Vulnerability archive: section 2, page 19

Open a report to review affected versions, available fixes and original sources. Each report covers a specific issue; its presence does not establish whether your website is affected.

• Page Builder Sandwich – Front-End Page Builder <= 5.1.0 - Authenticated (Contributor+) Stored Cross-Site Scripting
• Multilevel Referral Affiliate Plugin for WooCommerce <= 2.28 - Authenticated (Subscriber+) SQL Injection
• Checkout Field Editor for WooCommerce – Checkout Manager <= 3.0.5 - Authenticated (Shop manager+) Stored Cross-Site Scripting
• Simple Ads Manager < 2.7.97 - Multiple SQL Injections
• FuseDesk <= 6.8 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'emailtext' Shortcode Attribute
• Solace Extra <= 1.6.0 - Missing Authorization to Unauthenticated Site Content Deletion and Unauthorized Demo Import via action-import-zip AJAX Action
• Önceki Yazı Link <= 1.3 - Cross-Site Request Forgery
• Intagrate Lite <= 1.3.7 - Authenticated (Admin+) Stored Cross-Site Scripting
• Access Areas <= 1.5.19 - Reflected Cross-Site Scripting
• Real3D Flipbook Lite – 3D FlipBook, PDF Viewer, PDF Embedder <= 4.8 - Authenticated (Author+) Arbitrary File Upload
• CHATLIVE <= 2.0.1 - Unauthenticated SQL Injection
• Mindio Magic MCP <= 0.5.6 - Authenticated (Subscriber+) Information Exposure
• leadlovers forms <= 1.0.2 - Missing Authorization
• Selection Lite <= 1.13 - Authenticated (Contributor+) Stored Cross-Site Scripting
• Ultimate Store Kit – Addon For WooCommerce, EDD and Elementor <= 3.0.5 - Missing Authorization
• SpiderFAQ <= 1.3.2 - Reflected Cross-Site Scripting
• Advanced Access Manager <= 6.6.1 - Authenticated Information Disclosure
• Calculated Fields Form <= 5.5.1.3 - Reflected DOM-Based Cross-Site Scripting via 'x' URL Query Parameter via Text Area Predefined Value
• WooCommerce License Manager <= 7.0.6 - Authenticated (Shop Manager+) Arbitrary File Upload
• BetterDocs <= 4.3.11 - Missing Authorization to Authenticated (Subscriber+) Unauthorized AI API Usage
• WP Hide <= 0.0.2 - Missing Authorization to Settings Update
• Quiz And Survey Master <= 10.3.3 - Missing Authorization
• Timely Booking Button <= 2.0.2 - Authenticated (Administrator+) Stored Cross-Site Scripting
• NPS computy <= 2.7.5 - Authenticated (Admin+) Stored Cross-Site Scripting
• 1-Click Backup & Restore Database <= 1.0.3 - Missing Authorization
• Crypto <= 2.15 - Cross-Site Request Forgery to Authentication Bypass
• Order Delivery Date for WP e-Commerce Pro <= 12.4.0 - Reflected Cross-Site Scripting
• Gallery from files <= 1.60 - Reflected Cross-Site Scripting
• WP Directory Kit <= 1.2.9 - Reflected Cross-Site Scripting
• Responsive Lightbox2 <= 1.0.2 - Cross-Site Scripting
• Pricing Table by Supsystic <= 1.9.4 - Reflected Cross-Site Scripting
• Same but Different – Related Posts by Taxonomy <= 1.0.16 - Reflected Cross-Site Scripting
• Ninja Forms Contact Form <= 2.9.18 - Cross-Site Scripting
• WP-Picasa-Image <= 1.0 - Reflected Cross-Site Scripting
• MagicForm - WordPress Form Builder <= 1.6.2 - Missing Authorization
• PowerPress <= 10.0 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode
• Institutions Directory <= 1.3.4 - Missing Authorization
• Themify Store Locator <= 1.1.9 - Cross-Site Request Forgery
• Display product variations dropdown on shop page <= 1.1.3 - Missing Authorization
• Metform Elementor Contact Form Builder <= 3.3.0 - Authenticated (Contributor+) Stored Cross-Site Scripting via mf shortcode
• JetBlog <= 2.4.4 - Reflected Cross-Site Scripting
• Gallery Bank – WordPress Photo Gallery Plugin <= 4.0.50 - Stored Cross-Site Scripting via Gallery Description
• Appointment Booking and Scheduling Calendar Plugin – WP Timetics <= 1.0.36 - Missing Authorization to Unauthenticated Booking Details View And Modification
• Fluent Forms <= 6.2.8 - Unauthenticated Sensitive Information Exposure via Insecure Direct Object Reference and Weak Transaction Hash in 'transaction' Parameter
• Photo Gallery by Supsystic <= 1.15.5 - Cross-Site Request Forgery to Plugin Settings Change
• Login Lockdown & Protection <= 2.14 - IP Block Bypass
• Build Your Dream Website Fast with 400+ Starter Templates and Landing Pages, No Coding Needed, One-Click Import for Elementor & Gutenberg Blocks! – TemplateSpare <= 2.4.2 - Missing Authorization to Authenticated (Subscriber+) Theme Update
• Guest Author <= 2.3 - Authenticated Stored Cross-Site Scripting
• MaxGalleria <= 6.5.3 - Unauthenticated Stored Cross-Site Scripting
• ElementsCSS Addons for Elementor <= 1.0.8.7 - Authenticated (Contributor+) Stored Cross-Site Scripting
• Simple Posts Ticker <= 1.1.5 - Authenticated(Contributor+) Stored Cross-Site Scripting via shortcode
• LearnPress Export Import <= 4.0.3 - Reflected Cross-Site Scripting
• Photo Gallery Builder <= 3.0 - Missing Authorization
• AIKTP <= 5.0.04 - Missing Authorization to Authenticated (Subscriber+) Multiple Administrator Actions
• Smart Mockups <= 1.2.0 - Authenticated (Contributor+) Stored Cross-Site Scripting
• Taxi Booking Manager for WooCommerce – WordPress plugin | Ecab <= 1.0.9 - Authenticated (Admin+) Stored Cross-Site Scripting
• WordPress Poll <= 34.05 - SQL Injection
• Be Shortcodes <= 1.0.0 - Authenticated (Contributor+) Stored Cross-Site Scripting
• WP Comment Remix <= 1.4.3 - SQL Injection
• Coupon Tab for DirectoryPress (pp-coupon-tab) <= 0.2.0 - Reflected Cross-Site Scripting
• Checkout Field Editor (Premium) < 1.7.5 - Cross-Site Request Forgery
• Nexi XPay Build 7.6.1 - 7.6.2 - Unauthenticated Insecure Direct Object Reference
• AI Engine <= 3.3.2 - Authenticated (Editor+) Arbitrary File Upload via 'filename' Parameter in update_media_metadata Endpoint
• Shirt Product Designer for WooCommerce 1.0.4 - Missing Authorization
• Media Library Alt Text Editor <= 1.0.0 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'post_id' Shortcode Attribute
• Widget Options <= 4.0.6.1 - Missing Authorization
• Education LMS <= 0.0.7 - Authenticated (Contributor+) Stored Cross-Site Scripting
• Download Manager <= 3.3.71 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'regurl' Shortcode Attribute
• CRM Perks – WordPress HelpDesk Integration – Zendesk, Freshdesk, HelpScout <= 1.1.6 - Authenticated (Contributor+) Stored Cross-Site Scripting
• Pochipp < 1.18.9 - Missing Authorization
• WPLMS Plugin < 1.9.9.8.2 - Unauthenticated SQL Injection
• Portfolio Gallery <= 1.4.8 - Missing Authorization
• Gravity Forms <= 2.10.0 - Unauthenticated Stored Cross-Site Scripting via Product Option
• Uptime Robot <= 0.1.3 - Cross-Site Request Forgery to Stored Cross-Site Scripting
• WPSyncSheets Lite For Elementor – Elementor Pro Form Google Spreadsheet Addon <= 1.4 - Running Vulnerable Dependencies
• HD Quiz <= 1.8.14 - Authenticated (Editor+) Stored Cross-Site Scripting
• SetMore Theme – Custom Post Types <= 1.1 - Authenticated (Contributor+) Stored Cross-Site Scripting
• Theme Tuner < 0.8 - Remote File Inclusion
• Radio Player <= 2.0.73 - Missing Authorization to Player Update
• Estatik <= 4.3.2 - Cross-Site Request Forgery
• MasterStudy LMS – Online Courses, eLearning PRO Plus <= 4.7.9 - Authenticated (Subscriber+) Arbitrary File Upload
• Shortcodes and extra features for Phlox theme <= 2.16.3 - Authenticated (Contributor+) Stored Cross-Site Scripting via Modern Heading and Icon Picker Widgets
• WP FEvents Book <= 0.46 - Authenticated (Subscriber+) Stored Cross-Site Scripting
• Accessibility Checker by Equalize Digital <= 1.30.0 - Authenticated (Contributor+) Insecure Direct Object Reference
• TablePress <= 2.4.2 - Authenticated (Author+) Stored Cross-Site Scripting
• WP Dropbox Dropins <= 1.0 - Unauthenticated Arbitrary File Upload
• WordPress Core < 5.4.2 - Open Redirect
• Dino Game – Embed Google Chrome Dinosaur Game in WordPress <= 1.1.0 - Authenticated (Contributor+) Stored Cross-Site Scripting
• User Activity Log Pro <= 2.3.4 - Authenticated (Subscriber+) SQL Injection
• Rebuild Permalinks <= 1.6 - Reflected Cross-Site Scripting
• WP Sticky Button <= 1.3 - Unauthenticated Stored Cross-Site Scripting
• Pie Register – User Registration Forms. Invitation based registrations, Custom Login, Payments < 3.1.2 - SQL Injection
• PowerPack Pro for Elementor <= 2.10.17 - Authenticated (Contributor+) Privilege Escalation
• FluentAuth <= 1.0.1 - IP Spoofing to Protection Mechanism Bypass
• Progress Bar <= 2.1.6 - Authenticated (Contributor+) Stored Cross-Site Scripting via wppb shortcode
• Video Conferencing with Zoom <= 4.0.9 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode
• Spreadsheet Integration and Spreadsheet Integration Pro <= 3.5.0 - Reflected Cross-Site Scripting
• User Frontend: AI Powered Frontend Posting, User Directory, Profile, Membership & User Registration <= 4.2.8 - Missing Authorization
• JupiterX Theme <= 3.0.0 - Authenticated Local File Inclusion via print_pane
• Element Pack Addons for Elementor – MCP & AI-Ready Elementor Widgets, Elementor Templates, Elementor Addons <= 8.8.8 - Authenticated (Contributor+) Stored Cross-Site Scripting