Vulnerability archive: section 2, page 22

Open a report to review affected versions, available fixes and original sources. Each report covers a specific issue; its presence does not establish whether your website is affected.

• Contest Gallery – Upload, Vote & Sell with PayPal and Stripe <= 27.0.3 - Unauthenticated CSV Injection
• FAQ Builder AYS <= 1.7.1 - Reflected Cross-Site Scripting
• Html Social share buttons <= 2.1.16 - Authenticated (Contributor+) Stored Cross-Site Scripting
• WPshop 2 – E-Commerce 2.0.0 - 2.6.0 - Authenticated (Subscriber+) Privilege Escalation via Account Takeover
• WP Carticon <= 1.0.0 - Authenticated (Admin+) Stored Cross-Site Scripting
• Grid Gallery – Photo Image Grid Gallery <= 1.2.4 - Stored Cross-Site Scripting
• Shuttle <= 1.5.0 - Authenticated (Contributor+) Stored Cross-Site Scripting
• Post Carousel Slider for Elementor <= 1.5.0 - Authenticated (Contributor+) Stored Cross-Site Scripting
• Pretty Google Calendar <= 2.0.0 - Missing Authorization to Unauthenticated Google API Key Exposure
• Icons Font Loader <= 1.1.2 - Authenticated (Subscriber+) SQL Injection
• Wtyczka SeoPilot dla WP <= 3.3.091 - Cross-Site Request Forgery to Stored Cross-Site Scripting
• Text To Speech TTS Accessibility <= 1.9.30 - Missing Authorization
• Minimum Purchase for WooCommerce <= 2.0.0.1 - Authenticated (Contributor+) Stored Cross-Site Scripting
• S3 Bubble Amazon S3 HTML5 Video with Adverts <= 2.0 - Arbitrary File Download
• Toocheke Companion <= 1.166 - Authenticated (Admin+) Stored Cross-Site Scripting
• Aajoda Testimonials <= 2.2.1 - Authenticated(Administrator+) Stored Cross-Site Scripting
• Posti Shipping <= 3.10.3 - Reflected Cross-Site Scripting
• Registration Forms – User Profile, Custom Registration Form, Login Form, Invitation-Based Registrations for WordPress 2.0.14 - 2.0.15 - Authentication Bypass
• The Ultimate WordPress Toolkit – WP Extended <= 3.0.8 - Missing Authorization to Admin Username Change
• Blox Page Builder <= 1.0.65 - Authenticated (Contributor+) Arbitrary File Upload
• X Addons for Elementor <= 1.0.16 - Authenticated (Contributor+) Stored Cross-Site Scripting
• Google Calendar Events <= 3.5.9 - Unauthenticated Insecure Direct Object Reference
• NGG Smart Image Search <= 3.4.1 - Unauthenticated SQL Injection
• King Addons for Elementor – 100+ Elementor Widgets, 4 000+ Elementor Templates, WooCommerce Builder, Mega Menu, Popup Builder <= 51.1.85 - Authenticated (Contributor+) Stored Cross-Site Scripting
• Ultra Addons Lite for Elementor <= 1.3.2 - Authenticated (Contributor+) Stored Cross-Site Scripting via Type Out Widget
• myCred – Points Management System For Gamification, Ranks, Badges, and Loyalty Program <= 2.9.7.1 - Missing Authorization to Sensitive Information Exposure
• Speed Booster Pack PageSpeed Optimization Suite <= 4.1.9. - Authenticated (Admin+) Remote Code Execution
• WP Job Portal <= 2.1.6 - Missing Authorization to Unauthenticated Local File Inclusion, Arbitrary Settings Update, and User Creation
• Funnelforms Free <= 3.4 - Cross-Site Request Forgery to Arbitrary Post Duplication
• WooCommerce <= 8.5.2 - Cross-Site Request Forgery
• YDS Support Ticket System <= 1.0 - Cross-Site Request Forgery
• WTI Like Post < 1.4.3 - SQL Injection
• King Addons for Elementor <= 51.1.80 - Authenticated (Contributor+) Stored Cross-Site Scripting
• WooCommerce Quick View <= 1.1.1 - Unauthenticated Information Disclosure
• Ocean Extra <= 2.2.9 - Authenticated (Contributor+) Stored Cross-Site Scripting
• BuddyApp <= 1.9.2 - Reflected Cross-Site Scripting
• QR Code Composer – Automatic QR code Generator <= 2.0.3 - Authenticated (Subscriber+) Stored Cross-Site Scripting
• AI Copilot <= 1.5.4 - Authenticated (Subscriber+) SQL Injection via 'order[0][dir]' Parameter
• Website Chat Button: Kommo integration <= 1.3.1 - Missing Authorization
• StreamWeasels Kick Integration <= 1.1.4 - Authenticated (Contributor+) Stored Cross-Site Scripting
• Simple Author Box <= 2.51 - Authenticated (Contributor+) Insecure Direct Object Reference to Arbitrary User Sensitive Information Exposure
• Image Hotspot by DevVN <= 1.2.5 - Authenticated (Author+) PHP Object Injection
• Orpheus <= 1.8 - Unauthenticated PHP Object Injection
• Gettext override translations <= 1.0.1 - Authenticated (Administrator+) Stored Cross-Site Scripting
• Wonder Video Embed <= 1.7 - Authenticated (Contributor+) Stored Cross-Site Scripting
• JetEngine < 3.8.12 - Authenticated (Contributor+) Stored Cross-Site Scripting
• AI Builder – Generate pages, blocks, images & translate with AI 2.4.1 - 2.7.7 - Authenticated (Contributor+) Stored Cross-Site Scripting
• Resource Library for Logged In Users <= 1.5 - Cross-Site Request Forgery to Multiple Administrative Actions
• Download canvasio3D Light <= 2.5.0 - Reflected Cross-Site Scripting
• Membership by Supsystic <= 1.4.7 - Unauthenticated SQL Injection
• Online Hotel Booking System Pro <= 1.1 - Cross-Site Scripting
• WP Tabs Slides <= 2.0.3 - Cross-Site Request Forgery
• Essential Addons for Elementor – Best Elementor Templates, Widgets, Kits & WooCommerce Builders <= 5.9.23 - Authenticated (Contributor+) Stored Cross-Site Scripting
• Firelight Lightbox <= 2.3.14 - Authenticated (Contributor+) Stored Cross-Site Scripting
• Essential Addons for Elementor – Best Elementor Addon, Templates, Widgets, Kits & WooCommerce Builders <= 6.0.9 - Authenticated (Author+) Sensitive Information Exposure to Privilege Escalation
• MainWP Links Manager Extension <= 2.1 - Unauthenticated PHP Object Injection
• WP Events Manager <= 2.1.11 - Authenticated (Subscriber+) Time-Based SQL Injection
• Namaste! LMS <= 2.6.3 - Authenticated (Subscriber+) PHP Object Injection
• CP Contact Form with PayPal < 1.1.6 - SQL Injection
• SMS Alert <= 4.0.0 - Unauthenticated Arbitrary Account Takeover
• DeBounce Email Validator <= 5.7 - Unauthenticated Local File Inclusion
• BlockArt Blocks <= 2.2.15 - Authenticated (Author+) Stored Cross-Site Scripting via 'clientId' Block Attribute
• Page Restrict <= 2.2.1 - Stored Cross-Site Scripting
• Woosa <= 2.0.5 - Authenticated (Administrator+) Arbitrary File Read via 'log_file' Parameter
• WP Cookie Notice for GDPR, CCPA & ePrivacy Consent <= 3.8.0 - Cross-Site Request Forgery
• WholesaleX – WooCommerce Wholesale Plugin (Wholesale Prices, Dynamic Pricing, Tiered Pricing) <= 1.3.2 - Unauthenticated PHP Object Injection
• Quick License Manager – WooCommerce Plugin <= 2.4.17 - Reflected Cross-Site Scripting
• Arvow AI SEO Writer <= 1.5.3 - Missing Authorization
• Gift Cards (Gift Vouchers and Packages) (WooCommerce Supported) <= 4.6.9 - Missing Authorization
• IceStats <= 1.3 - Cross-Site Request Forgery
• Visualizer: Tables and Charts Manager for WordPress <= 3.7.9 - Authenticated (Contributor+) PHAR Deserialization
• iPages Flipbook < 1.4.3 - Reflected Cross-Site Scripting
• DP ALTerminator - Missing ALT manager <= 1.0.2 - Authenticated (Administrator+) Stored Cross-Site Scripting
• Fraud Prevention For Woocommerce <= 2.3.2 - Authenticated (Subscriber+) Information Exposure
• Ultimate Classified Listings <= 1.3 - Reflected Cross-Site Scripting
• Freshmail for WordPress <= 1.5.8 - SQL Injection
• The Plus Addons for Elementor Pro <= 6.3.6 - Missing Authorization
• Real Cookie Banner <= 3.4.9 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode
• Qubely <= 1.7.9 - Incorrect Authorization
• FV Flowplayer Video Player <= 7.5.45.7212 - Reflected Cross-Site Scripting
• Year Make Model Search for WooCommerce <= 1.0.11 - Cross-Site Request Forgery
• EmbedPress <= 3.9.8 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode
• PixelYourSite <= 5.2.1 - Reflected Cross-Site Scripting
• Ajax Search Lite <= 4.12.3 - Authenticated (Admin+) Stored Cross-Site Scripting
• MyWorks WooCommerce Sync for QuickBooks Online <= 2.9.1 - Reflected Cross-Site Scripting
• WooCommerce Additional Fees On Checkout (Free) <= 1.4.7 - Reflected Cross-Site Scripting via 'number'
• Asset CleanUp: Page Speed Booster <= 1.3.8.4 - Reflected Cross-Site Scripting
• Asset CleanUp: Page Speed Booster <= 1.4.0.5 - Authenticated (Administrator+) Server-Side Request Forgery via 'page_url' Parameter
• Jetpack 13.0 - 14.0 - Reflected DOM-based Cross-Site Scripting
• WP ERP <= 1.13.2 - Reflected Cross-Site Scripting
• SmilePure < 1.8.5 - Unauthenticated Local File Inclusion
• Admin Amplify <= 1.3.0 - Reflected Cross-Site Scripting
• Icegram Email Subscribers & Newsletters <= 4.5.0 - Authenticated SQL Injection
• WP Video Lightbox <= 1.9.10 - Authenticated (Contributor+) Stored Cross-Site Scripting via width Parameter
• ARMember Premium <= 6.7 - Cross-Site Request Forgery via multiple functions
• Real Estate Manager <= 7.3 - Unauthenticated Local File Inclusion
• Featured Video Plus <= 2.3.3 - Authenticated (Contributor+) Stored Cross-Site Scripting
• Barcode Scanner with Inventory & Order Manager <= 1.6.6 - Reflected Cross-Site Scripting
• Audier For Elementor <= 1.0.9 - Missing Authorization
• AI Scribe – SEO AI Writer, Content Generator, Humanizer, Blog Writer, SEO Optimizer, DALLE-3, AI WordPress Plugin ChatGPT (GPT-4o 128K) <= 2.5 - Cross-Site Request Forgery to Settings Update