Vulnerability archive: section 2, page 7

Open a report to review affected versions, available fixes and original sources. Each report covers a specific issue; its presence does not establish whether your website is affected.

• Uncanny Automator <= 6.7.0.1 - Missing Authorization
• Storely <= 18 - Authenticated (Contributor+) Stored Cross-Site Scripting
• 69 Clothing | Brand Store & Fashion Boutique WordPress Theme <= 1.2.11.1 - Unauthenticated PHP Object Injection
• AI Copilot – Content Generator <= 1.5.6 - Unauthenticated Privilege Escalation
• Hydra Booking <= 1.1.38 - Authenticated (Hydra host+) Stored Cross-Site Scripting
• Panda Pods Repeater Field <= 1.5.3 - Reflected Cross-Site Scripting
• Adsmonetizer <= 3.1.2 - Reflected Cross-Site Scripting
• flickrRSS <= 5.3.1 - Cross-Site Scripting via flickrRSS_id
• Sunshine Photo Cart <= 3.2.9 - Open Redirect
• Image Map Pro – Drag-and-drop Builder for Interactive Images – Lite <= 1.0.0 - Missing Authorization to Stored Cross-Site Scripting
• FullCalendar <= 1.6 - Unauthenticated Information Exposure
• real.Kit <= 5.1.1 - Authenticated (Contributor+) Stored Cross-Site Scripting
• Element Pack Elementor Addons (Header Footer, Template Library, Dynamic Grid & Carousel, Remote Arrows) <= 5.7.2 - Authenticated (Contributor+) Arbitrary File Read
• PostX <= 4.1.36 - Missing Authorization
• Reviews and Rating – Google Reviews <= 5.2 - Authenticated (Author+) Stored Cross-Site Scripting
• CP Image Store with Slideshow < 1.0.6 - Arbitrary File Download
• CodePeople Post Map for Google Maps <= 1.2.6 - Authenticated (Contributor +) Stored Cross-Site Scripting via 'cpm_point' Post Meta
• Advanced AJAX Product Filters <= 3.2.0.3 - Unauthenticated Stored Cross-Site Scripting
• BP Better Messages <= 2.4.32 - Missing Authorization
• f4 Post Tree <= 2.0.4 - Missing Authorization to Authenticated (Subscriber+) Arbitrary Post Parent/Menu Order Modification
• s2Member <= 250905 - Unauthenticated Remote Code Execution
• Revive Old Posts <= 9.3.3 - Missing Authorization
• Marcell - Personal Blog & Magazine WordPress Theme <= 1.2.14 - Unauthenticated PHP Object Injection
• Team Rosters <= 4.8.2 - Unauthenticated PHP Object Injection
• IgnitionDeck Crowdfunding Platform <= 1.1.6 - Missing Authorization
• Pondol Form to Mail <= 1.1 - Reflected Cross-Site Scripting
• MindValley Super PageMash <= 1.1 - Authenticated (Editor+) SQL Injection
• Invoice123 <= 1.7.0 - Missing Authorization to Authenticated (Subscriber+) Setting Modification via s123_submit_api_key & s123_submit_invoice_settings AJAX actions
• Mass Pages/Posts Creator <= 1.2.2 - Missing Authorization
• Auto x LINE <= 1.0.0 - Missing Authorization
• Booking for Appointments and Events Calendar – Amelia <= 2.4.9 - Authenticated (Editor+) SQL Injection
• KJM Admin Notices <= 2.0.1 - Authenticated (Admin+) Stored Cross-Site Scripting
• Real3D Flipbook <= 2.8 - Reflected Cross-Site Scripting via bookId parameter
• Ray Enterprise Translation <= 1.7.3 - Missing Authorization
• Ajax Load More <= 7.0.1 - Authenticated (Admin+) Directory Traversal to Arbitrary File Read
• WP User Manager <= 2.9.18 - Missing Authorization to Authenticated (Subscriber+) Stripe Account Hijack via Stripe Connect Callback
• Universal Video Player <= 3.8.4 - Reflected Cross-Site Scripting
• Extensions for Elementor <= 2.0.32 - Authenticated (Contributor+) Stored Cross-Site Scripting via EE Events and EE Flipbox Widget
• WP Chinese Conversion <= 1.1.16 - Unauthenticated Stored Cross-Site Scripting
• Swiss Toolkit For WP <= 1.4.6 - Authenticated (Author+) Arbitrary File Upload via upload_extension_files()
• Frontegg SAML SSO <= 1.0.1 - Authentication Bypass to Admin
• Ultimate Member < 1.0.84 - Authorization Bypass to Arbitrary File Upload/Delete
• The Grid < 2.8.0 - Authenticated (Subscriber+) Stored Cross-Site Scripting
• Photo Gallery, Sliders, Proofing and Themes – NextGEN < 4.2.1 - Authenticated (Admin+) SQL Injection
• Upload Files Anywhere <= 2.8 - Unauthenticated Arbitrary File Deletion
• Renewal <= 1.2.2 - Unauthenticated Local File Inclusion
• Genesis Blocks <= 3.1.2 - Authenticated (Contributor+) Stored Cross-Site Scripting via Block Content
• Safe Ai Malware Protection for WP <= 1.0.17 - Missing Authorization to Unauthenticated Database Export
• Astra Security Suite <= 0.2 - Missing Authorization
• Site Reviews <= 8.2.0 - Unauthenticated Stored Cross-Site Scripting
• DSK < 2.4 - Unauthenticated Local File Inclusion
• SKT Addons for Elementor <= 3.7 - Authenticated (Contributor+) Stored Cross-Site Scripting via Multiple Widgets
• Popup Box – Create Countdown, Coupon, Video, Contact Form Popups < 5.5.0 - Unauthenticated Stored Cross-Site Scripting
• Chatbox Manager <= 1.2.2 - Missing Authorization
• Recipe Cards For Your Food Blog from Zip Recipes <= 8.2.7 - Authenticated (Contributor+) SQL Injection
• LearnPress – WordPress LMS Plugin <= 4.3.2.2 - Insecure Direct Object Reference to Authenticated (Instructor+) Teacher Material Deletion
• Wordfence <= 5.1.4 - Reflected Cross-Site Scripting
• eShop < 6.2.9 - Reflected Cross-Site Scripting
• SureForms <= 2.8.1 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'headingWrapper' Block Attribute
• EWWW Image Optimizer <= 8.7.6 - Authenticated (Author+) Stored Cross-Site Scripting
• SEO Tools <= 4.0.7 - Reflected Cross-Site Scripting
• Events Manager - Calendar, Bookings, Tickets, and more! <= 7.3.3 - Unauthenticated Stored Cross-Site Scripting via Event Attributes
• Simple Social Media Share Buttons 2.0.4 - 2.0.21 - Missing Authorization
• MyParcel <= 4.24.1 - Reflected Cross-Site Scripting
• SEO Plugin by Squirrly SEO <= 12.3.20 - Authenticated (Editor+) Stored Cross-Site Scripting
• WP-Business Directory <= 1.0.2 - Cross-Site Scripting
• Sign-up Sheets <= 2.2.12 - Missing Authorization
• WooCommerce Photo Reviews <= 1.4.4 - Unauthenticated Arbitrary Shortcode Execution
• Generate Post Thumbnails <= 0.8 - Cross-Site Request Forgery
• ARForms <= 1.5.8 - Unauthenticated Stored Cross-Site Scripting via arf_http_referrer_url
• WP Docs <= 2.2.8 - Missing Authorization
• WP MLM Unilevel <= 4.0 - Unauthenticated Privilege Escalation
• Mail logging <= 2.1.12 - Unauthenticated Stored Cross-Site Scripting via PHPMailer 'wp_mail_failed' Error Message
• WP-CRM System <= 3.4.5 - Missing Authorization
• Dynamic Text Field For Contact Form 7 <= 2.0.22 - Authenticated (Contributor+) Stored Cross-Site Scripting
• Enable CORS <= 2.0.3 - Backdoor
• eaSYNC <= 1.3.11 - Reflected Cross-Site Scripting
• Download Monitor < 1.7.1 - Reflected Cross-Site Scripting
• Crowdsignal Dashboard <= 3.0.9 - Authorization Bypass
• ViaAds <= 2.1.2 - Cross-Site Request Forgery to API Key Update
• Header Footer Code Manager Pro <= 1.0.16 - Reflected Cross-Site Scripting via message
• Chapa Payment Gateway Plugin for WooCommerce <= 1.0.3 - Unauthenticated Sensitive Information Exposure
• Download Manager < 3.3.66 - Unauthenticated Stored Cross-Site Scripting
• Nepali Post Date <= 5.1.1 - Authenticated (Contributor+) Stored Cross-Site Scripting
• Slimstat Analytics <= 4.9.3.2 - Authenticated (Subscriber+) SQL Injection via Shortcode
• Permalink Manager Lite <= 2.2.12 - Admin+ SQL Injection
• Responsive Slider Gallery – Responsive Image Photo Slider <= 1.5.5 - Authenticated (Editor+) PHP Object Injection
• UsersWP <= 1.2.3.22 - Cross-Site Request Forgery
• Restore PayPal Standard for WooCommerce <= 3.1.2 - Unauthenticated Payment Verification Bypass
• Easy Google Maps <= 1.14.6 - Unauthenticated Stored Cross-Site Scripting
• MemberPress Corporate Accounts <= 1.5.39 - Authenticated (Subscriber+) Privilege Escalation via Mass Assignment in Sub-Account Creation
• Open User Map | Everybody can add locations <= 1.3.26 - Authenticated (Administrator+) Stored Cross-Site Scripting
• WP-FormAssembly <= 2.0.7 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode
• StreamCast <= 2.2.3 - Authenticated (Editor+) Stored Cross-Site Scripting
• Tainacan <= 0.18.9 - Cross-Site Scripting
• Pricing Table Plugin <= 3.6 - Unauthenticated SQL Injection
• Sweet Date <= 3.7.3 - Unauthenticated Privilege Escalation
• Bitly's WordPress Plugin <= 2.7.2 - Missing Authorization
• Actionwear products sync < 3.1.13 - Authenticated (Subscriber+) SQL Injection
• Questionar for Elementor <= 1.1.7 - Missing Authorization