Vulnerability archive: section 1, page 24

Open a report to review affected versions, available fixes and original sources. Each report covers a specific issue; its presence does not establish whether your website is affected.

• Easy Quiz Maker <= 1.5 - Unauthenticated Stored Cross-Site Scripting
• Paid Membership Plugin, Ecommerce, User Registration Form, Login Form, User Profile & Restrict Content – ProfilePress <= 4.15.0 - Authenticated (Contributor+) Stored Cross-Site Scripting via [reg-select-role] Shortcode
• Stock Sync for WooCommerce <= 2.4.0 - Reflected Cross-Site Scripting via page parameter
• Jarvis – Night Club, Concert, Festival WordPress <= 1.8.11 - Unauthenticated PHP Object Injection
• TablePress – Tables in WordPress made easy <= 3.2.4 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode Attributes
• DirectoriesPro by SabaiApps <= 1.3.45 - Reflected Cross-Site Scripting
• MStore API <= 4.15.7 - Authenticated (Subscriber+) SQL Injection
• PawFriends - Pet Shop and Veterinary WordPress <= 1.3 - Cross-Site Request Forgery
• WP Contact Form III <= 1.6.2d - Reflected Cross-Site Scripting
• Testimonial Rotator <= 3.0.3 - Authenticated (Contributor+) Stored Cross-Site Scripting
• Jetpack – WP Security, Backup, Speed, & Growth 16.1 - 16.1.2 - Unauthenticated Stored Cross-Site Scripting
• Sell Downloads <= 1.2.3 - Missing Authorization
• JetFormBuilder <= 3.6.6 - Reflected DOM-Based Cross-Site Scripting via 'query_var' Dynamic Preset via data-jfb-macro / JFB_FIELD:: Macro Renderer
• Linear <= 2.8.0 - Authenticated (Contributor+) Stored Cross-Site Scripting
• All Bootstrap Blocks <= 1.3.28 - Missing Authorization
• Slimstat Analytics <= 4.9.2 - Unauthenticated Stored Cross-Site Scripting
• WP Humans.txt <= 1.0.6 - Authenticated (Administrator+) Stored Cross-Site Scripting
• Mortgage Calculators WP < 1.53 - Authenticated Stored Cross-Site Scripting
• WordPress Core < 4.1.2 - Cross-Site Scripting via Ephox in Plupload
• Knight Lab Timeline <= 3.9.3.4 - Authenticated (Contributor+) Stored Cross-Site Scripting
• WP eStore <= 8.5.4 - Cross-Site Request Forgery to Coupon Deletion
• Kirki – Freeform Page Builder, Website Builder & Customizer <= 6.0.11 - Unauthenticated Stored Cross-Site Scripting
• WP Ultimate Email Marketer <= 1.2.0 - Authentication Bypass
• Good Old Gallery <= 2.1.2 - Reflected Cross-Site Scripting
• YayReviews 1.0.4 - 1.4.0 - Unauthenticated Information Exposure
• Eventicity <= 1.5 - Unauthenticated Local File Inclusion
• Image Hover Effects <= 5.4 - Authenticated (Administrator+) Stored Cross-Site Scripting
• Block Plugin Update <= 3.3.1 - Cross-Site Request Forgery via bspu_plugin_select.php
• PDF Block <= 1.1.0 - Authenticated (Contributor+) Stored Cross-Site Scripting
• FOX <= 1.4.5 - Authenticated (Shop manager+) SQL Injection
• cookieBAR <= 1.7.0 - Authenticated (Administrator+) Stored Cross-Site Scripting
• MBE eShip <= 2.2.4 - Reflected Cross-Site Scripting
• CE21 Suite <= 2.2.0 - Unauthenticated Privilege Escalation
• GERRYWORKS Post by Mail <= 1.0 - Contributor+ Privilege Escalation
• Ultimate Security Checker <= 4.2 - Cross-Site Request Forgery
• S2B AI Assistant – ChatBot, ChatGPT, OpenAI, Content & Image Generator <= 1.7.8 - Authenticated (Editor+) Arbitrary File Upload
• Advanced Tag Lists <= 1.2 - Cross-Site Request Forgery to Stored Cross-Site Scripting
• Visitor Maps <= 1.5.8.6 - Stored Cross-Site Scripting
• Ultimate CSV Importer < 3.6.75 - Information Disclosure
• WP Club Manager <= 2.2.11 - Authenticated (Player+) Stored Cross-Site Scripting
• Islamic Database <= 1.0 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode Attributes
• Video Lessons Manager < 1.7.2 and Video Lessons Manager Pro < 3.5.9 - Stored Cross-Site Scripting
• Simply Poll <= 1.4.1 - Unauthenticated SQL Injection
• Essential Addons for Elementor <= 6.5.5 - Missing Authorization to Unauthenticated Sensitive Information Exposure
• Smart Popup by Supsystic <= 1.13.0 - Unauthenticated PHP Object Injection
• Woocommerce Custom Product Addons Pro <= 5.4.1 - Unauthenticated Remote Code Execution via Custom Pricing Formula
• Email Marketing for WordPress and WooCommerce <= 1.0.10 - Authenticated (Subscriber+) Stored Cross-Site Scripting via 'data' Parameter to /updateOptions REST Endpoint
• Gutenverse <= 1.9.0 - Authenticated (Contributor+) Stored Cross-Site Scripting
• Gutenium Blocks <= 1.1.7 - Authenticated (Contributor+) Stored Cross-Site Scripting
• LifterLMS – WordPress LMS Plugin for eLearning <= 7.6.2 - Authenticated (Contributor+) SQL Injection via Shortcode
• Page Builder: KingComposer < 2.8.2 - Authenticated Stored Cross-Site Scripting
• Custom HTML Pages <= 0.6.2 - Authenticated (Author+) Stored Cross-Site Scripting
• PDF Generator for WordPress <= 1.6.2 - Authenticated (Subscriber+) Server-side Request Forgery
• Brizy – Page Builder <= 2.4.43 - Unauthenticated Stored Cross-Site Scripting via Form
• 4ECPS Web Forms <= 0.2.17 - Authenticated (Administrator+) Stored Cross-Site Scripting
• Product Catalog Feed by PixelYourSite <= 2.1.1 - Cross-Site Request Forgery
• Mercado Pago payments for WooCommerce <= 6.6.0 - Cross-Site Request Forgery
• Shortcodify <= 1.4.3 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'name' Shortcode Attribute
• Themify Portfolio Post <= 1.3.0 - Authenticated (Author+) Stored Cross-Site Scripting
• Beaver Builder <= 2.9.4.1 - Authenticated (Contributor+) Remote Code Execution
• Crowdsignal Dashboard <= 2.0.24 - Cross-Site Scripting
• Tutor LMS Elementor Addons <= 2.1.4 - Authenticated (Contributor+) Stored Cross-Site Scripting via Course Carousel Widget
• Next Event Calendar <= 1.2 - Authenticated (Author+) Stored Cross-Site Scripting
• Giveaways and Contests by RafflePress <= 1.12.4 - Missing Authorization
• JetEngine < 3.8.14 - Authenticated (Author+) Stored Cross-Site Scripting
• WP DeskLite – Helpdesk and Support Plugin <= 1.0.0 - Reflected Cross-Site Scripting
• Link Whisper Free <= 0.9.2 - Reflected Cross-Site Scripting
• EELV Newsletter <= 4.6.0 - Cross-Site Request Forgery
• Modern Events Calendar Lite <= 6.5.1 - Authenticated (Admin+) Stored Cross-Site Scripting
• WP Social Links <= 0.3.1 - Reflected Cross-Site Scripting
• WP-Contact <= 1.0 - Cross-Site Scripting
• LiteSpeed Cache <= 6.4.1 - Authenticated (Author+) Path Traversal
• Simple File List <= 6.1.14 - Unauthenticated Arbitrary File Download
• AI Responsive Gallery Album <= 1.4 - Missing Authorization
• GiveWP – Donation Plugin and Fundraising Platform <= 4.16.9 - Unauthenticated Insecure Direct Object Reference
• Awesome Support <= 6.1.4 - Reflected Cross-Site Scripting
• Social Share Buttons by Supsystic <= 2.2.3 - Cross-Site Request Forgery
• Elementary Addons <= 2.0.4 - Authenticated (Contributor+) Stored Cross-Site Scripting
• Feed Them Social – for Twitter feed, Youtube and more <= 2.9.9 - Authenticated (Subscriber+) Stored Cross-Site Scripting
• Brave – Create Popup, Optins, Lead Generation, Survey, Sticky Elements & Interactive Content < 0.8.6 - Reflected Cross-Site Scripting
• Advanced Custom Fields: Extended <= 0.9.2.1 - Unauthenticated Privilege Escalation via Insert User Form Action
• RTMKit <= 1.6.5 - Authenticated (Contributor+) Arbitrary File Upload
• ERP <= 1.16.7 - Missing Authorization
• copy-me <= 1.0.0 - Missing Authorization & Cross-Site Request Forgery
• SEOPress <= 10.2 - Unauthenticated Stored Cross-Site Scripting via Author Display Name
• JetFormBuilder — Dynamic Blocks Form Builder < 3.6.5.2 - Unauthenticated Stored Cross-Site Scripting
• Bulk Order Update for WooCommerce <= 1.6 - Unauthenticated Arbitrary File Read via 'csv_url' Parameter
• MDx <= 2.0.3 - Authenticated (Contributor+) Stored Cross-Site Scripting via mdx_list_item Shortcode
• Image Optimizer, Resizer and CDN – Sirv <= 7.2.6 - Authenticated (Contributor+) Arbitrary File Upload
• WP Activity Log Premium <= 4.6.4 - Authenticated (Subscriber+) SQL Injection
• RomethemeKit For Elementor <= 1.5.2 - Missing Authorization
• W3 Total Cache <= 2.1.2 Authenticated (Admin+) Stored Cross-Site Scripting
• Zedna eBook download < 1.2 - Directory Traversal
• MicroPayments <= 3.2.4 - Reflected Cross-Site Scripting
• StreamTube Core <= 4.78 - Unauthenticated Arbitrary User Password Change
• We’re Open! <= 1.37 - Authenticated (Administrator+) Stored Cross-Site Scripting
• a3 Lazy Load <= 2.7.6 - Authenticated (Contributor+) Stored Cross-Site Scripting via Video Element
• Ricerca – advanced search <= 1.1.12 - Authenticated (Administrator+) Stored Cross-Site Scripting via Plugin's Settings
• Stock Exporter for WooCommerce <= 1.1.0 - Cross-Site Request Forgery
• Eduma <= 5.7.6 - Authenticated (Contributor+) Local File Inclusion