Vulnerability archive: section 2, page 10

Open a report to review affected versions, available fixes and original sources. Each report covers a specific issue; its presence does not establish whether your website is affected.

• Add User Meta <= 1.0.1 - Cross-Site Request Forgery to Stored Cross-Site Scripting
• miniorange otp verification <= 5.5.1 - Unauthenticated Stored Cross-Site Scripting
• Booking for Appointments and Events Calendar – Amelia Premium <= 7.7 and Lite <= 1.2.4 - Missing Authorization to Sensitive Information Exposure
• Golo Framework <= 1.7.3 - Authenticated (Contributor+) Local File Inclusion
• Envira Photo Gallery <= 1.8.14 - Missing Authorization
• Simply Schedule Appointments <= 1.6.12.35 - Unauthenticated Stored Cross-Site Scripting via 'status' Parameter via /wp-json/ssa/v1/appointments/{id}
• Barberry <= 2.9.9.87 - Unauthenticated Local File Inclusion
• WP Ultimate Exporter <= 2.9.1 - Authenticated (Admin+) Remote Code Execution
• Contact Form 7 – PayPal & Stripe Add-on <= 1.9.3 - Cross-Site Request Forgery
• Eventin <= 4.1.23 - Missing Authorization
• Custom css-js-php <= 2.0.7 - Unauthenticated Remote Code Execution
• Payment Forms for Paystack <= 3.4.1 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode
• VaultPress <=1.9 - Remote Code Execution
• Variation Swatches for WooCommerce <= 1.0.61 - Reflected Cross-Site Scripting
• Users Ultra Membership, Users Community and Member Profiles With PayPal Integration Plugin <= 1.3.58 - SQL Injection
• Sticky Header Effects for Elementor <= 2.1.3 - Missing Authorization
• Chained Quiz <= 1.1.9 -Stored Cross-Site Scripting
• Quote Comments <= 3.0.0 - Missing Authorization to Authenticated (Subscriber+) Arbitrary Plugin Settings Update
• WPRecovery <= 2.0 - Unauthenticated SQL Injection to Arbitrary File Deletion
• WP Job Portal <= 2.2.8 - Authenticated (Contributor+) Local File Inclusion
• BEAR <= 1.1.3.3 - Cross-Site Request Forgery to Product Manipulation
• Real Time Validation for Gravity Forms <= 1.7.0 - Reflected Cross-Site Scripting
• PageLayer <= 1.7.7 - Cross-Site Request Forgery via pagelayer_load_plugin
• Link Checker <= 1.16.2 - Unauthenticated Stored Cross-Site Scripting
• Photo Gallery Slideshow & Masonry Tiled Gallery <= 1.0.13 - Reflected Cross-Site Scripting
• Import into Easy Property Listings <= 2.2.1 - Cross-Site Request Forgery
• Multiple Shipping Address Woocommerce < 2.0 - Unauthenticated SQL Injection
• WP-OliveCart <= 1.1.3 - Authenticated (Administrator+) Stored Cross-Site Scripting
• add custom google tag manager <= 1.0.3 - Cross-Site Request Forgery to Stored Cross-Site Scripting
• Classipress <= 3.1.4 - Stored Cross-Site Scripting
• Simple SEO <= 1.8.12 - Cross-Site Request Forgery to Sitemap Deletion/Creation
• WC Fields Factory <= 4.1.12 - Authenticated (Subscriber+) Stored Cross-Site Scripting
• ResponsiveVoice Text To Speech <= 1.7.6 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode
• PORTONE 우커머스 결제 <= 3.2.5 - Reflected Cross-Site Scripting
• IBS Mappro < 1.0 - Directory Traversal
• Popup Box 6.4.1 - 6.4.2 - Unauthenticated Arbitrary Shortcode Execution via Client-IP / X-Forwarded-For HTTP Headers
• User Profile Builder <= 4.0.3 - Authenticated (Subscriber+) Stored Cross-Site Scripting via 'display_name' Parameter
• The Events Calendar <= 6.11.2.1 - Missing Authorization
• Simple Folio <= 1.1.0 - Cross-Site Request Forgery
• SpaBiz <= 1.0.18 - Authenticated (Contributor+) Stored Cross-Site Scripting
• Simple Google Static Map <= 1.0.1 - Authenticated (Contributor+) Stored Cross-Site Scripting
• Simple Fields <= 0.3.5 - Unauthenticated Local File Inclusion
• Visualizer <= 3.7.6 - Reflected Cross-Site Scripting
• GD Rating System <= 3.7 - Authenticated (Contributor+) SQL Injection
• month name translation benaceur <= 2.3.7 - Authenticated (Admin+) Stored Cross-Site Scripting
• WP Custom Pages <= 0.5.0.1 - Path Traversal
• Frontend File Manager <= 23.5 - Missing Authorization
• Slider by 10Web <= 1.2.51 - Admin+ Stored Cross-Site Scripting
• Import Export Lite <= 3.9.32 - Authenticated (Admin+) Path Traversal to Arbitrary Directory Deletion
• Process Steps Template Designer <= 1.2.1 - Cross-Site Request Forgery
• Import Export For WooCommerce <= 1.6.2 - Missing Authorization to Authenticated (Subscriber+) Settings Update
• Catalyst Connect Zoho CRM Client Portal <= 2.0.0 - Authenticated (Administrator+) Stored Cross-Site Scripting
• MailChimp Subscribe Form, Optin Builder, PopUp Builder, Form Builder <= 4.3.3 - Unauthenticated Stored Cross-Site Scripting via Form Field Values
• WP Cafe Pro <= 3.0.14 - Authenticated (Author+) Local File Inclusion
• FormGent <= 1.9.2- Missing Authorization to Unauthenticated Arbitrary File Deletion via 'file_token' Parameter
• Floating Social Media Links <= 1.5.2 - Authenticated (Administrator+) Stored Cross-Site Scripting
• Ultimate Learning Pro <= 3.9.1 - Reflected Cross-Site Scripting
• Tooltipy <= 5.5.6 - Authenticated (Contributor+) Stored Cross-Site Scripting
• WP-Ban-User <= 1.0 - Cross-Site Request Forgery to Cross-Site Scripting
• The FOX – Currency Switcher Professional for WooCommerce <= 1.4.2.2 - Unauthenticated Arbitrary Shortcode Execution
• DesignThemes Core <= 1.6 - Authenticated (Contributor+) Stored Cross-Site Scripting
• RESTful Content Syndication 1.1.0 - 1.5.0 - Authenticated (Contributor+) Arbitrary File Upload
• Secure Copy Content Protection and Content Locking <= 2.8.1 - Unauthenticated SQL Injection
• pixfort Core <= 3.2.22 - Missing Authorization
• Mang Board WP <= 1.8.0 - Reflected Cross-Site Scripting
• JetMenu <= 2.4.9 - Missing Authorization
• Meta Field Block <= 1.2.13 - Authenticated (Contributor+) Stored Cross-Site Scripting
• FiveStar <= 1.7 - Authenticated (Subscriber+) Insecure Direct Object Reference
• Photo Gallery, Images, Slider in Rbs Image Gallery <= 3.2.19 - Authenticated (Author+) Stored Cross-Site Scripting via Image Title
• s2Member – Excellent for All Kinds of Memberships, Content Restriction Paywalls & Member Access Subscriptions <= 241216 - Reflected Cross-Site Scripting
• NGG Smart Image Search <= 3.4.3 - Authenticated (Contributor+) Stored Cross-Site Scripting
• Import Export All WordPress Images, Users & Post Types <= 3.8.7 - Reflected Cross-Site Scripting
• ImageRecycle pdf & image compression <= 3.1.13 - Cross-Site Request Forgery to Plugin Data Removal in reinitialize
• Multivendor Marketplace Solution for WooCommerce – WC Marketplace < 3.8.4 - Reflected Cross-Site Scripting
• RegistrationMagic <= 5.2.3.0 - Missing Authorization
• KiviCare <= 3.6.6 - Authenticated (Patient+) Insecure Direct Object Reference
• Simple Pull Quote <= 1.6.3 - Authenticated (Contributor+) Stored Cross-Site Scripting
• WordPress File Upload <= 2.4.3 - Reflected Cross-Site Scripting
• Football Pool <= 2.12.5 - Authenticated (Contributor+) Stored Cross-Site Scripting
• Multicollab: Content Team Collaboration and Editorial Workflow <= 5.2 - Missing Authorization to Authenticated (Subscriber+) Collaboration Comment
• ML Responsive Audio player with playlist Shortcode <= 0.2 - Authenticated (Contributor+) Stored Cross-Site Scripting
• Tutor LMS – eLearning and online course solution <= 1.7.6 - Unprotected AJAX including Privilege Escalation
• Citizen Space <= 1.1 - Reflected Cross-Site Scripting
• League of Legends Shortcodes <= 1.0.1 - Authenticated (Contributor+) SQL Injection via Shortcode
• User Feedback <= 1.0.10 - Missing Authorization
• Poll Builder <= 1.3.5 - Authenticated (Contributor+) Stored Cross-Site Scripting
• WPBakery Page Builder <= 8.6.1 - Stored Cross-Site Scripting via Custom JS Module
• Reebox < 1.4.8 - Reflected Cross-Site Scripting
• GetYourGuide Ticketing <= 1.0.2 - Authenticated (Admin+) Stored Cross-Site Scripting
• Gravity SMTP <= 2.1.4 - Unauthenticated Sensitive Information Exposure via REST API
• BetterDocs <= 4.3.10 - Unauthenticated Information Exposure
• ThemeMove Core <= 1.4.2 - Authenticated (Subscriber+) PHP Object Injection
• All custom fields & groups <= 1.04 - Reflected Cross-Site Scripting
• Download Manager <= 3.3.51 - Missing Authorization to Authenticated (Contributor+) Media File Protection Removal
• Uncanny Automator – AI + Automation for WordPress | AI Agent, AI Page Builder, Free AI Usage Included <= 7.6.1.1 - Authenticated (Subscriber+) PHP Object Injection to Arbitrary File Deletion
• Moka Get Posts Shortcode <= 1.0 - Authenticated (Contributor+) Stored Cross-Site Scripting
• Master Bar <= 1.0 - Reflected Cross-Site Scripting
• 6Storage Rentals <= 2.19.6 - Missing Authorization
• Easy Tweet Embed <= 1.7 - Authenticated (Contributor+) Stored Cross-Site Scripting
• User Registration & Membership – Free & Paid Memberships, Subscriptions, Content Restriction, User Profile, Custom User Registration & Login Builder <= 5.2.8 - Missing Authorization