Vulnerability archive: section 1, page 4

Open a report to review affected versions, available fixes and original sources. Each report covers a specific issue; its presence does not establish whether your website is affected.

• Paid Memberships Pro <= 2.4.2 - Cross-Site Request Forgery Bypass
• Salem Theme <= 1.5.5 - DOM-based Cross-Site Scripting
• WoW Guild Armory Roster <= 0.5.5 - Authenticated (Contributor+) Stored Cross-Site Scripting
• BSK PDF Manager 1.3 - 2.9 - Authenticated Stored Cross-Site Scripting
• RankMath SEO <= 1.0.107.2 - Authenticated (Contributor+) Local File Inclusion
• Webcam Video Conference <= 3.1 - Cross-Site Scripting
• WPLMS Learning Management System for WordPress, WordPress LMS <= 4.973 - Authenticated (Subscriber+) SQL Injection
• WowStore <= 4.2.4 - Missing Authorization
• User Registration & Membership PRO – Custom Registration Form, Login Form, and User Profile <= 5.1.3 - Cross-Site Request Forgery to User Deletion
• EELV Newsletter <= 3.3.0 - Reflected Cross-Site Scripting
• Roi Calculator <= 1.0 - Cross-Site Request Forgery to Stored Cross-Site Scripting
• Donate Me <= 1.2.5 - Cross-Site Request Forgery to Stored Cross-Site Scripting
• OpenInviter for WordPress <= 1.7.0 - Sensitive Information Disclosure
• WP-RSS-Spreadshirt-3DCube-Gallery <= 1.3 - Cross-Site Scripting
• FV Flowplayer Video Player <= 7.5.54.7212 - Authenticated (Subscriber+) Stored Cross-Site Scripting via Unquoted popup Shortcode Attribute
• Age Verification <= 0.4 - Open Redirect
• VSTEMPLATE Creator <= 2.0.2 - Reflected Cross-Site Scripting
• ClickWhale – Link Manager, Link Shortener and Click Tracker for Affiliate Links & Link Pages <= 2.4.1 - Authenticated (Contributor+) SQL Injection
• i-amaze <= 1.3.7 - Cross-Site Request Forgery
• LearnDash LMS <= 4.20.0.1 - Missing Authorization
• Organizer <= 1.2.1 - Multiple Cross-Site Scripting
• Pretty Google Calendar <= 1.7.2 - Authenticated (Contributor+) Stored Cross-Site Scripting
• WPLMS <= 1.9.9.7 - Missing Authorization
• Libsyn Publisher Hub <= 1.4.4 - Unauthenticated Cross-Site Scripting
• User Profile Builder – Beautiful User Registration Forms, User Profiles & User Role Editor <= 4.0.2 - Authenticated (Subscriber+) Stored Cross-Site Scripting
• WordPress Core < 2.6.2 - Arbitrary User Password Reset
• Easy Digital Download <= 3.5.2 - Insufficient Verification to Order Manipulation
• Booking Calendar <= 6.2 - Cross-Site Request Forgery leading to Cross-Site Scripting
• Broken Link Checker <= 2.4.13 - Unauthenticated Stored Cross-Site Scripting via Comment Author URL / Link Log
• Editorial Calendar <= 3.7.12 - Authenticated (Contributor+) Insecure Direct Object Reference
• Bookory <= 2.2.7 - Authenticated (Contributor+) Local File Inclusion
• WP Basic Elements <= 5.2.15 - Missing Authorization to Plugin Settings Update via wpbe_save_settings
• WP Coder – add custom html, css and js code <= 2.5.3 - Authenticated (Admin+) SQL Injection
• Web Push <= 1.4.0 - Cross-Site Request Forgery to Stored Cross-Site Scripting
• Relevanssi <= 4.22.2 (Free) and <= 2.25.1 (Premium) - Unauthenticated Information Exposure
• nK Themes Helper <= 1.7.9 - Authenticated (Subscriber+) Server-Side Request Forgery
• Category Grid View Gallery <= 2.3.1 - Reflected Cross-Site Scripting
• WPGSI: Spreadsheet Integration <= 3.8.3 - Missing Authorization to Unauthenticated Arbitrary Post Creation and Deletion via Forged Base64 Token
• WooCommerce <= 10.4.2 - Authenticated (Subscriber+) Information Exposure
• Hubbub Lite <= 1.34.3 - Authenticated (Admin+) Stored Cross-Site Scripting
• NP Quote Request for WooCommerce <= 2.4.15 - Unauthenticated Information Exposure
• Login Logout Register Menu <= 2.0 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'llrmloginlogout' Shortcode
• Smart Auto Upload Images <= 1.2.0 - Authenticated (Contributor+) Arbitrary File Upload
• Cost Calculator Builder <= 4.0.17 - Unauthenticated Information Exposure
• MachForm Shortcode <= 1.4.1 - Cross-Site Request Forgery to Stored Cross-Site Scripting
• WP Directory Kit <= 1.3.6 - Authenticated (Admin+) HTML Injection
• WordPress Core - All known versions - Unauthenticated Blind Server Side Request Forgery
• All-in-One Video Gallery <= 3.6.4 - Authenticated (Contributor+) Arbitrary File Upload via featured image
• Listdom: AI-powered Business Directory with Classifieds Ads Listings <= 5.5.0 - Unauthenticated Privilege Escalation
• Ivory Search <= 4.6.6 - Reflected Cross-Site Scripting
• Permalink Manager Lite <= 2.2.20.3 - Authenticated Stored Cross-Site Scripting
• Just Highlight <= 1.0.3 - Authenticated (Administrator+) Stored Cross-Site Scripting via 'Highlight Color' Setting
• Adaptive Images for WordPress <= 0.6.66 - Local File Inclusion
• Crayon Syntax Highlighter < 2.8.4 - Cross-Site Scripting
• Travelpayouts <= 1.2.3 - Missing Authorization
• Kraken.io Image Optimizer <= 2.6.9 - Missing Authorization to Authenticated (Subscriber+) Plugin Options Update
• Google Adsense & Banner Ads by AdsforWP <= 1.8 - Cross-Site Request Forgery
• Mega Menu Block <= 1.0.6 - Authenticated (Contributor+) Stored Cross-Site Scripting
• WP Travel Engine – Tour Booking Plugin – Tour Operator Software < 6.8.2 - Missing Authorization to Unauthenticated Settings Update
• Hover Image <= 1.4.1 - Cross-Site Request Forgery
• Hero Mega Menu - Responsive WordPress Menu Plugin <= 1.16.5 - Authenticated (Subscriber+) SQL Injection
• Accordion <= 2.3.14 - Missing Authorization
• Spectra – WordPress Gutenberg Blocks <= 2.3.1 - Captcha Bypass
• Betheme <= 26.5.1.4 - Authenticated (Subscriber+) PHP Object Injection
• SMTP Mail <= 1.3.46 - Unauthenticated Stored Cross-Site Scripting via Email Subject
• Wp EMember <= 10.6.5 - Cross-Site Request Forgery to Bulk Delete
• Under Construction / Maintenance Mode from Acurax <= 2.6 - Information Exposure
• Integration for Constant Contact and Contact Form 7, WPForms, Elementor, Ninja Forms <= 1.1.6 - Unauthenticated PHP Object Injection
• WordPress Core < 3.4.2 - Cross-Site Scripting
• Mapplic Lite <= 1.0 - Authenticated (Author+) Stored Cross-Site Scripting via SVG File Upload
• Affiliate Link Tracker <= 0.2 - Authenticated (Administrator+) Stored Cross-Site Scripting
• EmailPress <= 1.0 - Reflected Cross-Site Scripting
• Classima < 2.1.11 - Reflected Cross-Site Scripting
• Opal Woo Custom Product Variation <= 1.1.3 - Unauthenticated Arbitrary File Deletion
• Pinpoint Booking System – #1 WordPress Booking Plugin < 2.1 - Authenticated SQL Injection
• Royal Addons for Elementor – Addons and Templates Kit for Elementor < 1.7.1066 - Missing Authorization
• WooODT Lite <= 2.5.5 - Unauthenticated Payment Bypass
• Advanced Custom Fields <= 5.10 - Missing Authorization to Information Disclosure
• Team Showcase < 25.05.13 - Authenticated (Subscriber+) Arbitrary Shortcode Execution
• Contact Form builder with drag & drop for WordPress – Kali Forms <= 2.3.41 - Missing Authorization
• Download Manager <= 3.2.82 - Password Protected File Bypass
• ImageMagick Engine <= 1.7.5 - Cross-Site Request Forgery to Remote Command Execution
• WordPress Announcement & Notification Banner Plugin – Bulletin <= 3.8.5 - Authenticated (Administrator+) SQL Injection
• App Builder <= 5.6.1 - Insecure Direct Object Reference to Authenticated (Subscriber+) Arbitrary User Avatar Modification via 'user_id' Parameter
• All-in-One Microsoft 365 & Entra ID / Azure AD SSO Login <= 2.2.5 - Authentication Bypass
• Slider Responsive Slideshow – Image slider, Gallery slideshow <= 1.5.4 - Authenticated (Contributor+) PHP Object Injection
• Random Posts, Mp3 Player + ShareButton <= 1.4.1 - Reflected Cross-Site Scripting
• Business Hours Indicator <= 2.3.4 - Authenticated Stored Cross-Site Scripting
• Advanced Control Manager for WordPress by ItalyStrap <= 2.16.0 - Authenticated (Contributor+) Stored Cross-Site Scripting
• PWA for WP & AMP Plugin <= 1.0.8 - Cross-Site Scripting
• Slimstat Analytics <= 4.9.2 - Reflected Cross-Site Scripting via REQUEST_URI
• WPB Image Widget <= 1.1 - Authenticated (Contributor+) Stored Cross-Site Scripting
• DesignFolio Plus Theme (Unkown Versions) - Arbitrary File Upload
• Easy Banners <= 1.4 - Cross-Site Scripting
• Ninja Forms – The Contact Form Builder That Grows With You 3.14.10 - 3.15.1 - Unauthenticated Arbitrary Shortcode Execution
• Tutor LMS – eLearning and online course solution <= 4.1.2 - Authenticated (Subscriber+) Race Condition
• My Category Order <= 4.3 - Cross-Site Request Forgery to Cross-Site Scripting
• Product Website Showcase <= 1.0 - Unauthenticated Arbitrary File Upload
• WooCommerce Pre-Orders <= 1.9.0 - Unauthenticated Cross-Site Scripting
• Shield Security – Smart Bot Blocking & Intrusion Prevention Security <= 19.1.13 - Cross-Site Request Forgery