticated (Subscriber+) MailMunch Integration Takeover via 'sign_in' AJAX Action
• User Registration & Membership – Free & Paid Memberships, Subscriptions, Content Restriction, User Profile, Custom User Registration & Login Builder < 5.2.8 - Unauthenticated Open Redirect
• AHAthat <= 1.6 - Reflected Cross-Site Scripting
• Modula Image Gallery <= 3.0.2 - Missing Authorization to Authenticated (Author+) Arbitrary File Deletion (Non-PHP) via 'file' Parameter
• Appointment Booking Calendar — Simply Schedule Appointments Booking Plugin <= 1.6.7.14 - Authenticated (Contributor+) Stored Cross-Site Scripting