Vulnerability archive: section 1, page 11

Open a report to review affected versions, available fixes and original sources. Each report covers a specific issue; its presence does not establish whether your website is affected.

• Flow-Flow Social Feed Stream <= 3.0.71 - Cross-Site Scripting
• Livemesh Addons for WPBakery Page Builder <= 3.9 - Authenticated (Contributor+) Stored Cross-Site Scripting
• Widgetize Pages Light <= 3.0 & Widgets as Shortcodes <= 5.9.10 - Reflected Cross-Site Scripting
• WP Statistics <= 14.16.8 - Unauthenticated Stored Cross-Site Scripting via 'utm_campaign' Parameter
• Livemesh Addons for WPBakery Page Builder <= 3.9.4 - Authenticated (Editor+) Stored Cross-Site Scripting
• Quick Restaurant Reservations <= 1.4.1 - Reflected Cross-Site Scripting
• TranslatePress <= 3.2.6 - Unauthenticated Stored Cross-Site Scripting via Comment Content
• Real Estate Manager Pro <= 12.8.5 - Reflected Cross-Site Scripting
• RSS Aggregator by Feedzy <= 4.1.0 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode
• Ajax Search Lite <= 4.13.1 - Missing Authorization to Unauthenticated Basic Information Exposure via ASL_Query in AJAX Search Handler
• Interactive Contact Form and Multi Step Form Builder with Drag & Drop Editor – Funnelforms Free <= 3.7.3.2 - Missing Authorization to Unauthenticated Arbitrary Media Upload
• JS & CSS Script Optimizer <= 0.3.3 - Cross-Site Request Forgery
• Virtue <= 3.4.8 - Authenticated (Contributor+) Stored Cross-Site Scripting via Post Author
• Echo RSS Feed Post Generator <= 5.4.8.1 - Reflected Cross-Site Scripting
• Buddybadges <= 1.0.0 - Authenticated (Administrator+) SQL Injection
• Video Gallery – Api Gallery, YouTube and Vimeo, Link Gallery <= 1.5.3 - Missing Authorization
• Appointment Booking Calendar <= 1.6.7.53 - Authenticated (Admin+) Stored Cross-Site Scripting via Appointment Settings
• E-cab Taxi Booking Manager for Woocommerce <= 2.0.1 - Missing Authorization
• Relevanssi <= 4.28.3 - Unauthenticated Stored Cross-Site Scripting via Comment Content
• Charitable <= 1.5.13 - Unauthorized Access to Information Disclosure
• WP Job Manager <= 2.0.0 - Cross-Site Request Forgery
• WP Hardening – Fix Your WordPress Security <= 1.2.6 - Unauthenticated Security Feature Bypass to Username Enumeration
• Authorize.net Add-on for iThemes Exchange < 1.1.0 - Reflected Cross-Site Scripting
• Happy Addons for Elementor <= 3.10.4 - Authenticated (Contributor+) DOM-Based Stored Cross-Site Scripting via title_tag
• Charitable – Donation & Fundraising Platform (Donation Forms, Recurring Donations & Fundraising Campaigns) <= 1.8.12.3 - Unauthenticated Stored Cross-Site Scripting
• OPEN-BRAIN <= 0.5.0 - Cross-Site Request Forgery
• Ninja Forms Google Sheet Connector <= 1.2.6 - Reflected Cross-Site Scripting
• Woocommerce Vietnam Checkout <= 2.0.4 - Reflected Cross-Site Scripting
• Easy GitHub Gist Shortcodes <= 1.0 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'id' Shortcode Attribute
• Greg's High Performance SEO <= 1.6.1 - Reflected Cross-Site Scripting
• SalesKing <= 1.6.15 - Missing Authorization to Settings Change
• Raychat <= 2.1.0 - Missing Authorization
• ST Gallery WP <= 1.0.8 - Missing Authorization to Authenticated (Subscriber+) Settings Update
• Category Featured Images Extended <= 1.52 - Authenticated (Author+) Stored Cross-Site Scripting
• myCred <= 2.9.4.3 - Authenticated (Subscriber+) Race Condition
• ARMember – Membership Plugin, Content Restriction, Member Levels, User Profile & User signup <= 3.4.7 -Authentication Bypass via Password Reset Weakness
• Newsletter Popup <= 1.2 - Unauthenticated Stored Cross-Site Scripting
• VideoWhisper Video Presentation <= 3.25 - Reflected Cross-Site Scripting
• Transcoder <= 1.3.5 - Cross-Site Request Forgery
• WordPress Core < 3.1.3 - Sensitive Information Disclosure
• WP e-Customers Beta <= 0.0.1 - Reflected Cross-Site Scripting
• EZ Form Calculator <= 2.14.0.3 - Reflected Cross-Site Scripting
• Latest Post Shortcode <= 14.0.3 - Authenticated (Contributor+) Stored Cross-Site Scripting
• WP-BlackCheck <= 2.7.2 - Cross-Site Request Forgery to Stored Cross-Site Scripting
• GamiPress – Gamification plugin to reward points, badges & ranks in WordPress, now with AI < 8.0.6 - Missing Authorization
• Wyzi - Social Directory WordPress Theme <= 2.4.2 - Reflected Cross-Site Scripting
• Custom Fonts – Host Your Fonts Locally <= 2.1.4 - Authenticated (Author+) Stored Cross-Site Scripting
• Contact Form <= 2.0.12 - Authenticated (Contributor+) Stored Cross-Site Scripting
• Prime Slider – Addons For Elementor (Revolution of a slider, Hero Slider, Ecommerce Slider) <= 3.16.5 - Authenticated (Contributor+) Stored Cross-Site Scripting
• Dropshipping and affiliates for Amazon and woocommerce <= 1.4.3 - Missing Authorization
• Document Embedder – let visitors read files without downloading <= 2.4.0 - Unauthenticated Stored Cross-Site Scripting
• BC Menu Bar Cart Icon For WooCommerce By Binary Carpenter <= 1.49.3 - Cross-Site Request Forgery
• Wonder PDF Embed <= 1.6 - Contributor+ Stored Cross-Site Scripting
• Quiz Maker <= 6.7.0.80 - Unauthenticated Sensitive Information Exposure
• Automated FedEx live/manual rates with shipping labels – HPOS supported <= 5.1.8 - Missing Authorization
• WebToffee Gift Cards for WooCommerce <= 1.3.0 - Unauthenticated Arbitrary Gift Card Price Manipulation
• Colibri WP <= 1.0.94 - Cross-Site Request Forgery to Limited Plugin Installation
• BEAF <= 4.5.4 - Cross-Site Request Forgery to Notice Dismissal
• Microsoft Advertising Universal Event Tracking (UET) <= 1.0.3 - Authenticated Stored Cross-Site Scripting
• Blog2Social <= 8.7.0 - Missing Authorization to Authenticated (Subscriber+) Arbitrary Post Trashing
• Welcart e-Commerce <= 2.12.1 - Unauthenticated Stored Cross-Site Scripting via 'custom_order' Parameter
• Link Library <= 5.8.10.6 - Reflected Cross-Site Scripting
• Link View <= 0.8.0 - Authenticated (Contributor+) Stored Cross-Site Scripting
• MultiVendorX <= 5.0.15 - Missing Authorization
• Frontend File Manager Plugin <= 23.4 - Insecure Direct Object Reference to Authenticated (Subscriber+) Arbitrary File Renaming
• RSS Aggregator – RSS Import, News Feeds, Feed to Post, and Autoblogging <= 5.0.10 - Authenticated (Contributor+) Stored Cross-Site Scripting via wp-rss-aggregator Shortcode
• Live updates from Excel <= 2.3.2 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode
• Avventure <= 1.1.12 - Unauthenticated Local File Inclusion
• Advanced Post List <= 0.5.6.2 - Cross-Site Request Forgery
• Admin and Site Enhancements (ASE) <= 8.0.8 - Missing Authorization
• Post Grid Gutenberg Blocks for News, Magazines, Blog Websites <= 5.0.31 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'moreResultsText' Block Attribute
• Alpine PhotoTile for Instagram < 1.2.7.6 - Reflected Cross-Site Scripting
• GiveWP <= 2.25.1 - Cross-Site Request Forgery via save
• Think Responsive <= 1.0 - Arbitrary File Upload
• Category and Taxonomy Meta Fields <= 1.0.0 - Authenticated (Editor+) Stored Cross-Site Scripting
• WP Data Access – No-Code App Builder with Tables, Forms, Charts & Maps <= 5.5.68 - Unauthenticated Insecure Direct Object Reference to Data Access
• YourChannel <= 1.2.5 - Authenticated (Administrator+) Stored Cross-Site Scripting
• HMS Testimonials < 2.0.11 - Cross-Site Scripting
• Avada (Fusion) Builder <= 3.15.2 - Unauthenticated Remote Code Execution via PHP Function Injection via 'render_logics' Shortcode Attribute via Widget AJAX Handler
• bxSlider integration for WordPress <= 1.7.2 - Authenticated (Contributor+) Stored Cross-Site Scripting
• CP Contact Form with PayPal <= 1.3.01 - Cross-Site Scripting
• WP Property <= 1.35.0 - Remote File Upload
• RapidLoad Power-Up for Autoptimize <= 1.7.1 - Cross-Site Request Forgery via 'ajax_deactivate'
• Askka <= 1.0 - Unauthenticated Local File Inclusion
• 3CX Live Chat <= 8.0.07 - Cross-Site Scripting
• affiliate-toolkit <= 3.4.5 - Authenticated (Author+) Stored Cross-Site Scripting via ratings
• SEO Backlink Monitor <= 1.6.0 - Cross-Site Request Forgery
• Subaccounts for WooCommerce <= 1.6.6 - Authenticated (Subscriber+) Privilege Escalation via Account Takeover
• Slider by 10Web <= 1.2.61 - Authenticated (Administrator+) Stored Cross-Site Scripting via Widget
• GMO Font Agent <= 1.6 - Authenticated (Contributor+) Stored Cross-Site Scripting
• WPQA - Builder forms Addon For WordPress < 5.7 - Information Disclosure
• Autoship Cloud for WooCommerce Subscription Products <= 2.8.0 - Authenticated (Contributor+) Stored Cross-Site Scripting
• Event Calendar <= 1.1.44 - Cross-Site Scripting
• Prider <= 1.1.3.1 - Unauthenticated Local File Inclusion
• Bootstrap Modals <= 1.3.2 - Authenticated (Contributor+) Stored Cross-Site Scripting
• JS Help Desk – AI-Powered Support & Ticketing System <= 3.1.0 - Unauthenticated Insecure Direct Object Reference
• Store Locator WordPress <= 1.6.2 - Authenticated (Contributor+) SQL Injection
• bbPress <= 2.6.4 - Unauthenticated Privilege Escalation
• Live Streaming Video Player – by SRS Player <= 1.0.18 - Authenticated (Contributor+) Stored Cross-Site Scripting
• TaxoPress <= 3.0.7.1 - Stored Cross-Site Scripting