Vulnerability archive: section 1, page 23

Open a report to review affected versions, available fixes and original sources. Each report covers a specific issue; its presence does not establish whether your website is affected.

• Text Selection Color <= 1.6 - Authenticated (Administrator+) Stored Cross-Site Scripting
• TrustProfile <= 3.24 - Cross-Site Request Forgery
• Woocommerce Blocks – Woolook <= 1.7.0 - Authenticated (Admin+) Local File Inclusion
• Ezoic <= 2.22.11 - Authentication Bypass
• WooCommerce Menu Cart <= 2.11.0 - Reflected Cross-Site Scripting
• Conversador <= 2.61 - Reflected Cross-Site Scripting
• Related Posts by Zemanta <= 1.3.1 - Cross-Site Request Forgery
• The Plus Addons for Elementor Page Builder Lite <= 5.6.14 - Authenticated (Contributor+) Stored Cross-Site Scripting
• Exclusive Addons Elementor <= 2.8.0 - Unauthenticated Information Exposure
• Embed Google Photos album <= 2.1.9 - Authenticated (Contributor+) Server-Side Request Forgery
• Request a Quote <= 2.5.3 - Missing Authorization
• tagDiv Opt-In Builder <= 1.4.4 - Authenticated (Admin+) SQL Injection
• Download Manager <= 2.5.8 - Cross-Site Scripting
• Article Directory <= 1.3 - Authenticated (Administrator+) Stored Cross-Site Scripting via 'publish_terms_text'
• Urna <= 2.5.12 - Unauthenticated Local File Inclusion
• WordPress Core < 4.9.1 - Authenticated Stored Cross-Site Scripting
• tagDiv Composer <= 5.0 - Reflected Cross-Site Scripting via envato_code[]
• Google Drive upload and download link <= 1.0 - Authenticated (Contributor+) Stored Cross-Site Scripting
• Ni Sales Commission For WooCommerce <= 1.2.4 - Missing Authorization to Authenticated (Subscriber+) Commission Update
• WordPress Core < 4.7.1 - Authorization Bypass
• Participants Database <= 2.7.8.4 - Unauthenticated Arbitrary File Deletion
• QuickCal <= 1.0.15 - Authenticated (Subscriber+) Sensitive Information Exposure
• NACC WordPress Plugin <= 4.1.0 - Authenticated (Contributor+) Stored Cross-Site Scripting
• Database Backup and check Tables Automated With Scheduler 2024 <= 2.36 - Authenticated (Administrator+) Arbitrary File Deletion
• Simple Crypto Shortcodes <= 1.0.2 - Cross-Site Request Forgery to Plugin Settings Update
• Faktur Pro for WooCommerce <= 3.2.2 - Authenticated (Customer+) Insecure Direct Object Reference
• Stock Manager for WooCommerce < 3.6.0 - Cross-Site Request Forgery
• Plain Post <= 1.0.3 - Authenticated (Subscriber+) Stored Cross-Site Scripting
• NEX-Forms <= 9.2.2 - Missing Authorization to Unauthenticated Arbitrary Form Entry Modification via nf_send_nf_email AJAX Action
• CGC Maintenance Mode <= 1.2 - IP Spoofing
• Xpro Addons <= 1.5.1 - Missing Authorization to Authenticated (Subscriber+) Arbitrary Post Creation via get_menu_content_editor() Function
• Social Sharing (by Danny) <= 1.3.7 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode
• Premium Packages <= 7.0.4 - Authenticated (Admin+) SQL Injection via 'orderby' Parameter
• Kirki – Freeform Page Builder, Website Builder & Customizer < 6.2.1 - Unauthenticated Remote Code Execution
• Custom Menu <= 1.3.3 - Reflected Cross-Site Scripting
• Traveler – Travel Booking WordPress Theme < 2.7.8.6 - Cross-Site Scripting
• Booking Calendar and Notification <= 4.0.3 - Missing Authorization via wpcb_all_bookings, wpcb_update_booking_post, and wpcb_delete_posts Functions
• ImageMeta <= 1.1.2 - Reflected Cross-Site Scripting
• Social Auto Poster <= 5.3.14 - Authenticated (Contributor+) Arbitrary File Upload
• Prevent files / folders access <= 2.6.0 - Authenticated (Subscriber+) Path Traversal
• WP Wand – Unlimited Content Generation using AI – for OpenAI, Claude, Openrouter and Deepseek <= 1.3.07 - Missing Authorization
• Widgets Reset <= 0.1 - Cross-Site Request Forgery to Settings Update
• Transposh WordPress Translation <= 1.0.9.1 - Cross-Site Request Forgery
• Survey Maker <= 5.1.3.5 - Authenticated (Administrator+) Stored Cross-Site Scripting
• Drone Media | Aerial Photography & Videography Theme <= 2.2.0 - Unauthenticated PHP Object Injection
• Diary & Availability Calendar <= 1.0.3 - Authenticated (Subscriber+) SQL Injection
• LadiApp <= 4.4 - Cross-Site Request Forgery via ladiflow_save_hook()
• BD Courier Order Ratio Checker <= 2.0.1 - Missing Authorization
• Animated Pixel Marquee Creator <= 1.0.0 - Cross-Site Request Forgery via 'marquee' Parameter
• WP Lightbox 2 <= 3.0.6.6 - Authenticated (Contributor+) DOM-Based Stored Cross-Site Scripting
• WordPress Button Plugin MaxButtons <= 9.7.4 - Authenticated (Administrator+) Stored Cross-Site Scripting
• Community Events <= 1.4.9 - Cross-Site Request Forgery
• Copymatic – AI Content Writer & Generator <= 2.1 - Cross-Site Request Forgery to Settings Update
• Quick Paypal Payments <= 5.7.25 - Authenticated (Administrator+) Stored Cross-Site Scripting
• .htaccess Redirect <= 0.3.1 Reflected Cross-Site Scripting
• FoodBook <= 4.7.6 - Unauthenticated Sensitive Information Exposure
• Super Store Finder <= 6.9.7 - Unauthenticated SQL Injection
• MDJM Event Management <= 1.7.5.2 - Authenticated (Subscriber+) PHP Object Injection
• Product Table by WBW <= 2.0.1 - Unauthenticated Remote Code Execution
• Payment Gateway Pix For GiveWP <= 2.2.3 - Missing Authorization
• Pedalo Connector <= 2.0.5 - Authentication Bypass to Administrator
• UsersWP <= 1.2.4 - Cross-Site Request Forgery
• illi Link Party! <= 1.0 - Authenticated (Admin+) Stored Cross-Site Scripting
• Animated Typed JS Shortcode <= 2.0 - Authenticated (Contributor+) Stored Cross-Site Scripting
• Reaction Buttons <= 2.1.6 - Authenticated (Administrator+) Stored Cross-Site Scripting
• NEX-Forms <= 9.1.11 - Unauthenticated Stored Cross-Site Scripting via POST Parameter Key Names
• Aspose.Words Exporter <= 6.3.1 - Missing Authorization
• Classified Listing <= 5.0.0 - Authenticated (Contributor+) Content Injection
• PropertyHive <= 2.0.8 - Reflected Cross-Site Scripting
• Counter Up – Animated Number Counter & Milestone Showcase <= 2.4.0 - Authenticated (Contributor+) Stored Cross-Site Scripting
• MasterStudy LMS <= 3.0.8 - Authenticated (Contributor+) Stored Cross-Site Scripting
• Better Messages <= 1.9.9.148 - Cross-Site Request Forgery
• LiteSpeed Cache <= 5.7 - Missing Authorization via update_cdn_status
• Filter Custom Fields & Taxonomies Light <= 1.05 - Missing Authorization
• WP Composer <= 1.0.5 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'pbwp_raw_shortcode' Shortcode
• Out Of Stock Badge <= 2.0 - Cross-Site Request Forgery to Stored Cross-site Scripting
• Info Cards <= 1.0.11 - Missing Authorization
• Thumbnail Editor <= 2.3.3 - Authenticated (Contributor+) Stored Cross-Site Scripting
• Login & Register Forms <= 4.0.1 - Unauthenticated Account Takeover via Brute Force Password Reset Code
• The Ultimate WordPress Toolkit – WP Extended <= 3.0.8 - Reflected Cross-Site Scripting via selected_option
• TicketBAI Facturas para WooCommerce <= 3.21 - Missing Authorization
• Smartsupp – live chat, AI shopping assistant and chatbots <= 3.9.1 - Authenticated (Subscriber+) Stored Cross-Site Scripting
• ProSolution WP Client <= 2.0.8 - Unauthenticated SQL Injection
• Bellows Accordion Menu <= 1.4.2 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode
• Musicbox <= 2.0.3 - Reflected Cross-Site Scripting
• Name Directory <= 1.34.2 - Unauthenticated Arbitrary Shortcode Execution
• HUSKY – Products Filter Professional for WooCommerce <= 1.3.5.2 - Authenticated (Admin+) Local File Inclusion
• AH Shortcodes <= 1.0.2 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'column' Shortcode Attribute
• SW Ajax WooCommerce Search <= 1.2.6 - Reflected Cross-Site Scripting
• reCAPTCHA for all <= 2.26 - Cross-Site Request Forgery
• Editorialmag <= 1.2.0 - Missing Authorization to Authenticated Plugin Activation
• Calculated Fields Form <= 5.2.63 - Authenticated (Admin+) Stored Cross-Site Scripting
• WordPress Core <= 2.0.5 - SQL Injection
• Profile Builder <= 3.4.8 - Admin Access via Password Reset
• Contact Form 7 Extension For Mailchimp <= 0.9.54 - Authenticated (Contributor+) Information Exposure
• Gutenberg Blocks by Kadence Blocks – Page Builder Features <= 3.2.37 - Authenticated (Contributor+) Stored Cross-Site Scripting
• Ace Post Type Builder <= 1.9 - Missing Authorization to Authenticated (Subscriber+) Arbitrary Custom Taxonomy Deletion via 'taxonomy' Parameter
• Accept Stripe Payments < 2.1.4 - Unauthenticated Insecure Direct Object Reference
• CubeWP Framework <= 1.1.30 - Unauthenticated Arbitrary File Read via prev_icon/next_icon Parameter
• W4 Post List <= 2.4.5 - Authenticated (Contributor+) Stored Cross-Site Scripting via Block Options