Vulnerability archive: section 1, page 2

Open a report to review affected versions, available fixes and original sources. Each report covers a specific issue; its presence does not establish whether your website is affected.

• Visual Website Collaboration, Feedback & Project Management – Atarim <= 4.0.9 - Missing Authorization to Authenticated (Subscriber+) Project Page/File Deletion
• WP Attachments <= 5.0.5 - Authenticated (Administrator+) Stored Cross-Site Scripting
• WP User Stylesheet Switcher <= v2.2.0 - Cross-Site Request Forgery to Stored Cross-Site Scripting
• Podigee <= 1.4.0 - Unauthenticated Sever-Side Request Forgery
• Quasar form <= 6.1 - Authenticated (Subscriber+) SQL Injection via 'id'
• Form Builder | Create Responsive Contact Forms <= 1.9.8.4 - Cross-Site Scripting
• RealHomes Memberships <= 3.0.9 - Missing Authorization to Authenticated (Subscriber+) Membership Payment Bypass via 'ims_add_paypal_recurring_membership' AJAX Action
• Bulk Watermark <= 1.6.10 - Cross-Site Request Forgery
• Booster for WooCommerce <= 7.1.7 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortocde
• Favicon <= 1.3.29 - Cross-Site Request Forgery to Notice Dismissal
• The Ultimate WordPress Toolkit – WP Extended <= 3.0.8 - Reflected Cross-Site Scripting via page
• Floating Chat Widget - Chaty <= 3.1.1 - Authenticated (Administrator+) Stored Cross-Site Scripting
• Colibri Page Builder <= 1.0.253 - Cross-Site Request Fogery via cp_shortcode_refresh
• Razorpay Payment Button for Elementor <= 1.2.5 - Reflected Cross-Site Scripting
• Morkva UA Shipping <= 1.0.18 - Unauthenticated Local File Inclusion
• PDF Invoices & Packing Slips for WooCommerce <= 5.14.0 - Insecure Direct Object Reference to Authenticated (Contributor+) Sensitive Information Disclosure via 'order_id' Shortcode Attribute
• Lindo <= 1.2.5 - Unauthenticated Local File Inclusion
• Migration, Backup, Staging – WPvivid <= 0.9.75 - Authenticated (Administrator+) Path Traversal
• Astra Pro Addon <= 3.5.1 - Unauthenticated SQL Injection
• Email Customizer for WooCommerce (Pro) <= 3.9.5 - Authenticated (Subscriber+) Remote Code Execution via 'template' Parameter
• Frontend Admin by DynamiApps <= 3.28.36 - Unauthenticated Privilege Escalation via Edit User Form
• FireStorm Professional Real Estate <= 2.7.11 - Authenticated (Administrator+) SQL Injection
• CubeWP Framework <= 1.1.30 - Authenticated (Subscriber+) SQL Injection via 'relation_id' Parameter
• Multiple Plugins <= (Various Versions) - Authenticated (Contributor+) Stored DOM-Based Cross-Site Scripting via SimpleLightbox JavaScript Library
• Custom post type templates for Elementor <= 1.10.1 - Authenticated (Contributor+) Stored Cross-Site Scripting
• CoDesigner WooCommerce Builder for Elementor <= 4.21 - Authenticated (Author+) Stored Cross-Site Scripting
• Wishlist for WooCommerce <= 1.1.3 - Insecure Direct Object Reference to Unauthenticated Wishlist Manipulation
• Recall Products <= 0.8 - Authenticated SQL Injection
• WP Compress – Image Optimizer <= 6.11.08 - Missing Authorization to Unauthenticated CDN Modification
• WooCommerce < 6.3.1 - Unauthorized Order Status Change
• ENL Newsletter <= 1.0.1 - Authenticated (Admin+) SQL Injection
• Feed Them Social – for Twitter feed, Youtube and more <= 2.9.9 - Authenticated (Subscriber+) Stored Cross-Site Scripting
• Eventin – Event Calendar, Tickets, Registration, Booking & WooCommerce < 4.1.22 - Missing Authorization
• Leyka <= 3.31.8 - Authenticated (Contributor+) Stored Cross-Site Scripting
• WP-CORS <= 0.2.1 - Authenticated (Administrator+) Stored Cross-Site Scripting
• WP VK-付费内容插件 <= 1.3.3 - Cross-Site Request Forgery via AJAX actions
• JobSearch WP Job Board <= 1.5.5 - Reflected Cross-Site Scripting
• Social Feed <= 1.5.4.6 - Authenticated (Author+) Stored Cross-Site Scripting via Shortcode
• UsersWP <= 1.2.15 - Missing Authorization
• Podlove Podcast Publisher <= 4.2.0 - Authenticated (Admin+) Stored Cross-Site Scripting
• Builder for Contact Form 7 by Webconstruct <= 1.2.2 - Cross-Site Request Forgery
• Mail Queue <= 1.1 - Unauthenticated Stored Cross-Site Scripting via Email Subject
• Inline Google Spreadsheet Viewer <= 0.9.6 - Cross-Site Request Forgery
• Ezoic <= 2.23.0 - Missing Authorization
• Live Copy Paste for Elementor – Cross Domain Copy Paste & Page Duplicator <= 1.5.6 - Missing Authorization
• NEX-Forms – Ultimate Form Builder – Contact forms and much more <= 8.8.1 - Unauthenticated Sensitive Information Exposure
• Pz-LinkCard <= 2.5.2 - Authenticated (Administrator+) Stored Cross-Site Scripting
• WordPress Core < 4.5 - Server-Side Request Forgery
• Drag and Drop Multiple File Upload – Contact Form 7 <= 1.3.6.4 - File Upload Size Limit Bypass
• Selar.co Widget <= 1.2 - Authenticated (Contributor+) Stored Cross-Site Scripting
• Booking for Appointments and Events Calendar – Amelia < 2.4.7 - Missing Authorization
• Ultimate Member <= 2.6.0 - Cross-Site Request Forgery to Form Duplication
• All in One SEO <= 5.0.2.0 - Unauthenticated Arbitrary Shortcode Execution
• Popup More <= 2.2.4 - Authenticated (Admin+) Directory Traversal to Limited Local File Inclusion
• WPB Elementor Addons <= 1.0.9 - Authenticated (Contributor+) Stored Cross-Site Scripting
• FooBox Image Lightbox <= 2.7.33 - Authenticated (Author+) Stored Cross-Site Scripting
• RSS Aggregator by Feedzy <= 3.4.2 - Cross-Site Request Forgery Bypass
• WPCafe <= 3.0.18 - Authenticated (Contributor+) Local File Inclusion via 'food_menu_style' Elementor Widget Setting
• WordPress Gallery Plugin – NextGEN Gallery <= 3.59 - Missing Authorization to Unauthenticated Information Disclosure
• Search Unleashed <= 0.2.10 - Cross-Site Scripting
• Vivagh <= 2.4 - Authenticated (Subscriber+) PHP Object Injection
• MetForm Pro <= 3.9.7 - Unauthenticated Payment Amount Manipulation via 'mf-calculation'
• WP Reset – Most Advanced WordPress Reset Tool (PRO) 5.00- 5.98 - Missing Authorization to Database Reset
• Autoptimize <= 2.7.7 - Race Condition leading to Remote Code Execution
• Gutenberge Blocks <= 2.1.8 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcodes
• WooCommerce Placetopay Gateway <= 3.2.2 - Reflected Cross-Site Scripting via 'redirect-url'
• Bulk Auto Image Title Attribute <= 2.0.2 - Authenticated (Contributor+) Stored Cross-Site Scripting
• Category Post Slider <= 1.4 - Authenticated (Contributor+) Stored Cross-Site Scripting
• Two Factor Authentication (2FA , MFA, OTP SMS and Email) <= 1.0.7 - Cross-Site Scripting
• AddFunc Mobile Detect <= 3.1 - Authenticated (Contributor+) Stored Cross-Site Scripting
• Noo JobMonster <= 4.8.5 - Reflected Cross-Site Scripting
• WPCS <= 1.2.0.1 - Cross-Site Request Forgery
• MediCenter - Health Medical Clinic WordPress Theme <= 14.9 - Reflected Cross-Site Scripting
• Ultimate Addons for Beaver Builder - Lite <= 1.5.5 - Authenticated (Subscriber+) Settings Change
• Call To Action Plugin <= 3.1.3 - Cross-Site Request Forgery via Settings Update
• Kings & Queens <= 1.1.16 - Unauthenticated Local File Inclusion
• WooCommerce POS <= 1.4.11 - Insufficient Verification of Data Authenticity to Authenticated (Customer+) Information Disclosure
• click5 CRM add-on to WPForms <= 1.0.3 - Missing Authorization
• Quill Forms <= 3.7.0 - Authenticated (Contributor+) Stored Cross-Site Scripting
• WP Responsive Images <= 1.0 - Unauthenticated Path Traversal to Arbitrary File Read via src
• Sidebar Widgets by CodeLights <= 1.4 - Authenticated (Administrator+) Stored Cross-Site Scripting
• Sidebar Widgets by CodeLights <= 1.4 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode
• Related Posts for WordPress < 1.8.2 - Reflected Cross-Site Scripting
• Essential Addons for Elementor – Best Elementor Templates, Widgets, Kits & WooCommerce Builders <= 5.9.8 - Authenticated (Contributor+) Stored Cross-Site Scripting
• WP Retina 2x <= 6.4.5 - Sensitive Information Exposure
• Discy <= 5.1 - Cross-Site Request Forgery to Settings Update
• One-Login <= 1.4 - Unauthenticated Privilege Esclation
• WBW Currency Switcher for WooCommerce <= 2.2.5 - Missing Authorization
• Address Bar Ads <= 1.0.0 - Reflected Cross-Site Scripting
• Post Grid and Gutenberg Blocks <= 2.3.23 - Authenticated (Contributor+) Stored Cross-Site Scripting
• WPC Product Bundles for WooCommerce <= 8.5.3 - Missing Authorization
• Mail Mint <= 1.24.1 - Authenticated (Administrator+) SQL Injection via 'recipients' Parameter
• ServerBuddy by PluginBuddy.com <= 1.0.5 - Cross-Site Request Forgery to PHP Object Injection
• Translate WordPress with GTranslate <= 2.8.10 - Open Redirect
• Processing Projects <= 1.0.2 - Authenticated (Shop Manager+) Arbitrary File Upload
• Hustle <= 7.8.3 - Sensitive Information Exposure via Exposed Hubspot API Keys
• Section Widget <= 3.3.1 - Reflected Cross-Site Scripting
• Download Plugin < 1.6.1 - Cross-Site Request Forgery
• Elite Video Player <= 10.0.5 - Reflected Cross-Site Scripting
• Real Estate Manager – Property Listing and Agent Management <= 7.3 - CAPTCHA Bypass