Vulnerability archive: section 1, page 20

Open a report to review affected versions, available fixes and original sources. Each report covers a specific issue; its presence does not establish whether your website is affected.

• Avada Custom Branding <= 1.2 - Missing Authorization
• AdFoxly – Ad Manager, AdSense Ads & Ads.txt <= 1.8.5 - Cross-Site Request Forgery
• QR Redirector <= 2.0.5 - Authenticated (Contributor+) Stored Cross-Site Scripting
• Portfolio Plugin < 1.05 - Cross-Site Request Forgery
• GiftXtore <= 1.7.5 - Unauthenticated Local File Inclusion
• WP Accessibility <= 2.3.1 - Authenticated (Contributor+) Stored DOM-Based Cross-Site Scripting via 'alt' Attribute
• Target Video Easy Publish <= 3.8.8 - Authenticated (Contributor+) Stored Cross-Site Scripting via placeholder_img Parameter
• Mighty Addons for Elementor <= 1.9.3 - Reflected Cross-Site Scripting
• Slideshow 2.2.8 - 2.2.21 - Information Exposure
• Zephyr Project Manager <= 3.3.102 - Missing Authorization to Authenticated (Subscriber+) Status Updates
• Jetpack CRM <= 5.4.2 - Authenticated (Administrator+) Cross-Site Scripting
• Tribute Testimonials – WordPress Testimonial Grid/Slider <= 1.0.4 - Authenticated (Contributor+) Stored Cross-Site Scripting
• PDF for Elementor Forms + Drag And Drop Template Builder <= 5.5.1 - Missing Authorization
• EKC Tournament Manager <= 2.2.1 - Cross-Site Request Forgery to Tournament and Team Creation
• Tutor LMS – eLearning and online course solution <= 2.7.0 - Authenticated (Instructor+) Insecure Direct Object Reference to Arbitrary Course Deletion
• NextMove Lite <= 2.17.0 - Missing Authorization to Authenticated(Subscriber+) Plugin Activation
• SurveyJS: Drag & Drop WordPress Form Builder <= 1.12.20 - Cross-Site Request Forgery to Survey Deletion
• WP Super Edit <= 2.5.4 - Unauthenticated Arbitrary File Upload
• JetReviews <= 3.1.2 - Authenticated (Subscriber+) Stored Cross-Site Scripting
• Replyable – Subscribe to Comments and Reply by Email <= 2.2.9 - Authenticated (Subscriber+) PHP Object Injection via prompt_dismiss_notice
• Autoship Cloud for WooCommerce Subscription Products <= 2.8.0.1 - Authenticated (Contributor+) Stored Cross-Site Scripting
• Job Board by BestWebSoft < 1.1.4 - Reflected Cross-Site Scripting
• Latest Post Accordian Slider <= 1.3 - Cross-Site Request Forgery to Stored Cross-Site Scripting
• Frontend Dashboard <= 2.2.4 - Authenticated (Subscriber+) Arbitrary Function Call
• ChatBot <= 4.2.8 - Cross-Site Request Forgery to Stored Cross-Site Scripting and Settings Reset
• Connections Business Directory <= 9.6 - Authenticated CSV Injection
• Loggedin – Limit Active Logins <= 1.3.1 - Reflected Cross-Site Scripting
• IFrame Shortcode <= 1.0.5 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode
• WOLF <= 1.0.8.3 - Authenticated (Editor+) CSV Path Traversal
• PowerPress Podcasting <= 11.13.12 - Cross-Site Request Forgery
• WP Masonry & Infinite Scroll <= 2.2 - Authenticated (Contributor+) Stored Cross-Site Scripting
• Heateor Social Login <= 1.1.30 - Authenticated(Contributor+) Stored Cross-Site Scripting via Shortcode
• WP Database Backup < 3.4 - Authenticated Stored Cross-Site Scripting
• HEL Online Classroom: AI-powered Online Classrooms <= 1.0.3 - Missing Authorization to Unauthenticated Settings Update
• Better Click To Tweet <= 5.10.1 - Reflected Cross-Site Scripting
• Read more By Adam <= 1.1.8 - Missing Authorization to Authenticated (Subscriber+) Read More Button Deletion
• Linux Promotional Plugin <= 1.4 - Cross-Site Request Forgery to Stored Cross-Site Scripting
• Bigmart Elements <= 1.0.3 - Authenticated (Contributor+) Stored Cross-Site Scripting
• Amazon Einzeltitellinks <= 1.3.3 - Cross-Site Request Forgery to Arbitrary Settings Update
• tagDiv Composer <= 5.4.2 - Authenticated (Contributor+) Stored Cross-Site Scripting
• NEX-Forms – Ultimate Form Builder – Contact forms and much more <= 8.5.6 - Missing Authorization via set_read()
• Custom Content Shortcode <= 3.8.8 - Unauthorised Arbitrary Post Metadata Access
• NextMove Lite <= 2.23.0 - Unauthenticated Insecure Direct Object Reference
• BuddyBoss Platform <= 2.8.50 - Authenticated (Subscriber+) Stored Cross-Site Scripting via 'bp_nouveau_ajax_media_save' function
• Image Hover Effects Ultimate <= 9.7.0 - Reflected Cross-Site Scripting via effects
• Style Kits <= 2.6.5 - Missing Authorization
• YourChannel <= 1.2.3 - Missing Authorization to Plugin Cache Reset
• Fabius - One Page Resume WordPress Theme <= 1.0 - Unauthenticated Local File Inclusion
• eBay Dropshipping and Affiliate by Wooshark <= 1.5.6 - Unprotected AJAX Actions
• Podlove Podcast Publisher <= 4.0.11 - Missing Authorization to Settings Import
• BookingPress Pro <= 5.6 - Unauthenticated Arbitrary File Upload via Signature Custom Field
• NewsPlus Shortcodes <= 4.2.0 - Authenticated (Contributor+) Local File Inclusion
• YouSayToo auto-publishing plugin <= 1.0 - Cross-Site Scripting
• Wired Impact Volunteer Management <= 2.8.1 - Missing Authorization
• Migration, Backup, Staging – WPvivid <= 0.9.105 - Sensitive Information Exposure
• Advanced Category and Custom Taxonomy Image <= 1.0.9 - Authenticated (Contributor+) Stored Cross-Site Scripting via ad_tax_image Shortcode
• Event Espresso 4 Decaf <= 4.10.11 - Cross-Site Request Forgery Bypass
• ColorWay <= 3.4.1 - Cross-Site Scripting
• Simple Trackback Disabler <= 1.4 - Cross-Site Request Forgery
• affiliate-toolkit – WordPress Affiliate Plugin <= 3.3.9 - Open Redirect via atkpout.php
• WebHotelier <= 1.9.2 - Authenticated (Contributor+) Stored Cross-Site Scripting
• SendPress Newsletters <= 1.23.11.6 - Missing Authorization
• Carousel Slider <= 2.2.3 - Cross-Site Request Forgery
• Happy Addons for Elementor <= 3.10.1 - Authenticated (Contributor+) Stored Cross-Site Scripting
• SupportCandy <= 3.5.3 - Authenticated (Custom+) SQL Injection via 'sort_by' Parameter
• Newsletter <= 8.8.4 - Authenticated (Administrator+) Stored Cross-Site Scripting
• Quiz and Survey Master (QSM) – Quiz Maker & Survey Maker <= 11.2.7 - Authenticated (Contributor+) Stored Cross-Site Scripting
• YOP Poll <= 6.5.37 - Unauthenticated Stored Cross-Site Scripting
• Digits: WordPress Mobile Number Signup and Login <= 9.1.0.5 - Authenticated (Subscriber+) Privilege Escalation via 'digits_reg_userrole' Parameter
• Gutenberg Blocks, Page Builder – ComboBlocks <= 2.2.87 - Authenticated (Contributor+) Stored Cross-Site Scripting via Accordion Block
• Fuse Social Floating Sidebar <= 5.4.10 - Authenticated (Author+) Stored Cross-Site Scripting via File Upload
• WP Compress <= 6.30.15 - Unauthenticated Server-Side Request Forgery via init Function
• Newspack <= 3.8.6 - Missing Authorization
• WPCOM Member <= 1.7.14 - Authenticated (Contributor+) Local File Inclusion via Shortcode
• Aimogen Pro - All-in-One AI Content Writer, Editor, ChatBot & Automation Toolkit <= 2.8.4 - Unauthenticated Privilege Escalation via 'aiomatic_call_google_ai_function'
• JetGridBuilder <= 1.1.2 - Authenticated (Contributor+) Local File Inclusion
• Directorist – WordPress Business Directory Plugin with Classified Ads Listings <= 7.2.3 - Missing Authorization
• Wise Chat <= 3.4.3 - Missing Authorization
• Easy Cart <= 1.8 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode Attributes
• CBX Bookmark & Favorite <= 1.7.13 - Authenticated (Contributor+) Stored Cross-Site Scripting
• Kadence Blocks <= 3.2.53 - Authenticated (Admin+) Stored Cross-Site Scripting
• Uncode Core <= 2.8.8 - Privilege Escalation
• GlobalPayments WooCommerce <= 1.13.2 - Reflected Cross-Site Scripting
• JetBlocks <= 1.3.12 - Authenticated (Contributor+) Stored Cross-Site Scripting
• Content Mask <= 1.8.4 - Authenticated (Subscriber+) Arbitrary Options Update
• Emmet <= 0.3.4 - Authenticated (Administrator+) Stored Cross-Site Scripting
• Categorify <= 1.0.7.4 - Cross-Site Request Forgery via categorifyAjaxUpdateFolderPosition
• Smart Slider 3 <= 3.5.0.8 - Authenticated Stored Cross-Site Scripting
• Surbma | Yoast SEO Breadcrumb Shortcode <= 1.2 - Authenticated (Contributor+) Stored Cross-Site Scripting
• Elfsight Testimonials Slider <= 1.0.1 - Missing Authorization
• Product Import Export for WooCommerce <= 2.5.0 - Directory Traversal to Authenticated (Administrator+) Limited Arbitrary File Deletion via admin_log_page Function
• MemberSpace <= 2.1.13 - Reflected Cross-Site Scripting
• VikBooking Hotel Booking Engine & PMS <= 1.8.2 - Missing Authorization
• WooCommerce – Payphone Gateway <= 3.2.0 - Reflected Cross-Site Scripting
• Buying Buddy IDX CRM <= 2.3.0 - Authenticated (Contributor+) Stored Cross-Site Scripting
• Metform Elementor Contact Form Builder <= 3.3.1 - Authenticated (Subscriber+) Information Disclosure via 'mf_payment_status' shortcode
• Icegram Email Subscribers & Newsletters Plugin for WordPress <= 4.5.0 - Cross-Site Request Forgery
• Video Gallery <= 1.0.10 - Reflected Cross-Site Scripting
• WP To Do <= 1.3.0 - Authenticated (Admin+) Stored Cross-Site Scripting via Settings
• [GWA] AutoResponder <= 2.7.4 - Cross-Site Request Forgery to Stored Cross-Site Scripting