Vulnerability archive: section 1, page 6

Open a report to review affected versions, available fixes and original sources. Each report covers a specific issue; its presence does not establish whether your website is affected.

• WPZOOM Shortcodes <= 1.0.1 - Reflected Cross-Site Scripting
• GDPR CCPA Compliance Support <= 2.7.4 - Missing Authorization
• Organization chart <= 1.4.4 - Authenticated (Admin+) Stored Cross-Site Scripting
• Jeeng Push Notifications <= 2.0.3 - Cross-Site Request Forgery
• B Slider <= 1.1.30 - Missing Authorization
• Woffice <= 5.4.14 - Unauthenticated Privilege Escalation
• Accalia | Dermatology Clinic & Cosmetology WordPress Theme + Elementor <= 1.5.3 - Unauthenticated PHP Object Injection
• NEX-Forms – Ultimate Forms Plugin for WordPress 9.2.1 - 9.3.0 - Unauthenticated Insecure Direct Object Reference
• WordPress Portfolio Builder – Portfolio Gallery <= 1.1.7 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode
• wpForo Forum <= 2.4.5 - Authenticated (Subscriber+) Stored Cross-Site Scripting via Profile Avatar
• Rocket Media Library Mime Type <= 2.1.0 - Cross-Site Request Forgery to Stored Cross-Site Scripting
• Maspik <= 2.5.6 - Authenticated (Subscriber+) Missing Authorization to Spam Log Export
• Download Monitor <= 4.4.6 - Authenticated (Admin+) Arbitrary File Download
• Dynamics 365 Integration <= 1.3.12 - Cross-Site Request Forgery via wp_ajax_wpcrm_log
• PeproDev CF7 Database <= 2.0.0 - Unauthenticated Stored Cross-Site Scripting
• WP Register Profile With Shortcode <= 3.5.9 - Cross-Site Request Forgery to User Password Reset
• Icegram <= 3.1.24 - Missing Authorization to Unauthenticated Message Duplication
• Integration for Contact Form 7 HubSpot <= 1.2.8 - Open Redirect via state parameter
• WP Membership <= 1.2.3 - Cross-Site Scripting
• BlockArt Blocks – Gutenberg Blocks, Page Builder Blocks ,WordPress Block Plugin, Sections & Template Library <= 2.2.14 - Authenticated (Contributor+) Stored Cross-Site Scripting
• Automatic <= 3.92.0 - Unauthenticated SQL Injection
• AdminQuickbar <= 1.9.3 - Cross-Site Request Forgery to Settings Update
• CWW Portfolio <= 1.3.1 - Unauthenticated Local File Inclusion
• Norse Rune Oracle Plugin <= 1.4.3 - Authenticated (Contributor+) Stored Cross-Site Scripting
• PDF Generator Addon for Elementor Page Builder <= 2.1.0 - Authenticated (Contributor+) Stored Cross-Site Scripting
• TopScorer - Sports WordPress <= 1.2 - Unauthenticated Local File Inclusion
• Uix UserCenter <= 1.0.3 - Unauthenticated Privilege Escalation
• Urban City (All Versions) - Arbitrary File Download
• Tour Master - Tour Booking, Travel, Hotel <= 5.3.7 - Authenticated (Subscriber+) SQL Injection via review_id Parameter
• WP Mailster <= 1.8.17.0 - Unauthenticated Sensitive Information Exposure
• Thim Kit for Elementor <= 1.3.7 - Missing Authorization to Unauthenticated Private Course Disclosure
• ARMember Premium <= 5.9.2 - Missing Authorization
• WP Accurate Form Data <= 1.2 - Cross-Site Request Forgery to Cross-Site Scripting
• Limit Login Attempts (Spam Protection) <= 4.9.1 - Unauthenticated SQL Injection
• Download Manager <= 3.3.70 - Authenticated (Subscriber+) Stored Cross-Site Scripting via Display Name
• Vertical Carousel <= 1.0.2 - Authenticated (Contributor+) Stored Cross-Site Scripting
• ElementInvader Addons for Elementor <= 1.3.1 - Missing Authorization
• Easy PayPal & Stripe Buy Now Button <= 1.8.3 & Contact Form 7 – PayPal & Stripe Add-on <= 2.1 - Cross-Site Request Forgery to Settings Update
• Newsletters <= 4.6.8.5 - Object Injection
• BuddyPress 2.0 - 2.7.3 - Unauthenticated Arbitrary File Deletion
• Swift Calendar Online Appointment Scheduling <= 1.3.3 - Reflected Cross-Site Scripting
• Startklar Elementor Addons <= 1.7.13 - Unauthenticated Arbitrary File Upload
• SevenTrees <= 1.0.2 - Unauthenticated Local File Inclusion
• VPSUForm <= 3.2.20 - Missing Authorization
• Auto Load Next Post <= 1.5.14 - Cross-Site Request Forgery
• Appointment Hour Booking <= 1.4.56 - Captcha Bypass
• WP Table Builder 2.1.1 - 2.1.13 - Incorrect Authorization to Authenticated (Subscriber+) Arbitrary Post Deletion via 'ids' Parameter
• Workreap - Freelance Marketplace and Directory WordPress Theme < 2.2.2 - Arbitrary File Upload
• AffiliateImporterEb <= 1.0.6 - Reflected Cross-Site Scripting via 'module'
• Easy Social Share Buttons for WordPress <= 3.4.1 - Cross-Site Scripting
• JobSearch <= 2.3.4 - Authentication Bypass to Account Takeover
• Promotion Slider <= 3.3.4 - Authenticated (Contributor+) Stored Cross-Site Scripting
• Woocommerce Order address Print <= 3.2 - Reflected Cross-Site Scripting
• EasyJobs <= 2.4.14 - Reflected Cross-Site Scripting
• Reward Video Ad for WordPress <= 1.6 - Authenticated (Administrator+) Stored Cross-Site Scripting via Admin Settings
• CM Ad Changer <= 2.0.5 - Cross-Site Request Forgery
• Videos <= 1.0.5 - Reflected Cross-Site Scripting
• Data Dash <= 1.2.3 - Authenticated (Subscriber+) Stored Cross-Site Scripting
• WPBot <= 8.5.9 - Missing Authorization to Unauthenticated Email Relay via wpcs_send_email AJAX Action
• Infocob CRM Forms <= 2.4.0 - Authenticated (Editor+) Arbitrary File Download
• Sovratec Case Management <= 1.0.0 - Unauthenticated Arbitrary File Upload
• Happy Addons for Elementor <= 3.20.8 - Unauthenticated Information Exposure
• Pliska <= 0.3.5 - Authenticated (Contributor+) Stored Cross-Site Scripting via Author Display Name
• NEX-Forms <= 9.2.2 - Missing Authorization to Unauthenticated Sensitive Information Disclosure via CSVExport Class
• Photoxhibit <= 2.1.8 - Reflected Cross-Site Scripting
• WooCommerce Products Vendor <= 2.1.65 - Unauthenticated SQL Injection
• Pagelayer <= 1.7.9 - Authenticated(Administrator+) Stored Cross-Site Scripting via Header/Footer code
• WP Review Slider <= 12.8 - Authenticated (Administrator+) Stored Cross-Site Scripting
• Poll Maker – Versus Polls, Anonymous Polls, Image Polls <= 5.4.6 - Authenticated (Administrator+) SQL Injection via Order_by Parameter
• Simple Membership < 4.7.8 - Missing Authorization
• Quick Social Login <= 1.4.6 - Authenticated (Contributor+) Stored Cross-Site Scripting
• WP File Download <= 6.3.4 - Authenticated (Subscriber+) Arbitrary File Deletion via 'remoteurl' Parameter
• MasterStudy LMS WordPress Plugin – for Online Courses and Education <= 3.7.29 - Authenticated (Subscriber+) SQL Injection
• WP User Profile Avatar <= 1.0.5 - Cross-Site Request Forgery to Settings Update
• Libsyn Publisher Hub <= 1.4.4 - Cross-Site Request Forgery
• ARMember <= 5.5 - Unauthenticated SQL Injection via 'orderby' Parameter
• Order Export & Order Import for WooCommerce <= 2.4.3 - Authenticated (Shop Manager+) Arbitrary File Upload via upload_import_file
• Aora <= 1.3.15 - Authenticated (Contributor+) Local File Inclusion
• Infility Global <= 2.15.34 - Authenticated (Subscriber+) Arbitrary File Download
• WP Custom Admin Interface <= 7.32 - Missing Authorization to Transients Deletion
• ThemeREX Addons <= 2.32.3 - Unauthenticated Arbitrary File Upload in trx_addons_uploads_save_data
• Rank Math SEO PRO <= 3.0.35 - Reflected Cross-Site Scripting
• Project Manager – AI Powered Project Management, Task Management, Kanban Board & Time Tracker 2.1.0 - 4.0.6 - Unauthenticated Subscriber Account Creation
• Hyve Lite – AI Chatbot Trained on WordPress Posts, Pages, Products & More with ChatGPT <= 2.0.2 - Unauthenticated Insecure Direct Object Reference
• Avada Builder <= 3.11.13 - Unauthenticated Arbitrary Shortcode Execution
• NitroPack <= 1.18.4 - Missing Authorization to Authenticated (Subscriber+) Limited Settings Update via nitropack_set_compression_ajax Function
• 301 Redirects - Easy Redirect Manager < 2.51 - SQL Injection
• WordPress Ad Widget <= 2.11.0 - Local File Inclusion
• HollerBox — Fast & Effective Popups & Lead-Generation <= 2.3.14 - Unauthenticated Insecure Direct Object Reference
• Jetpack CRM <= 5.5.0 - Authenticated (Administrator+) Stored Cross-Site Scripting
• Woocommerce Vietnam Checkout <= 2.0.7 - Authenticated (Shop manager+) Stored Cross-Site Scripting
• Chameleon <= 1.4.3 - Authenticated (Administrator+) Stored Cross-Site Scripting
• Easy Google Maps < 1.14.2 - Unauthenticated Arbitrary Remote Script Inclusion
• Royal Elementor Addons <= 1.7.1064 - Authenticated (Contributor+) Stored Cross-Site Scripting
• Archivist – Custom Archive Templates <= 1.7.4 - Authenticated(Admin+) Stored Cross-Site Scripting
• Gravity Forms <= 2.9.30 - Unauthenticated Stored Cross-Site Scripting via Consent Field Hidden Input
• StreamCast – Radio Player for WordPress <= 2.1.0 - Cross-Site Scripting
• Majestic Before After Image <= 2.0.2 - Authenticated (Contributor+) Stored Cross-Site Scripting
• wpForo Forum <= 2.3.4 - Unauthenticated Sensitive Information Exposure
• Ajax Archive Calendar <= 2.6.7 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode