Vulnerability archive: section 1, page 18

Open a report to review affected versions, available fixes and original sources. Each report covers a specific issue; its presence does not establish whether your website is affected.

• RegistrationMagic <= 5.1.9.2 - Cross-Site Request Forgery leading to Form Metadata Deletion
• Hydra Booking – All in One Appointment Booking System | Appointment Scheduling, Booking Calendar & WooCommerce Bookings <= 1.1.27 - Unauthenticated Arbitrary Booking Cancellation via Weak Hash Generation
• Forminator Forms <= 1.53.0 - Missing Authorization to Authenticated (Subscriber+) Scheduled Form Submission Export via forminator_export_entries Action on wp_loaded Hook
• DeepDigital <= 1.0.2 - Unauthenticated Arbitrary Shortcode Execution
• Broken Link Manager <= 0.6.5 - Authenticated (Admin+) SQL Injection
• Guten Free Options <= 0.9.5 - Reflected Cross-Site Scripting
• Paid Memberships Pro <= 2.9.11 - Authenticated (Subscriber+) SQL Injection via Shortcodes
• CSS Hero <= 4.0.3 - Reflected Cross-Site Scripting
• Hotel Booking Lite <= 4.6.0 - Cross-Site Request Forgery to Settings Update
• Portugal CTT Tracking for WooCommerce <= 2.1 - Reflected Cross-Site Scripting
• Cardealer <= 1.6.4 - Cross-Site Request Forgery to User Update via update_user_profile
• KKProgressbar2 Free <= 1.1.4.2 - Cross-Site Request Forgery to Stored Cross-Site Scripting
• Depot <= 1.16 - Unauthenticated Local File Inclusion
• mLanguage <= 1.6.1 - Cross-Site Request Forgery
• Acumbamail < 1.0.4.1 - Sensitive Information Disclosure
• Paymendo Bank Transfer <= 1.1 - Unauthenticated SQL Injection
• Essential Real Estate <= 5.2.0 - Unauthenticated Local File Inclusion
• Admin Menu Manager <= 1.0.3 - Cross-Site Request Forgery
• Popup Box – Create Countdown, Coupon, Video, Contact Form Popups <= 4.9.7 - Missing Authorization to Unauthenticated Limited Options Update
• Advanced Text Widget <= 2.1.2 - Authenticated (Administrator+) Stored Cross-Site Scripting
• XPinner Lite <= 2.2 - Cross-Site Scripting
• Responsive Lightbox <= 2.4.6 - Missing Authorization via Information Disclosure
• Enfold - Responsive Multi-Purpose Theme < 4.8.4 - Reflected Cross-Site Scripting
• Calculated Fields Form <= 5.5.1.3 - Reflected DOM-Based Cross-Site Scripting via 'x' URL Parameter via setChoices()
• Login With Ajax <= 3.1.6 - Cross-Site Scripting
• Redirect Redirection <= 1.1.3 - Cross-Site Request Forgery via 'addRedirectRule' function
• Migration, Backup, Staging – WPvivid <= 0.9.89 - Authenticated (Administrator+) Arbitrary Directory Deletion via Path Traversal
• School Management System <= 93.2.0 - Authenticated (Student+) Arbitrary File Upload
• WP Statistics <= 13.2.8 - Authenticated (Admin+) SQL Injection
• WP Shortcodes Plugin — Shortcodes Ultimate <= 5.13.3 - Insecure Direct Object Reference to Information Disclosure
• OOPSpam Anti-Spam: Spam Protection for WordPress Forms & Comments (No CAPTCHA) <= 1.2.62 - Unauthenticated Stored Cross-Site Scripting
• ListingPro - WordPress Directory & Listing Theme < 2.6.1 - Arbitrary Plugin Installation, Activation and Deactivation
• Contentboxes <= 1.1 - Reflected Cross-Site Scripting
• Tutor LMS 2.7.1 - 4.0.7 - REST API Authentication Confusion
• Toolset Types < 1.8.8 - Cross-Site Scripting
• WPShapere - WordPress admin theme <= 1.4.1 - Cross-Site Request Forgery
• Sunshine Photo Cart <= 3.2.1 - Missing Authorization
• my flatonica <= 0.0.8 & my wooden under construction <= 2.0.7 - Reflected Cross-Site Scripting
• iPOSpays Gateways WC <= 1.3.7 - Unauthenticated Missing Authorization to Settings Update via REST API Endpoint
• LS Google Map Router <= 1.1.0 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode Attributes
• Easy Accordion <= 3.1.6 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'align' Block Attribute
• InPost Gallery <= 2.1.4.3 - Cross-Site Request Forgery
• Chalet-Montagne.com Tools <= 2.7.8 - Reflected Cross-Site Scripting
• Carousel Slider <= 2.2.2 - Missing Authorization
• Super Store Finder <= 7.10 - Unauthenticated Stored Cross-Site Scripting
• Broadstreet <= 1.51.0 - Authenticated (Contributor+) Stored Cross-Site Scripting via zone Parameter
• weForms <= 1.6.28 - Unauthenticated Limited Media File Deletion via 'wpuf_files' Parameter
• Leyka <= 3.31.6 - Missing Authorization
• Blocksy <= 2.0.42 - Authenticated (Contributor+) Stored Cross-Site Scripting
• Olive One Click Demo Import <= 1.1.2 - Authenticated (Administrator+) Arbitrary File Upload in olive_one_click_demo_import_save_file
• Verification SMS with TargetSMS <= 1.5 - Unauthenticated Limited Remote Code Execution
• Advanced Form Integration – Connect WooCommerce and Contact Form 7 to Google Sheets and other platforms <= 1.82.0 - SQL Injection to Reflected Cross-Site Scripting via integration_id
• Site Offline <= 1.5.7 - Missing Authorization
• WP Opt-in <= 1.4.1 - Cross-Site Request Forgery to Settings Update
• Kadence Shop Kit <= 3.0.6 - Authenticated (Subscriber+) SQL Injection
• Sky Addons for Elementor <= 2.5.15 - Authenticated (Contributor+) Stored Cross-Site Scripting
• Meow Gallery (+ Gallery Block) <= 4.1.9 - Missing Authorization to Arbitrary Options Update
• ApplyOnline – Application Form Builder and Manager <= 2.5.5 - Authenticated (Administrator+) Stored Cross-Site Scripting
• Digihood HTML Sitemap <= 3.1.1 - Reflected Cross-Site Scripting
• Nelio Content <= 4.3.1 - Authenticated (Contributor+) Server-Side Request Forgery
• EasyAzon – Amazon Associates Affiliate Plugin <= 5.1.0 - Reflected Cross-Site Scripting via easyazon-cloaking-locale
• FluentBoards – Project Management, Task Management, Goal Tracking, Kanban Board, and, Team Collaboration <= 1.91.2 - Authenticated (Board Member+) Insecure Direct Object Reference
• Random Quotes <= 1.3 - Reflected Cross-Site Scripting
• Funnelforms Free <= 3.4 - Missing Authorization to Arbitrary Post Deletion
• WP Directory Kit <= 1.1.9 - Open Redirect
• Pinpoint Booking System <= 2.9.9.3.4 - Content Spoofing
• Devs CRM – Manage tasks, attendance and teams all together <= 1.1.8 - Unauthenticated Information Expsoure
• SexyBookmarks <= 6.1.4.0 - Cross-Site Request Forgery
• ProfileGrid - User Profiles, Groups and Communities <= 5.9.9.5 - Unauthenticated Privilege Escalation via Email Overwrite
• Contact Form 7 Star Rating <= 1.10 - Authenticated (Editor+) Stored Cross-Site Scripting
• Uncanny Automator Pro < 5.3.0.1 - Cross-Site Request Forgery to License Setting Reset
• Business One Page <= 1.3.2 - Missing Authorization
• WooCommerce Amazon Affiliates < 9.0.2.16 - Unauthenticated Arbitrary File Upload
• LearnDash LMS 4.25.0 - 5.1.6 - Unauthenticated Arbitrary Course Enrollment via REST Endpoint
• Popup Cart Lite for WooCommerce <= 1.1 - Cross-Site Request Forgery
• WP Courses LMS <= 3.2.29 - Insecure Direct Object Reference to Authenticated (Custom+) Sensitive Information Disclosure via 'resultID' Parameter
• Media Library Folders <= 8.1.8 - Authenticated (Author+) Directory Traversal
• MStore API <= 3.1.9 - Authentication Bypass
• User Registration & Membership <= 5.2.0 - Missing Authorization to Unauthenticated Payment Bypass
• uListing <= 1.6.6 - Unauthenticated Arbitrary Account Creation
• Awesome Filterable Portfolio <= 1.9.7 - Unauthenticated Stored Cross-Site Scripting
• ProfileGrid <= 5.9.9.6 - Missing Authorization
• Listdom: AI-powered Business Directory with Classifieds Ads Listings <= 5.4.0 - Unauthenticated SQL Injection
• Bricksable for Bricks Builder <= 1.6.59 - Authenticated (Administrator+) Stored Cross-Site Scripting
• Add Subtitle <= 1.1.0 - Authenticated (Contributor+) Stored Cross-Site Scripting
• JS Job Manager <= 2.0.0 - Authenticated (Subscriber+) Stored Cross-Site Scripting via title
• Abstracts <= 2.7.4 - Unauthenticated Local File Inclusion
• Contact Form Generator <= 2.7.1 - Authenticated (Contributor+) SQL Injection
• Select Core < 2.6 - Authenticated (Contributor+) Stored Cross-Site Scripting
• Woocommerce Products Price Bulk Edit <= 2.0 - Cross-Site Scripting via show_products_page_limit parameter
• Listamester <= 2.3.6 - Cross-Site Request Forgery
• FunnelCockpit <= 1.4.3 - Reflected Cross-Site Scripting
• GBI To Print <= 1.0 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'div' Shortcode Attribute
• SMS Contact Form 7 Notifications by ClickSend <= 1.4.0 - Missing Authorization
• S3 Bubble Amazon S3 HTML5 Video with Adverts <= 0.7 - Directory Traversal to Arbitrary File Access
• KiviCare – Clinic & Patient Management System (EHR) <= 3.6.7 - Authenticated (Doctor+) SQL Injection via 'u_id' Parameter
• Hippoo Mobile App for WooCommerce <= 1.12.0 - Reflected Cross-Site Scripting via 'token_id' Parameter
• PowerPress Podcasting plugin by Blubrry <= 11.9.10 - Authenticated (Contributor+) Stored Cross-Site Scripting via media_url Parameter
• Appointy Appointment Scheduler <= 4.2.1 - Cross-Site Request Forgery to Settings Change
• Simple Download Monitor < 3.5.4 - Authenticated Stored Cross-Site Scripting