Vulnerability archive: section 2, page 2

Open a report to review affected versions, available fixes and original sources. Each report covers a specific issue; its presence does not establish whether your website is affected.

• PubyDoc <= 2.0.6 - Authenticated (Admin+) Stored Cross-Site Scripting
• PostX <= 4.1.12 - Authenticated (Contributor+) Stored Cross-Site Scripting
• Premium Addons for Elementor <= 4.10.27 - Authenticated (Contributor+) Stored Cross-Site Scripting via Button
• Silencesoft RSS Reader <= 0.6 - Cross-Site Request Forgery to RSS Feed Deletion
• Rate my Post – WP Rating System <= 3.3.4 - Race Condition
• Slides & Presentations <= 0.0.39 - Missing Authorization
• TheGem Theme Elements <= 5.11.1 - Authenticated (Contributor+) Local File Inclusion
• WooCommerce PDF Invoices & Packing Slips <= 2.14.5 - Cross-Site Scripting
• Arigato Autoresponder and Newsletter <= 2.7.2.2 - Cross-Site Request Forgery
• MarketKing — Ultimate WooCommerce Multivendor Marketplace Solution <= 2.1.60 - Missing Authorization
• xSpeed Cache: AI-Powered Performance Hub with MCP, Caching & CDN <= 1.4.2 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'post_content' Parameter
• Simple Membership <= 4.7.1 - Missing Authorization
• Curtain <= 1.0.2 - Authenticated (Admin+) Stored Cross-Site Scripting
• The Conference <= 1.2.5 - Missing Authorization
• Tourfic <= 2.14.5 - Missing Authorization in Multiple Functions
• WPLP Cookie Consent <= 4.4.1 - Missing Authorization
• AI Engine: ChatGPT Chatbot <= 1.9.98 - Unauthenticated Arbitrary File Upload via rest_upload
• WPC Smart Quick View for WooCommerce <= 4.2.1 - Authenticated (Contributor+) Stored Cross-Site Scripting via woosq_btn Shortcode
• WP smart CRM & Invoices FREE <= 1.8.7 - Stored Cross-Site Scripting
• StreamWeasels Twitch Integration <= 1.7.5 - Authenticated (Contributor+) Stored Cross-Site Scripting
• FreshMail For WordPress <= 2.3.2 - Reflected Cross-Site Scripting
• WPCHURCH <= 2.7.0 - Authenticated (Subscriber+) Privilege Escalation
• ELEX WooCommerce Google Shopping (Google Product Feed) <= 1.4.3 - Authenticated (Admin+) SQL Inejction
• Mailster <= 4.0.6 - Unauthenticated Local File Inclusion
• GiveWP <= 2.25.1 - Authenticated (Contributor+) Stored Cross-Site Scripting via give_form_grid shortcode
• Ultimate Carousel For WPBakery Page Builder <= 2.6 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode
• Icegram Engage – Popups, Optins, CTAs & Lead Generation <= 3.1.31 - Authenticated (Contributor+) PHP Object Injection
• Custom Bulk/Quick Edit <= 1.6.10 - Cross-Site Request Forgery
• Child Theme Creator by Orbisius <= 1.5.5 - Missing Authorization to Authenticated (Subscriber+) Cloud Snippet Update/Delete
• Premium Addons for KingComposer <= 1.1.1 - Unauthenticated Local File Inclusion
• Team Showcase <= 1.22.28 - Authenticated (Contributor+) Stored Cross-Site Scripting
• Seraphinite Accelerator <= 2.29.18 - Reflected Cross-Site Scripting
• Shockingly Simple Favicon <= 1.8.2 - Cross-Site Request Forgery
• LeadBI Plugin for WordPress <= 1.7 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'form_id' Shortcode Attribute
• WP Affiliate Platform <= 6.5.0 - Cross-Site Request Forgery to Cross-Site Scripting
• WidgetKit <= 2.5.0 - Authenticated (Contributor+) Stored Cross-Site Scripting
• Hover Effects <= 2.1.2 - Authenticated (Administrator+) SQL Injection
• Play.ht – Make Your Blog Posts Accessible With Text to Speech Audio <= 3.6.4 - Authenticated (Contributor+) PHP Object Injection
• Complete Open Graph <= 3.4.5 - Authenticated (Administrator+) Stored Cross-Site Scripting
• Cornerstone < 7.8.8 - Authenticated (Subscriber+) SQL Injection
• WpStream – Live Streaming, Video on Demand, Pay Per View <= 4.5.4 - Cross-Site Request Forgery via wpstream_update_local_event_settings
• Universal Video Player <= 3.8.3 - Reflected Cross-Site Scripting
• Soumettre.fr <= 2.1.5 - Improper Authorization to Unauthenticated Soumettre Posts Creation/Modification/Deletion
• K Elements < 5.5.0 - Authenticated (Contributor+) Stored Cross-Site Scripting
• Civi Framework <= 2.1.6.3 - Cross-Site Request Forgery
• WPtouch < 1.9.20 - Cross-Site Scripting
• Drag and Drop Multiple File Upload for Contact Form 7 <= 1.3.9.7 - Authenticated (Administrator+) Stored Cross-Site Scripting via 'drag_n_drop_text' and 'drag_n_drop_browse_text' Settings
• asMember <= 1.5.4 - Authenticated (Administrator+) Stored Cross-Site Scripting
• AI for SEO <= 1.2.9 - Missing Authorization
• Team Circle Image Slider With Lightbox 1.0 - Cross-Site Request Forgery
• JaviBola Custom Theme Test <= 2.0.5 - Cross-Site Request Forgery
• Energia <= 1.1.2 - Unauthenticated Arbitrary File Upload
• Chatbot for WordPress by Collect.chat ⚡️ <= 2.4.3 - Authenticated (Admin+) Stored Cross-Site Scripting
• EazyDocs <= 2.3.5 - Unauthenticated Stored Cross-Site Scripting via edit_doc_one_page
• MailChimp Forms by MailMunch <= 3.2.2 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode
• Embedder for Google Reviews <= 1.7.3 - Missing Authorization
• Restaurant Solutions – Checklist 1.0.0 - Authenticated (Admin+) Stored Cross-Site Scripting
• JetSearch <= 3.5.10.1 - Authenticated (Contributor+) Stored Cross-Site Scripting
• Email Notifications for Updates <= 1.1.6 - Missing Authorization to Authenticated (Subscriber+) Arbitrary Options Update
• Plethora Plugins Tabs + Accordions <= 1.1.8 - Authenticated (Contributor+) Stored Cross-Site Scripting via anchor
• LiveJournal Shortcode <= 1.1.1 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode
• Web To Print Shop : uDraw <= 3.3.3 - Unauthenticated Arbitrary File Access
• WPPizza <= 3.19.4 - Reflected Cross-Site Scripting
• Security Audit <= 1.0.0 - Authenticated (Admin+) Cross-Site Scripting
• Clinked Client Portal <= 1.9 - Authenticated (Contributor+) Stored Cross-Site Scripting
• Easy Testimonials <= 3.8 - Reflected Cross-Site Scripting
• Theme Editor <= 2.5 - Authenticated Arbitrary File Download
• Two Factor Authentication < 1.1.10 - Cross-Site Scripting
• WooCommerce Follow-Up Emails <= 4.9.40 - Cross-Site Request Forgery
• Getwid – Gutenberg Blocks <= 2.0.12 - Authenticated (Contributor+) Stored Cross-Site Scripting
• Advanced File Manager <= 5.1 - Authenticated (Administrator+) Arbitrary File and Folder Access
• Context Blog <= 1.2.5 - Unauthenticated Private Post Disclosure
• WordPress Core <= 7.1.1 - Unauthenticated Local File Inclusion via locate_template() Path Traversal
• Tiny Contact Form <= 0.7 - Cross-Site Request Forgery
• Translate WordPress - Google Language Translator <= 6.0.11 - Admin+ Stored Cross-Site Scripting
• Admin Customization <= 2.2 - Cross-Site Request Forgery to Stored Cross-Site Scripting
• YIT Plugin Framework <= 3.3.8 - Authenticated Settings Change
• WP Rollback – Rollback Plugins and Themes <= 3.1.2 - Unauthenticated Information Exposure
• Social Media Share Buttons & Social Sharing Icons <= 2.1.7 - Reflected Cross-Site Scripting
• Easy Digital Downloads – eCommerce Payments and Subscriptions made easy <= 3.7.0 - Authenticated (Shop Manager+) SQL Injection
• Advanced post slider <= 3.0.0 - Authenticated (Contributor+) Stored Cross-Site Scripting
• Everest Forms <= 3.0.4.1 - Authenticated (Admin+) Stored Cross-Site Scripting
• Permalink Manager Lite <= 2.4.4 - Missing Authorization to Unauthenticated Sensitive Information Exposure
• Frontend File Manager Plugin <= 23.5 - Unauthenticated Insecure Direct Object Reference
• WPJAM Basic <= 6.9.2 - Authenticated (Subscriber+) Arbitrary File Upload
• WangGuard < 1.8.0 - Unauthenticated Stored Cross-Site Scripting
• Enable Media Replace <= 4.1.4 - Reflected Cross-Site Scripting
• Post Index <= 0.7.5 Cross-Site Request Forgery to Stored Cross-Site Scripting
• Demi <= 0.0.8 - Unauthenticated Information Exposure to Arbitrary Directory Copy
• Booking Package <= 1.6.72 - Reflected Cross-Site Scripting via Locale Parameter
• Melapress Role Editor <= 1.1.1 - Improper Authorization to Authenticated (Subscriber+) Privilege Escalation via Secondary Role Assignment
• Smart Slider 3 Pro 3.5.1.35 - Backdoor Embedded via Supply Chain Compromise
• Easy EU Cookie law <= 1.3.3.1 - Authenticated (Subscriber+) Stored Cross-Site Scripting
• FeedFocal <= 1.2.2 - Missing Authorization via feedfocal_api_setup REST function
• Greenorganic <= 2.45 - Unauthenticated Local File Inclusion
• ColorMag <= 3.1.6 - Authenticated (Contributor+) Stored Cross-Site Scripting via Display Name
• Small Package Quotes – Unishippers Edition <= 2.4.9 - Missing Authorization
• SureForms – Contact Form Builder, AI Forms, Payment Form, Survey & Quiz <= 2.12.5 - Unauthenticated Insecure Direct Object Reference
• WooCommerce PDF Invoices <= 4.2.1 - Authenticated(Shop Manager+) Arbitrary Options Update via JSON Import
• Elementor Addons by Livemesh <= 8.5 - Authenticated (Contributor+) Stored Cross-Site Scripting via piechart_settings Parameter