Vulnerability archive: section 2, page 27

Open a report to review affected versions, available fixes and original sources. Each report covers a specific issue; its presence does not establish whether your website is affected.

• Video Gallery by Huzzaz <= 10.5 - Authenticated (Contributor+) Stored Cross-Site Scripting
• My Calendar <= 3.7.8 - Unauthenticated SQL Injection via 'mc_auth' and 'mc_host' Parameters
• Ni WooCommerce Sales Report Email <= 3.1.4 - Reflected Cross-Site Scripting
• Essential Addons for Elementor <= 5.9.21 - Authenticated (Contributor+) Stored Cross-Site Scripting via Twitter Feed
• Recover WooCommerce Cart Abandonment, Newsletter, Email Marketing, Marketing Automation By FunnelKit <= 3.2.2 - Unauthenticated SQL Injection
• Language Translate Widget for WordPress – ConveyThis <= 269.1 - Authenticated (Administrator+) PHP Object Injection
• Gutenberg Blocks with AI by Kadence WP <= 3.6.1 - Authenticated (Contributor+) Server-Side Request Forgery via 'endpoint' Parameter
• Beds24 Online Booking <= 2.0.27 - Authenticated (Contributor+) Stored Cross-Site Scripting via beds24-link Shortcode
• Cookie consent for developers <= 1.7.1 - Authenticated (Administrator+) Stored Cross-Site Scripting via Multiple Settings Fields
• Advanced Reorder Image Text Slider <= 1.0 - Cross-Site Request Forgery to Stored Cross-Site Scripting
• Magic Fields 1 <= 1.7.1 - Cross-Site Scripting via RCCWP_CreateCustomFieldPage.php custom-field-css parameter
• WP Smart Tooltip <= 1.0.0 - Authenticated (Subscriber+) Stored Cross-Site Scripting
• Portfolio Slideshow Pro <= 3.0 - SQL Injection
• WP To Do <= 1.3.0 - Cross-Site Request Forgery via wptodo_manage()
• Sprout Invoices – Client Invoicing & Estimates <= 20.8.13 - Missing Authorization
• Redirect Redirection <= 1.1.3 - Missing Authorization in 'addRedirect' function
• Testimonial Slider <= 1.3.1 - Cross-Site Request Forgery
• User Registration – Custom Registration Form, Login Form And User Profile For WordPress <= 3.0.4.1 - Authenticated (Admin+) Stored Cross-Site Scripting
• Save Life <= 1.2.13 - Unauthenticated Local File Inclusion
• WPSmartContracts <= 2.0.10 - Unauthenticated SQL Injection
• Easy Appointments <= 3.12.27 - Missing Authorization to Authenticated (Author+) Bulk Appointment Manipulation
• Spiritual Gifts Survey <= 0.9.10 - Reflected Cross-Site Scripting
• Da Reactions <= 5.1.5 - Authenticated (Contributor+) Stored Cross-Site Scripting
• Simple Portfolio Gallery <= 0.1 - Authenticated (Administrator+) Stored Cross-Site Scripting
• imwptip <= 1.1 - Cross-Site Request Forgery to Settings Update
• CubeWP <= 1.1.27 - Missing Authorization
• User Submitted Posts – Enable Users to Submit Posts from the Front End <= 20251210 - Unauthenticated Stored Cross-Site Scripting via Custom Field
• SUMO Memberships for WooCommerce < 7.8.0 - Missing Authorization to Authenticated (Subscriber+) Arbitrary Content Deletion
• WooCommerce Infinite Scroll <= 1.6.2 - Authenticated (Subscriber+) PHP Object Injection
• Arconix Shortcodes <= 2.1.12 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode
• Simple Social Media Share Buttons <= 3.8.2 - Unauthenticated Password Protected Post Disclosure
• WP Headmaster <= 0.3 - Reflected Cross-Site Scripting
• Waitlist Woocommerce ( Back in stock notifier ) <= 2.6 - Missing Authorization
• Posts Slider Shortcode <= 1.0 - Authenticated (Contributor+) Stored Cross-Site Scripting
• Free Booking Plugin for Hotels, Restaurants and Car Rentals – eaSYNC Booking <= 1.3.21 - Insecure Direct Object Reference to Sensitive Information Exposure
• WP Visitor Statistics (Real Time Traffic) <= 5.7 - Unauthenticated SQL Injection
• The integration of the AMO.CRM <= 1.0.1 - Cross-Site Request Forgery
• Universal Star Rating <= 1.10.4 - Authenticated (Administrator+) Stored Cross-Site Scripting
• Stop Referrer Spam <= 1.3.0 - Cross-Site Request Forgery via processParameters
• Betheme <= 26.6.2 - Missing Authorization to Post Status Change
• Login Lockdown <= 2.06 - Authenticated (Administrator+) SQL Injection
• WP CSV <= 1.8.0.0 - Reflected Cross-Site Scripting
• MultiMailer <= 1.0.3 - Reflected Cross-Site Scripting
• Mobile App for WooCommerce: ShopApper Mobile App Builder Service for WooCommerce <= 0.4.69 - Missing Authorization to Authenticated (Subscriber+) Stock Update
• Contact Form Submissions <= 1.7.2 - Unauthenticated Stored Cross-Site Scripting
• BA Book Everything <= 1.6.8 - Authenticated (Administrator+) Stored Cross-Site Scripting
• WPO365 | Mail Integration for Office 365 / Outlook <= 1.9.0 - reflected Cross-Site Scripting via error_description
• iThemes Security <= 7.6.1 - Broken Password Mechanism
• OTP-less one tap Sign in 2.0.14 - 2.0.59 - Unauthenticated Arbitrary Email Update to Account Takeover/Privilege Escalation
• Redirection for Contact Form 7 <= 2.4.0 - Reflected Cross-Site Scripting
• WordPress Core < 6.0.3 - Information Disclosure (Multi-Part Email Leak)
• Category and Page Icons <= 0.9.1 - Arbitrary File Upload and Deletion
• Fluent Forms Pro Add On Pack < 6.2.12 - Unauthenticated Stored Cross-Site Scripting
• ZhinaTwitterWidget <= 1.0 - Reflected Cross-Site Scripting
• Easy Image Collage <= 1.13.5 - Missing Authorization to Authenticated (Contributor+) Data Clearance
• SeoSamba for WordPress Webmasters <= 1.0.5 - Cross-Site Request Forgery
• Lobo < 2.8.6 - Authenticated (Subscriber+) SQL Injection
• Essential Addons for Elementor – Best Elementor Templates, Widgets, Kits & WooCommerce Builders <= 5.9.2 - Authenticated (Contributor+) Stored Cross-Site Scripting
• Turitor < 1.5.3 - Authenticated (Contributor+) Local File Inclusion
• Stripe Payment Plugin for WooCommerce <= 3.7.7 - Authentication Bypass
• Advanced Customized Prompts <= 1.0.1 - Unauthenticated Privilege Escalation via Account Takeover
• Terms descriptions <= 3.4.7 - Authenticated (Administrator+) Stored Cross-Site Scripting
• Social Slider Feed <= 2.0.4 - Authenticated (Scubscriber+) Stored Cross-Site Scripting
• RSVPMarker <= 11.6.7 - Unauthenticated SQL Injection
• Age Gate <= 2.13.4 - Open Redirect
• Horizon <= 1.1 - Unauthenticated Local File Inclusion
• Parcel Pro <= 1.8.4 - Reflected Cross-Site Scripting
• ARMember <= 4.0.2 - Authenticated (Administrator+) Stored Cross-Site Scripting
• NewsTicker <= 1.0 - Reflected Cross-Site Scripting
• Gosign – Posts Slider Block <= 1.1.0 - Authenticated (Contributor+) Stored Cross-Site Scripting
• Comment Reply Email <= 1.0.3 - Authenticated (Administrator+) Stored Cross-Site Scripting
• Sendy <= 3.4.2 - Missing Authorization
• FluentCRM - Marketing Automation For WordPress <= 2.9.84 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'fluentcrm_content' Shortcode
• Premium Portfolio Features for Phlox theme <= 2.3.2 - Authenticated (Contributor+) Stored Cross-Site Scripting via ' Grid Portfolios'
• Ditty – Responsive News Tickers, Sliders, and Lists <= 3.1.38 - Authenticated (Contributor+) PHP Object Injection
• WP Odoo Form Integrator <= 1.1.0 - Cross-Site Request Forgery to Stored Cross-Site Scripting
• Ultimate Member <= 2.0.32 - Cross-Site Request Forgery
• Title Experiments Free <= 9.0.0 - SQL Injection