Vulnerability archive: section 1, page 7

Open a report to review affected versions, available fixes and original sources. Each report covers a specific issue; its presence does not establish whether your website is affected.

• Wechat Social login <= 1.3.0 - Authentication Bypass
• Backup Migration <= 1.4.3 - Information Exposure via Log Files
• Image Gallery – Photo Grid & Video Gallery <= 2.13.3 - Missing Authorization to Authenticated (Author+) Arbitrary Gallery Modification
• WoodMart - Multipurpose WooCommerce Theme <= 8.2.6 - Improper Input Validation Leading to Unauthenticated Cart Manipulation
• BulkPress <= 0.3.5 - Reflected Cross-Site Scripting
• Simple Nivo Slider <= 0.5.6 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode Attributes
• AI CoPilot <= 1.2.7 - Authenticated (Contributor+) Information Exposure
• OneTone Companion <= 1.1.1 - Open Mailer
• Seofy Core <= 1.6.8 - Unauthenticated Local File Inclusion
• Spider Calendar < 1.1.3 - Multiple Vulnerabilities
• Dracula Dark Mode - The Revolutionary Dark Mode Plugin For WordPress <= 1.0.8 - Authenticated (Contributor+) Stored Cross-Site Scripting via shortcode
• Fancy Product Designer < 6.1.81 - Authenticated (Admin+) Stored Cross-Site Scripting via Product Title
• Groundhogg <= 3.7.3.3 - Reflected Cross-Site Scripting
• WP Forum Server <= 1.6.5 - SQL Injection
• Formilla Edge <= 1.0 - Authenticated (Administrator+) Cross-Site Scripting via 'FormillaPluginID'
• Delete Comments By Status <= 2.1.1 - Unauthenticated Local File Inclusion
• Defender Security <= 2.4.6 - Cross-Site Request Forgery Bypass
• Order Export & Order Import for WooCommerce <= 2.6.0 - Authenticated (Admin+) PHP Object Injection via form_data Parameter
• Masteriyo LMS <= 2.2.0 - Missing Authorization to Unauthenticated Arbitrary Course Progress Deletion
• The Ultimate WordPress Toolkit – WP Extended <= 3.0.9 - Reflected Cross-Site Scripting
• Featured Image Plus – Quick & Bulk Edit with Unsplash <= 1.6.6 - Authenticated (Admin+) Server-Side Request Forgery
• Master Elements <= 8.0 - Unauthenticated SQL injection
• WP Job Portal – AI-Powered Recruitment System for Company or Job Board website <= 2.5.6 - Authenticated (Subscriber+) SQL Injection
• Ultimate WordPress Auction Plugin <= 4.2.7 - Missing Authorization to Unauthenticated Email Creation
• JS Job Manager <= 2.0.0 - Missing Authorization
• Login Social <= 1.0.4 - Unauthenticated Privilege Escalation via Account Takeover
• Passster <= 4.2.25 - Unauthenticated Global Content Protection Bypass
• Progressive License <= 1.1.0 - Cross-Site Request Forgery to Stored Cross-Site Scripting
• WP ERP | Complete HR solution with recruitment & job listings | WooCommerce CRM & Accounting <= 1.6.3 - Cross-Site Request Forgery Bypass
• Gutena Forms – Contact Form, Survey Form, Feedback Form, Booking Form, and Custom Form Builder <= 1.9.0 - Missing Authorization to Unauthenticated Arbitrary Form Entry Modification/Trash via process_bulk_action()
• ALL In One Custom Login Page <= 7.1.1 - Missing Authorization to Authenticated (Subscriber+)Privilege Escalation
• Chop Slider 3 <= 3.4 - Unauthenticated SQL Injection
• Dialogs <= 1.0.3 - Reflected Cross-Site Scripting
• Document Block – Upload & Embed Docs <= 1.1.0 - Missing Authorization
• Zoho SalesIQ <= 1.0.8 - Cross-Site Request Forgery
• wpForo Forum <= 2.4.1 - Authenticated (Subscriber+) Arbitrary File Read in update
• The Plus Blocks for Block Editor | Gutenberg <= 3.2.5 - Missing Authorization
• Dokan <=3.7.19 - Authenticated(Shop Manager+) PHP Object Injection via create_dummy_vendor
• Mmm Simple File List <= 2.3 - Authenticated (Subscriber+) Directory Traversal
• YOOtheme Pro <= 5.0.34 - Authenticated (Author+) Stored Cross-Site Scripting
• Pagelayer <= 2.0.7 - Improper Neutralization of CRLF Sequences to Unauthenticated Email Header Injection via 'email'
• WP Meteor Website Speed Optimization Addon <= 3.4.18 - Unauthenticated Stored Cross-Site Scripting via Comment Author Name
• CMP – Coming Soon & Maintenance Plugin by NiteoThemes < 4.1.18 - Authenticated (Editor+) Privilege Escalation
• Zarinpal Paid Downloads <= 2.3 - Reflected Cross-Site Scripting
• Welcart e-Commerce <= 2.9.4 - Cross-Site Request Forgery
• Aruba HiSpeed Cache <= 3.0.2 - Missing Authorization to Unauthenticated Plugin's Settings Modification
• UserPro <= 5.1.1 - Sensitive Information Disclosure via Shortcode
• Orbit Fox by ThemeIsle <= 2.10.30 - Authenticated (Contributor+) Stored Cross-Site Scripting
• Profile Extra Fields by BestWebSoft <= 1.2.7 - Missing Authorization to Sensitive Information Exposure
• GeekyBot — Generate AI Content Without Prompt, Chatbot and Lead Generation <= 1.2.0 - Unauthenticated SQL Injection via 'attributekey'
• Toolbox <= 1.4 - SQL Injection
• AF Companion <= 2.1.0 - Authenticated (Shop Manager+) Remote Code Execution
• HC Custom WP-Admin URL <= 1.4 - Information Exposure
• Persian Woocommerce SMS <= 7.0.10 - Authenticated (Shop manager+) SQL Injection
• Swift SMTP <= 5.0.6 - Cross-Site Request Forgery
• Image Social Feed Plugin <= 1.7.6 - Authenticated (Administrator+) Stored Cross-Site Scripting
• MyBookProgress by Stormhill Media <= 1.0.8 - Authenticated (Contributor+) Stored Cross-Site Scripting via book Parameter
• JobWP – Job Board, Job Listing, Career Page and Recruitment Plugin <= 2.3.9 - Unauthenticated SQL Injection
• Bamboo Columns <= 1.6.1 - Authenticated (Contributor+) Stored Cross-Site Scripting
• Hustle <= 7.8.4 - Authenticated (Administrator+) Stored Cross-Site Scripting
• Simple Download Monitor <= 3.9.4 - Contributor+ Arbitrary File Download
• Rich Reviews <= 1.7.4 - Stored Cross-Site Scripting
• ProfileGrid <= 5.8.7 - Missing Authorization
• wpDataTables <= 1.5.3 - Arbitrary File Upload
• WP-Recall <= 16.26.14 - Reflected Cross-Site Scripting
• ConveyThis <= 270.4 - Missing Authorization
• Hash Form – Drag & Drop Form Builder <= 1.4.0 - Cross-Site Request Forgery
• WordPress & WooCommerce Scraper Plugin, Import Data from Any WebSite. <= 1.0.7 - Unauthenticated Server-Side Request Forgery
• Fastcache by Host.it <= 1.7.4 - Authenticated (Administrator+) Code Injection via .htaccess Directive Injection via 'cache_cookie_exclude' Setting
• TheCartPress eCommerce Shopping Cart <= 1.5.3.6 - Directory Traversal
• MW WP Form <= 5.1.7 - Unauthenticated Stored Cross-Site Scripting via 'post_id' Parameter (via stored form-submitted post meta)
• VidoRev Extensions <= 2.9.9.9.9.9.5 - Missing Authorization to Unauthenticated Youtube Video Import
• myStickymenu <= 2.6.4 - Missing Authorization to Authenticated (Subscriber+) Arbitrary Form Lead Deletion
• WP Page Builder <= 1.2.6 - Authenticated (Author+) Stored Cross-Site Scripting
• Smush – Image Optimization, Compression, Lazy Load, WebP & CDN < 4.3.2 - Authenticated (Administrator+) Remote Code Execution
• Cwicly <= 1.4.0.2 - Authenticated (Contributor+) Remote Code Execution
• Theme Blvd Widget Areas <= 1.3.0 - Reflected Cross-Site Scripting
• Product Filter For WooCommerce Product <= 1.3.1 - Unauthenticated SQL Injection
• Bible Embed <= 0.0.4 - Cross-Site Request Forgery to Stored Cross-Site Scripting
• NextScripts <= 4.4.7 - Reflected Cross-Site Scripting
• Site5 Various Affected Themes (Various Versions) - Email Spoofing
• BuddyPress Groups Extras <= 3.6.10 - Cross-Site Request Forgery
• Quiz and Survey Master (QSM) – Quiz Maker & Survey Maker <= 11.2.7 - Authenticated (Contributor+) PHP Object Injection
• Product Loops for WooCommerce <= 2.1.2 - Missing Authorization
• WP Backup+ (Unknown Versions) - Sensitive Information Disclosure
• Spice Blocks <= 2.0.7.4 - Missing Authorization
• List Children <= 2.1 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode
• Listings for Buildium <= 0.1.5 - Cross-Site Request Forgery to Stored Cross-Site Scripting
• Cookie Banner, Cookie Consent, Consent Log, Cookie Scanner, Script Blocker (for GDPR, CCPA & ePrivacy) : WP Cookie Consent <= 4.0.7 - Missing Authorization to Unauthenticated Arbitrary Post Deletion
• Ivory Search – WordPress Search Plugin <= 5.5.6 - Information Exposure via AJAX Search Form
• WP-reCAPTCHA-bp <= 4.1 - Authenticated (Administrator+) Stored Cross-Site Scripting
• Varnish WordPress <= 1.7 - Cross-Site Request Forgery to Stored Cross-Site Scripting
• YITH WooCommerce Wishlist <= 4.12.0 - Unauthenticated Insecure Direct Object Reference
• WP-Table Reloaded <= 1.9.3 - Cross-Site Scripting
• Viral Signup <= 2.1 - Authenticated (Admin+) Stored Cross-Site Scripting
• SMS Alert Order Notifications <= 3.8.5 - Unauthenticated SQL Injection
• Breeze <= 2.1.14 - Authenticated (Administrator+) Stored Cross-Site Scripting
• Redirect 404 Error Page to Homepage or Custom Page with Logs <= 1.7.8 - Log Deletion via Cross-Site Request Forgery
• WP Fastest Cache <= 1.1.2 - Cross-Site Request Forgery via 'wpfc_pause_cdn_integration_ajax_request_callback'
• WooCommerce PDF Vouchers < 4.9.9 - Reflected Cross-Site Scripting