Vulnerability archive: section 1, page 5

Open a report to review affected versions, available fixes and original sources. Each report covers a specific issue; its presence does not establish whether your website is affected.

• User Meta Manager <= 3.4.9 - Reflected Cross-Site Scripting
• WP Support Plus Responsive Ticket System <= 8.0.7 - Arbitrary File Upload
• NGG Smart Image Search <= 3.3.3 - Authenticated (Contributor+) Stored Cross-Site Scripting
• Database Reset <= 3.22 - Cross-Site Request Forgery to WP Reset Plugin Installation
• Safe SVG <= 2.5.0 - Authenticated (Contributor+) Insecure Direct Object Reference
• MasterStudy LMS WordPress Plugin – for Online Courses and Education <= 3.7.25 - Authenticated (Subscriber+) SQL Injection
• aDirectory <= 1.3 - Unauthenticated Arbitrary File Upload
• Zedity – The Layout-Free Content Editor < 2.5.1 - Reflected Cross-Site Scripting
• AI Chatbot & Workflow Automation by AIWU <= 1.4.14 - Unauthenticated Stored Cross-Site Scripting via 'X-Forwarded-For' Header
• Export customers list csv for WooCommerce <= 2.0.67 - CSV Injection
• Display Eventbrite Events <= 6.2.6 - Authenticated (Contributor+) Local File Inclusion
• SMTP2GO for WordPress <= 1.16.0 - Missing Authorization to Authenticated (Subscriber+) Log Read/Truncate
• Envo Extra <= 1.8.11 - Authenticated (Contributor+) Stored Cross-Site Scripting
• Jayj Quicktag < 1.3.2 - Cross-Site Request Forgery
• Mukioplayer For WordPress <= 1.6 - SQL injection
• Taskbuilder – WordPress Project & Task Management plugin <= 3.0.4 - Authenticated (Admin+) SQL injection
• The7 Elements < 2.7.12 - Authenticated (Contributor+) Local File Inclusion
• WPBookit <= 1.0.7 - Cross-Site Request Forgery to Customer Deletion
• Hide Category by User Role for WooCommerce <= 2.3.1 - Missing Authorization to Unauthenticated Cache Flushing
• Listeo - Directory & Listings With Booking - WordPress Theme < 1.6.11 - Cross-Site Scripting
• Advance WP Query Search Filter <= 1.0.10 - Reflected Cross-Site Scripting
• CF7 Auto Responder Addon <= 2.4 - Unauthenticated Stored Cross-Site Scripting
• Unite Gallery Lite < 1.5 - Cross-Site Request Forgery and SQL Injection
• Ultimate Dashboard <= 3.8.7 - Missing Authorization to Authenticated (Subscriber+) Plugin Modules Activation/Deactivation
• Knews Multilingual Newsletters Plugin <= 1.7.0 - SQL Injection
• Newsletters <= 4.10 - Unauthenticated Local File Inclusion
• Decent Comments < 3.0.2 - Unauthenticated Information Exopsure
• Membership & Content Restriction – Paid Member Subscriptions <= 2.4.1 - SQL Injection
• Ocean Extra <=1.6.5 - Cross-Site Request Forgery Bypass
• Smart Slider 3 <= 3.5.1.9 - PHP Object Injection
• Royal Elementor Addons <= 1.3.59 - Insufficient Access Control to Template Conditions Modification
• Simple Counter <= 1.0.3 - Authenticated (Administrator+) Stored Cross-Site Scripting via settings
• PowerPress <= 10.2.3 - Authenticated (Administrator+) Stored Cross-Site Scripting via 'Feed[title]'
• Booking and Rental Manager <= 2.2.8 - Authenticated (Contributor+) Local File Inclusion
• Auto Bulb Finder for WordPress <= 2.8.0 - Authenticated (Contributor+) Stored Cross-Site Scripting
• Prime Slider – Addons For Elementor (Revolution of a slider, Hero Slider, Media Slider, Drag Drop Slider, Video Slider, Product Slider, Ecommerce Slider) <= 3.14.0 - Authenticated (Contributor+) Stored Cross-Site Scripting
• Brizy - Page Builder <= 2.8.18 - Authenticated (Author+) Stored Cross-Site Scripting
• Contest Gallery Pro <= 19.1.4.1 - Authenticated (Administrator+) SQL Injection via wp_user_id
• Scrollbar by webxapp – Best vertical/horizontal scrollbars plugin <= 1.3.0 - Authenticated (Contributor+) Stored Cross-Site Scripting
• WooCommerce License Manager <= 5.3.1 - Reflected Cross-Site Scripting
• Clone <= 2.3.7 - Cross-Site Request Forgery via wp_ajax_tifm_save_decision
• WPLMS < 1.9.9.5.3 - Authenticated (Instructor+) SQL Injection
• Widgetize Pages Light <= 3.0 - Authenticated (Administrator+) Stored Cross-Site Scripting
• Formidable Forms <= 6.32.0 - Unauthenticated Payment Bypass
• Biometric Login for WooCommerce <= 1.0.3 - Unauthenticated Privilege Escalation
• WZone <= 14.0.31 - Missing Authorization
• Website remote Install vor Gravity, WPForms, Formidable, Ninja, Caldera <= 4.0 - Authenticated (Contributor+) Stored Cross-Site Scripting
• Flower Delivery by Florist One <= 3.5.8 - (Admin+) Stored Cross-Site Scripting
• WP Directory Kit <= 1.4.9 - Unauthenticated Email Exposure via wdk_public_action
• Add Custom Fields to Media <= 2.0.3 - Cross-Site Request Forgery to Custom Field Deletion via 'delete' Parameter
• Sinking Dropdowns <= 1.25 - Cross-Site Request Forgery
• Modal Survey <= 2.0.2.0.1 - Unauthenticated SQL Injection
• Beds24 Online Booking <= 2.0.27 - Authenticated (Contributor+) Stored Cross-Site Scripting
• LazyTasks <= 1.2.37 - Unauthenticated Privilege Escalation
• Ninja Forms – The Contact Form Builder That Grows With You <= 3.8.19 - Unauthenticated Stored Cross-Site Scripting via Form Calculations
• Product Stock Manager < 1.0.5 - Missing Authorization and Cross-Site Request Forgery
• BuddyForms <= 2.7.2 - Authenticated (Contributor+) Stored Stored Cross-Site Scripting
• WooCommerce Pre-Orders <= 2.0.0 - Authenticated (Contributor+) Stored Cross-Site Scripting
• Modern Events Calendar Lite <= 6.2.9 - Authenticated (Contributor+) Cross-Site Scripting
• Multiple Domain <= 1.0.2 - Cross-Site Scripting
• The Events Calendar <= 6.15.13 - Missing Authorization to Authenticated (Subscriber+) Data Migration Control
• Music Store – WordPress eCommerce <= 1.1.19 - Reflected Cross-Site Scripting
• WP-DownloadManager <= 1.69 - Authenticated (Administrator+) Path Traversal to Arbitrary File Read via 'download_path' Parameter
• duoFAQ - Responsive, Flat, Simple FAQ <= 1.4.8 - Reflected Cross-Site Scripting
• silverOrchid <= 1.5.0 - Cross-Site Scripting
• Revision Manager TMC <= 2.8.19 - Missing Authorization to Authenticated (Subscriber+) Arbitrary Email Sending
• Download Manager <= 3.3.12 - Authenticated (Author+) Stored Cross-Site Scripting via SVG File Upload
• Product Category Slider for WooCommerce <= 4.3.4 - Authenticated (Contributor+) Local File Inclusion
• AI Engine <= 2.8.4 - Authenticated (Subscriber+) Stored Cross-Site Scripting via `mwai_chatbot` Shortcode `id` Parameter
• GiveWP <= 2.17.2 - Reflected Cross-Site Scripting via Import Tool
• Slideshow Gallery <= 1.7.8 - Cross-Site Request Forgery
• Racquet <= 1.12.0 - Unauthenticated Local File Inclusion
• iFrame <= 4.8 - Authenticated (Contributor+) Stored Cross-Site Scripting via srcdoc
• ElementsKit Elementor Addons – Advanced Widgets & Templates Addons for Elementor <= 3.9.6 - Missing Authorization
• Serial Numbers for WooCommerce – License Manager <= 2.1.0 - Missing Authorization
• Smart Marketing SMS and Newsletters Forms <= 5.1.24 - Unauthenticated SQL Injection
• Move Addons for Elementor <= 1.3.4 - Authenticated (Contributor+) Stored Cross-Site Scripting
• Quiz Maker <= 6.7.1.2 - Cross-Site Request Forgery
• Xpert Tab <= 1.3 - Authenticated (Contributor+) Stored Cross-Site Scripting
• Comment Approved Notifier Extended <= 5.2 - Authenticated (Administrator+) Stored Cross-Site Scripting
• Categorify <= 1.0.7.5 - Missing Authorization
• Gallery Bank – WordPress Photo Gallery Plugin < 3.0.70 - Reflected Cross-Site Scripting
• Forminator <= 1.44.1 - Authenticated (Contributor+) Stored DOM-Based Cross-Site Scripting via id and data-size Parameters
• Change WooCommerce Add To Cart Button Text <= 1.3 - Missing Authorization via rexvs_settings_submit
• ProfileGrid <= 5.9.5.3 - Authenticated (Subscriber+) SQL Injection
• Dokan <= 5.0.2 - Missing Authorization to Authenticated (Vendor+) Privilege Escalation
• Strong Testimonials <= 3.1.16 - Missing Authorization
• Sunshine Photo Cart <= 2.9.25 - Insecure Direct Object Reference to Order Manipulation
• Wordpress Simple Share Plugin <= 0.5.3 - Authenticated (Admin+) Stored Cross-Site Scripting
• Sticky Social Bar <= 2.0 - Cross-Site Request Forgery to Stored Cross-Site Scripting
• Chat Bubble <= 2.2 - Unauthenticated Stored Cross-Site Scripting
• News Publisher Autopilot <= 2.1.4 - Cross-Site Request Forgery to Stored Cross-Site Scripting
• Link Shield <= 0.5.4 - Authenticated (Admin+) Stored Cross-Site Scripting
• Revolution < 2.5.8 - Authenticated (Subscriber+) Local File Inclusion
• WPRealty <= 2.9.1 - Reflected Cross-Site Scripting
• CryptX <= 4.0.5 - Authenticated (Contributor+) Stored Cross-Site Scripting
• Unlock Addons for Elementor <= 2.0.0 - Authenticated (Contributor+) Stored Cross-Site Scripting
• Brave – Create Popup, Optins, Lead Generation, Survey, Sticky Elements & Interactive Content <= 0.6.9 - Authenticated (Admin+) Stored Cross-Site Scripting
• WCFM Membership – WooCommerce Memberships for Multivendor Marketplace <= 2.11.11 - Missing Authorization
• PublishPress Capabilities: User Role Access Control, Admin Area Permissions <= 2.50.1 - Cross-Site Request Forgery