Vulnerability archive: section 1, page 19

Open a report to review affected versions, available fixes and original sources. Each report covers a specific issue; its presence does not establish whether your website is affected.

• Product Filter by WooBeWoo <= 1.4.9 - Missing Authorization
• Dental Clinic <= 3.7 - Authenticated (Subscriber+) PHP Object Injection
• Ultimate Social Comments – Email Notification & Lazy Load <= 1.4.8 - Authenticated (Contributor+) Stored Cross-Site Scripting
• SEO Plugin LiveOptim <= 1.1.3 - Cross-Site Request Forgery
• AI ChatBot for WordPress – WPBot <= 6.2.3 - Authenticated (Admin+) Stored Cross-Site Scripting
• Gutenverse – Ultimate WordPress FSE Blocks Addons & Ecosystem <= 3.4.6 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'imageLoad'
• Bookshelf <= 2.0.4 - Cross-Site Scripting
• wordpress vertical image slider plugin <= 1.2.16 - Reflected Cross-Site Scripting
• Layer Slider <= 1.1.9.7 - Cross-Site Request Forgery via save_slide_ajax
• Element Pack Elementor Addons <= 8.3.13 - Cross-Site Request Forgery
• G Meta Keywords <= 1.4 - Authenticated (Contributor+) Stored Cross-Site Scripting
• Infusionsoft Gravity Forms Add-on 1.5.3 - 1.5.10 - Arbitrary File Upload
• Vex < 1.2.9 - Authenticated (Subscriber+) PHP Object Injection
• Kodex Posts likes <= 2.5.0 - Reflected Cross-Site Scripting
• Secure Invites <= 1.3 - Reflected Cross-Site Scripting
• Form Store to DB <= 1.1.0 - Stored Cross-Site Scripting
• wpForo Forum <= 2.0.5 - Cross-Site Request Forgery
• School Management System for Wordpress <= 92.0.0 - Authenticated (Subscriber+) SQL Injection via 'mj_smgt_show_event_task'
• Blue Wrench Video Widget < 2.0.0 - Cross-Site Request Forgery and to Cross-Site Scripting
• CM Table Of Contents <= 1.2.2 - Cross-Site Request Forgery
• WP-ViperGB <= 1.3.10 - Cross-Site Request Forgery to Cross-Site Scripting
• Ajax Custom CSS/JS <= 2.0.4 - Reflected Cross-Site Scripting
• Maspik <= 2.5.6 - Cross-Site Request Forgery
• Custom Twitter Feeds (Tweets Widget) <= 1.8.4 - Cross-Site Request Forgery
• Event Manager for WooCommerce <= 3.8.6 - Authenticated (Administrator+) Stored Cross-Site Scripting via 'mep_get_option' function
• Affiliate AI Lite <= 1.0.1 - Authenticated (Contributor+) Stored Cross-Site Scripting
• Easy Property Listings <= 3.5.3 - Cross-Site Request Forgery
• Essential Blocks <= 4.4.2 - Unauthenticated Local File Inclusion
• WP Compress – Image Optimizer [All-In-One] <= 6.10.33 - Unauthenticated Directory Traversal via css
• Responsive Starter Templates – Elementor & WordPress Templates <= 2.6.8 - Authenticated (Admin+) Stored Cross-Site Scripting
• JCH Optimize <= 3.2.2 - Authenticated (Administrator+) Stored Cross-Site Scripting via admin settings
• Newsletters, Email Marketing, SMS and Popups by Omnisend <= 1.9.0 - Authenticated (Subscriber+) Insecure Direct Object Reference
• Theme Editor <= 2.8 - Authenticated (Admin+) PHAR Deserialization
• LiteSpeed Cache <= 6.3.0.1 - Unauthenticated Privilege Escalation
• Enfold - Responsive Multi-Purpose Theme <= 7.1.4 - Reflected Cross-Site Scripting
• WP Affiliate Platform < 6.5.1 - Cross-Site Request Forgery to Profile Update
• MasterStudy LMS WordPress Plugin – for Online Courses and Education <= 3.7.42 - Unauthenticated Arbitrary File Deletion
• افزونه پیامک ووکامرس Persian WooCommerce SMS <= 4.4.0 - Cross-Site Scripting and SQL Injection
• Eagle Booking <= 1.3.4.3 - Authenticated (Subscriber+) SQL Injection
• Timeline Event History <= 3.2 - Reflected Cross-Site Scripting
• Business Template Blocks for WPBakery (Visual Composer) Page Builder <= 1.3.2 - Reflected Cross-Site Scripting
• HT Menu – WordPress Mega Menu Builder for Elementor < 1.2.7 - Authenticated (Subscriber+) Stored Cross-Site Scripting
• Easy Theme Options <= 1.0 - Missing Authorization to Authenticated (Subscriber+) Arbitrary Plugin Settings Import
• LearnPress <= 4.2.3 - Missing Authorization
• SpiderVPlayer <= 2.1 - Reflected Cross-Site Scripting
• Getwid – Gutenberg Blocks <= 2.0.10 - Missing Authentication to MailChimp API key update
• Import External Images <= 1.4 - Cross-Site Request Forgery via external_image_import_all_ajax
• MapGeo - Interactive Geo Maps <= 1.6.27 - Reflected Cross-Site Scripting via 'map' Parameter
• Aesop Story Engine <= 2.3.2 - Authenticated (Contributor+) Stored Cross-Site Scripting
• Simple Download Counter <= 2.3 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'text' Shortcode Attribute
• Spider Analyser – WordPress搜索引擎蜘蛛分析插件 <= 2.1.3 - Unauthenticated Remote Code Execution
• Kirki <= 6.0.14 - Insecure Direct Object Reference to Unauthenticated Sensitive Information Disclosure via 'context' Parameter
• Inactive Logout <= 3.2.2 - Missing Authorization
• AWP Classifieds <= 4.4.8 - Authenticated (Administrator+) Arbitrary File Upload
• Mailrelay <= 2.1.1 - Cross-Site Request Forgery via render_admin_page
• Social Sharing Plugin – Sassy Social Share <= 3.3.79 - Unauthenticated Stored Cross-Site Scripting
• WPCS – WordPress Currency Switcher Professional <= 1.3.2 - Unauthenticated Stored Cross-Site Scripting
• ActivityPub <= 0.17.0 - Authenticated (Subscriber+) Insecure Direct Object Reference to Sensitive Post Title Exposure
• WP SEO Structured Data Schema <= 2.7.11 - Authenticated (Contributor+) Stored Cross-Site Scripting via Plugin Settings
• Slimstat Analytics <= 3.5.5 - Stored Cross-Site Scripting
• Tutor LMS <= 4.0.7 - Authenticated (Subscriber+) PHP Object Injection to Remote Code Execution
• Simple:Press <= 6.8 - Authenticated (Subscriber+) Path Traversal to Arbitrary File Deletion
• Embed Chessboard <= 3.07.00 - Authenticated (Contributor+) Stored Cross-Site Scripting
• Cookies by JM <= 1.0 - Authenticated (Administrator+) Stored Cross-Site Scripting
• ReactPress – Create React App for WordPress <= 3.4.0 - Missing Authorization
• WP-PostRatings <= 1.91 - IP Spoofing
• Google XML Sitemap for Videos <= 2.6.1 - Cross-Site Request Forgery via video_sitemap_generate
• WP Symposium <= 14.11 - Arbitrary File Upload
• Nextend Social Login Pro <= 3.1.16 - Authentication Bypass via Apple OAuth provider
• Spam protection, AntiSpam, FireWall by CleanTalk <= 6.20 - Cross-Site Request Forgery via apbct_settings__update_account_email
• LoginPress <= 1.1.15 - Authenticated SQL Injection via Settings Import
• WordPress Membership, User Registration, Login Form, User Profile & Restrict Content Plugin – ProfilePress <= 3.2.15 - Reflected Cross-Site Scripting
• Depicter Slider <= 3.0.2 - Authenticated (Editor+) Stored Cross-Site Scripting
• Forums < 1.4.4 - Directory Traversal
• Payment Gateways Caller for WP e-Commerce < 0.1.1 - Local File Inclusion
• Welcart e-Commerce <= 2.9.5 - Authenticated (Administrator+) PHP Object Injection
• Download Panel <= 1.3.3 - Missing Authorization to Authenticated (Subscriber+) Arbitrary Plugin Settings Modification
• LatePoint – Calendar Booking Plugin for Appointments and Events <= 5.2.5 - Cross-Site Request Forgery
• ProfilePress <= 4.14.4 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode
• Breadcrumbs by menu <= 1.0.1 - Cross-Site Request Forgery
• Ad Inserter – Ad Manager & AdSense Ads < 1.5.3 - Cross-Site Request Forgery to Cross-Site Scripting
• Ninja Forms Contact Form <= 2.9.55.1 - Authenticated SQL Injection
• Small Package Quotes – UPS Edition <= 4.5.16 - Unauthenticated SQL Injection
• Internal Link Optimiser <= 5.1.3 - Cross-Site Request Forgery to Stored Cross-Site Scripting
• Geo to Lat <= 1.0.19 - Authenticated (Contributor+) SQL Injection
• 140+ Widgets | Xpro Addons For Elementor – FREE <= 1.4.6.7 - Authenticated (Contributor+) Stored Cross-Site Scripting
• Everest Forms <= 3.4.1 - Unauthenticated Arbitrary Shortcode Execution
• WP Statistics – The Most Popular Privacy-Friendly Analytics Plugin <= 14.13.3 - Missing Authorization to Authenticated (Subscriber+) Arbitrary Plugin Settings Update
• Add Google +1 (Plus one) social share Button <= 1.0.0 - Cross-Site Request Forgery to Stored Cross-Site Scripting
• Custom Field For WP Job Manager <= 1.1 - Authenticated (Administrator+) Stored Cross-Site Scripting
• HivePress <= 1.7.31 - Unauthenticated Stored Cross-Site Scripting via Custom User Attribute Value via Registration Form
• Product Filter by WBW <= 2.5.0 - Missing Authorization via getListForTbl
• Robo Gallery <= 3.2.18 - Unauthenticated Information Exposure
• MyBookTable Bookstore <= 3.4.0 - Cross-Site Request Forgery
• Wishlist <= 2.1.0 - Missing Authorization
• WP Editor < 1.2.6 - Incorrect Permission Assignment or Protection
• Lottie Player <= 1.1.8 - Authenticated (Author+) Stored Cross-Site Scripting via File Upload
• Headless SSO Plugin for WP <= 1.7.0 - Unauthenticated Arbitrary Account Takeover
• Qi Blocks <= 1.2.9 - Authenticated (Author+) Stored Cross-Site Scripting
• affiliate-toolkit <= 3.4.2 - Unauthenticated Server-Side Request Forgery