Vulnerability archive: section 2, page 20

Open a report to review affected versions, available fixes and original sources. Each report covers a specific issue; its presence does not establish whether your website is affected.

• Link to URL / Post <= 1.3 - Authenticated (Administrator+) SQL Injection
• Announcement & Notification Banner – Bulletin <= 3.5.1 - Authenticated (Subscriber+) Stored Cross-Site Scripting
• Entrepreneur - Booking for Small Businesses WordPress <= 3.1.3 - Authenticated (Subscriber+) PHP Object Injection
• Unicamp <= 2.6.3 - Unauthenticated Local File Inclusion
• Age Gate <= 3.5.3 - Unauthenticated Local PHP File Inclusion via 'lang'
• Careerfy < 3.9.0 - Cross-Site Scripting
• ERE Recently Viewed <= 1.3 - Unauthenticated PHP Object Injection
• WP Business intelligence lite < 1.3 - Arbitrary File Upload
• FuseWP – WordPress User Sync to Email List & Marketing Automation (Mailchimp, Constant Contact, ActiveCampaign etc.) <= 1.1.23.0 - Cross-Site Request Forgery to Sync Rule Creation
• MailerLite – Signup forms (official) 1.5.0 - 1.7.6 - Authenticated (Contributor+) Stored Cross-Site Scripting
• Gutenverse – Ultimate WordPress FSE Blocks Addons & Ecosystem <= 3.5.3 - Authenticated (Contributor+) Server-Side Request Forgery via 'imageUrl'
• Titan Framework <= (Various Versions) - Reflected Cross-Site Scripting
• MailerLite – WooCommerce integration <= 2.0.8 - Missing Authorization via Multiple Functions
• WP-Announcements <= 1.8 - Reflected Cross-Site Scripting
• Index Now <= 2.6.3 - Cross-Site Request Forgery via reset_form
• Masteriyo - LMS <= 1.11.4 - Authenticated (Student+) Insecure Direct Object Reference
• Extra Post Images <= 1.0 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode Attributes
• WPCode <= 2.0.6 - Missing Authorization to Sensitive Key Disclosure/Update
• Smart WeTransfer <= 1.3 - Missing Authorization
• Smarty for WordPress <= 3.1.35 - Cross-Site Request Forgery via displaySmartyManagementPage
• Contact List <= 3.0.18 - Authenticated (Contributor+) Stored Cross-Site Scripting via '_cl_map_iframe' Parameter
• Eventer <= 3.9.6 - Unauthenticated SQL Injection
• Accessibly <= 3.0.3 - Missing Authorization to Unauthenticated Stored Cross-Site Scripting via Widget Source Injection via REST API
• Barcode Generator for WooCommerce <= 2.0.4 - Authenticated (Subscriber+) Arbitrary Content Deletion
• JetFormBuilder — Dynamic Blocks Form Builder <= 3.6.6 - Missing Authorization
• NEX-Forms – Ultimate Form Builder <= 8.5.10 - Authenticated (Contributor+) Stored Cross-Site Scripting
• Community Events <= 1.4.8 - Authenticated (Administrator+) Stored Cross Site Scripting
• WP-dTree <= 4.4.5 - Cross-Site Request Forgery
• Stripe Payment Forms by WP Full Pay – Accept Credit Card Payments, Donations & Subscriptions < 8.5.1 - Unauthenticated Information Exposure
• Atarim <= 4.0 - Missing Authorization
• Lemonade Social Networks Autoposter Pinterest <= 2.0 - Reflected Cross-Site Scripting
• All-In-One Security <= 5.1.2 - Information Disclosure
• Flower Delivery by Florist One <= 3.9 - Authenticated (Contributor+) Stored Cross-Site Scripting
• Gutenverse <= 1.9.4 - Authenticated (Contributor+) Stored Cross-Site Scripting
• User Frontend: AI Powered Frontend Posting, User Directory, Profile, Membership & User Registration <= 4.2.8 - Authenticated (Author+) Arbitrary File Upload
• Current Age Plugin <= 1.6 - Cross-Site Request Forgery
• WP SmartPay <= 2.7.13 - Authenticated (Subscriber+) Account Takeover
• Simple Popup Newsletter <= 1.4.7 - Reflected Cross-Site Scripting
• Qwery - Multi-Purpose Business WordPress & WooCommerce Theme + ChatGPT <= 3.6.1 - Unauthenticated PHP Object Injection
• Avada <= 5.1.4 - Stored Cross-Site Scripting
• WordPress Ping Optimizer <= 2.35.1.2.3 - Cross-Site Request Forgery
• AllAble Connector <= 0.13.4 - Missing Authorization
• Modern Events Calendar < 7.35.0 - Unauthenticated SQL Injection
• Kunze Law <= 2.1 - Authenticated (Administrator+) Stored Cross-Site Scripting
• Quiz Maker <= 6.2.0.8 - SQL Injection
• iVysilani Shortcode <= 3.0 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'width' Shortcode Attribute
• MP3 Sticky Player <= 8.0 - Unauthenticated Arbitrary File Read/Download
• LayerSlider <= 7.7.9 - Authenticated (Contributor+) Stored Cross-Site Scripting
• Social Media Share Buttons & Social Sharing Icons <= 2.9.9 - Unauthenticated Stored Cross-Site Scripting
• wpDiscuz <= 7.6.10 - Insufficient Authorization to Comment Submission on Deleted Posts
• Flipmart - MegaOne Multipurpose WordPress Theme <= 2.8 - Unauthenticated Local File Inclusion
• The School Management Pro <= 9.9.6 - Remote Code Execution
• WP Stripe Checkout <= 1.2.2.20 - Authenticated (Contributor+) Stored Cross-Site Scripting
• Foyer <= 1.7.5 - Content Injection via Improper Access Control
• GD Mail Queue <= 3.9.3 - Unauthenticated Stored Cross-Site Scripting via Email
• Tab Ultimate <= 1.8 - Authenticated (Contributor+) Stored Cross-Site Scripting
• Społecznościowa 6 PL 2013 <= 2.0.6 - Cross-Site Request Forgery
• Flowerplayer Video Player <= 1.0.4 - Authenticated (Contributor+) Stored Cross-Site Scripting
• WPIDE – File Manager & Code Editor <= 2.6 - Authenticated (Admininstrator+) Local File Inclusion
• WPForms <= 2.0.2 - Reflected Cross-Site Scripting via 'page_title' POST Parameter
• School Management System – WPSchoolPress <= 2.2.14 - Authenticated (Student/Parent+) SQL Injection
• Secure Copy Content Protection and Content Locking <= 4.1.6 - Authenticated (Admin+) Stored Cross-Site Scripting
• Yet Another Stars Rating <= 3.1.2 - Authenticated (Subscriber+) Cross-Site Scripting via Shortcodes
• Football Pool < 2.6.5 - Cross-Site Scripting
• Clearfy Cache <= 2.3.2 - Cross-Site Request Forgery
• File Manager Pro <= 1.8 - Authenticated (Admin+) Stored Cross-Site Scripting
• BERTHA AI <= 1.13 - Missing Authorization
• Table Block by Tableberg <= 0.6.10 - Authenticated (Contributor+) Stored Cross-Site Scripting
• Scroll Styler <= 1.1 - Cross-Site Request Forgery to Stored Cross-Site Scripting
• WooCommerce Google Feed Manager <= 2.2.0 - Authenticated (Shop manager+) Stored Cross-Site Scripting
• WP Delete User Accounts <= 1.2.4 - Authenticated (Contributor+) Stored Cross-Site Scripting
• LA-Studio Element Kit for Elementor <= 1.6.2 - Authenticated (Contributor+) Stored Cross-Site Scripting
• Contest Gallery <= 25.1.0 - Authenticated (Author+) SQL Injection
• Element Pack Elementor Addons <= 5.10.5 - Authenticated (Contributor+) DOM-Based Stored Cross-Site Scripting via Lightbox Widget
• OrangeBox <= 3.0.0 - Cross-Site Request Forgery to Stored Cross-Site Scripting
• Hunk External Links <= 3.0.5 - Reflected Cross-Site Scripting
• Easy Voice Mail <= 1.2.5 - Unauthenticated Stored Cross-Site Scripting via 'message'
• GiveWP <= 2.10.3 - Authenticated Stored Cross-Site Scripting
• Add Link to Facebook < 2.2.8 - Reflected Cross-Site Scripting
• Prime Slider – Addons For Elementor <= 3.13.1 - Authenticated (Contributor+) Stored Cross-Site Scripting via title
• Rich Shortcodes for Google Reviews <= 6.8 - Unauthenticated Stored Cross-Site Scripting via Google Review
• Divelogs Widget <= 1.5 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode Attributes
• ReConstruction <= 1.4.7 - Reflected Cross-Site Scripting
• WP Find Your Nearest <= 0.3.1 - Authenticated (Contributor+) Stored Cross-Site Scripting
• Time Sheets < 1.5.0 - Reflected Cross-Site Scripting
• YMC Filter <= 3.12.19 - Authenticated (Author+) Stored DOM-Based Cross-Site Scripting via 'post_title' Parameter
• Event Banner <= 1.3 - Cross-Site Request Forgery
• WordPress Core < 3.5.2 - Cross-Site Scripting via Multiple Vectors
• MasterStudy LMS < 2.7.6 - Unauthenticated Admin Account Creation
• Backup Bolt <= 1.4.1 - Cross-Site Request Forgery
• MainWP Broken Link Checker <= 4.0 - Missing Authorization to Arbitrary Plugin Activation
• ECS – Ele Custom Skin for Elementor < 4.3.10 - Missing Authorization
• Where Did You Hear About Us Checkout Field for WooCommerce <= 1.3.1 - Authenticated (Shop Manager+) Stored Cross-Site Scripting
• Image Switcher <= 1.1 - Authenticated (Contributor+) Stored Cross-Site Scripting
• Download Monitor < 3.3.6.2 - Cross-Site Scripting via sort Parameter
• SlimStat Analytics <= 5.4.11 - Unauthenticated Stored Cross-Site Scripting via User-Agent Header
• Taxi Booking Manager for Woocommerce | E-cab <= 1.3.0 - Missing Authorization to Unauthenticated Privilege Escalation via Account Takeover
• Tutor LMS <= 4.0.5 - Unauthenticated Arbitrary Zero-Argument Function Invocation
• Translate WordPress and go Multilingual – Weglot <= 4.2.5 - Authenticated (Contributor+) Stored Cross-Site Scripting via Block Attributes
• NextGen GalleryView <= 0.5.5 - Cross-Site Request Forgery