Vulnerability archive: section 3, page 10

Open a report to review affected versions, available fixes and original sources. Each report covers a specific issue; its presence does not establish whether your website is affected.

• 140+ Widgets | Xpro Addons For Elementor – FREE <= 1.4.4.3 - Authenticated (Contributor+) Stored Cross-Site Scripting via Post Grid Widget
• Headinger for Elementor <= 1.1.4 - Missing Authorization
• LotekMedia Popup Form <= 1.0.6 - Authenticated (Administrator+) Stored Cross-Site Scripting via Plugin Settings
• SP Blog Designer <= 1.0.0 - Authenticated (Contributor+) Local File Inclusion
• WP Frontend Profile <= 1.3.8 - Cross-Site Request Forgery to Unauthorized User Account Approval or Rejection
• Ultimate Review <= 2.4.3 - Unauthenticated Persistent Page Denial of Service
• Media Library File Size <= 1.6.7 - Missing Authorization
• LMS Elementor Pro <= 1.0.4 - Unauthenticated Privilege Escalation
• WP Booking System <= 2.1.0.1 - Authenticated (Administrator+) SQL Injection via 'orderby' Parameter
• CKEditor for WordPress <= 4.5.3 - Reflected Cross-Site Scripting
• Import Export For WooCommerce <= 1.6.1 - Authenticated (Subscriber+) Arbitrary File Upload
• School Management System – SakolaWP <= 1.0.8 - Unauthenticated Privilege Escalation
• UiPress lite | Effortless custom dashboards, admin themes and pages <= 3.5.09 - Missing Authorization to Authenticated (Subscriber+) Plugin Settings Update
• Popup Box – Easily Create WordPress Popups <= 3.2.12 - Authenticated (Contributor+) Stored Cross-Site Scripting
• User Activity Log <= 1.6.2 - Unauthenticated SQL Injection via username
• Team <= 5.0.6 - Missing Authorization
• Responder <= 4.3.8 - Cross-Site Request Forgery
• Zen Sticky Social <= 0.3 - Cross-Site Request Forgery to Stored Cross-Site Scripting
• Multiple Page Generator Plugin – MPG <= 3.3.19 - Authenticated (Administrator+) SQL Injection in projects_list and total_projects
• Piotnet Addons For Elementor Pro <= 7.1.17 - Missing Authorization to Arbitrary Post/Page Deletion
• Easy Bet <= 1.0.7 - Authenticated(Contributor+) SQL Injection
• Wireless Butler <= 1.0.11 - Reflected Cross-Site Scripting
• UserPro <= 4.9.17 - Authentication Bypass
• Zoho Billing <= 4.1 - Authenticated (Contributor+) Stored Cross-Site Scripting
• Accept Stripe Donation – AidWP <= 3.1.5 - Cross Site Request Forgery
• WP Poll Maker <= 3.1 - Authenticated (Administrator+) Stored Cross-Site Scripting via settings
• Zeno Font Resizer <= 1.7.9 - Authenticated (Administrator+) Stored Cross-Site Scripting
• YITH WooCommerce Waiting List <= 2.6.0 - Cross-Site Request forgery via 'save_mail_status'
• Church Admin < 1.2550 - Cross-Site Request Forgery
• Appointment Calendar <= 2.9.6 - Reflected Cross-Site Scripting
• TaxoPress <= 3.44.0 - Authenticated (Editor+) SQL Injection
• Extensions For CF7 (Contact form 7 Database, Conditional Fields and Redirection) <= 3.4.5 - Unauthenticated Arbitrary File Upload via Signature Field File Upload
• WP-UserOnline <= 2.88.0 - Authenticated (Admin+) Stored Cross-Site Scripting
• Automatic Translation <= 1.0.4 - Unauthenticated Arbitrary File Upload
• Floating Window Music Player <= 3.4.2 - Cross-Site Request Forgery to Stored Cross-Site Scripting
• WP Adminify <= 4.0.7.7 - Unauthenticated Sensitive Information Exposure via 'get-addons-list' REST API
• King Addons for Elementor <= 51.1.62 - Authenticated (Contributor+) Stored Cross-Site Scripting
• Child Themes Helper <= 2.2.7 - Cross-Site Request Forgery to Arbitrary File Deletion
• Social Media Auto Publish <= 3.6.5 - Reflected Cross-Site Scripting via PostMessage
• KNR Author List Widget <= 3.1.1 - Reflected Cross-Site Scripting
• Top 10 – Popular posts plugin for WordPress < 2.3.1 - Cross-Site Scripting
• Booking (Reservation & Appointment) <= 3.0.3 - Authenticated (Subscriber+) SQL Injection
• AppPresser <= 4.3.0 - Cross-Site Request Forgery via toggle_logging_callback()
• Fade Slider <= 2.5 - Reflected Cross-Site Scripting
• LoginWP < 3.0.0.5 - Reflected Cross-Site Scripting via rul_login_url, rul_logout_url Parameter
• Page scroll to id <= 1.7.8 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode
• WP Pricing Table <= 1.1 - Reflected Cross-Site Scripting
• Vertical marquee plugin <= 7.1 - Authenticated (Subscriber+) SQL Injection via Shortcode
• Simple Event Planner <= 1.5.4 - Authenticated Stored Cross-Site Scripting
• WP-Cron Dashboard < 1.1.6 - Cross-Site Scripting
• All in One SEO <= 2.9.1.1 - Authenticated Stored Cross-Site Scripting
• Theme My Login <= 7.1.12 - Missing Authorization
• Better Messages – Chat Rooms, Group Chat, Private Messages & AI Chat Bots plugin for WordPress <= 2.15.22 - Reflected Cross-Site Scripting via 'icn' Parameter
• SOOZ – AI for SEO – Bulk Generate Focus Keyphrases, Metadata, Alt Text (SEO Autopilot) <= 2.4.2 - Missing Authorization
• Aparat for WordPress <= 2.2.0 - Authenticated (Contributor+) Stored Cross-Site Scripting
• Search Atlas SEO – Premier SEO Plugin for One-Click WP Publishing & Integrated AI Optimization < 2.6.12 - Missing Authorization
• Card flip image slideshow <= 1.5 - Authenticated (Contributor+) Stored Cross-Site Scripting
• Order Delivery Date for WooCommerce <= 3.20.0 - Reflected Cross-Site Scripting via 'orddd_lite_custom_startdate' and 'orddd_lite_custom_enddate'
• HTML2WP <= 1.0.0 - Cross-Site Request Forgery
• Insight Core <= 1.0 - Authenticated PHP Object Injection & Stored Cross-Site Scripting
• WP Reset <= 2.02 - Missing Authorization to License Key Modification
• MelaPress Login Security 2.1.0 - 2.1.1 - Authentication Bypass to Privilege Escalation via get_valid_user_based_on_token Function
• Soundslides < 2.5.0 - Reflected Cross-Site Scripting
• Popup for CF7 with Sweet Alert <= 1.6.5 - Cross-Site Request Forgery
• Newsletter <= 8.0.6 - Cross-Site Request Forgery
• Video Gallery Block – Display your videos as a gallery in a professional way <= 1.1.0 - Authenticated (Contributor+) Stored Cross-Site Scripting
• Print Invoice & Delivery Notes for WooCommerce <= 5.8.0 - Unauthenticated Remote Code Execution
• Email Subscription Popup <= 1.2.16 - Reflected Cross-Site Scripting
• WP-Recall – Registration, Profile, Commerce & More <= 16.26.10 - Missing Authorization to Authenticated (Subscriber+) Arbitrary Shortcode Exeuction
• Social Photo Gallery <= 1.0 - Remote Code Execution
• Pods - Custom Content Types and Fields - Missing Authorization
• belingoGeo <= 1.12.0 - Unauthenticated Arbitrary File Download
• Specific Content For Mobile – Customize the mobile version without redirections <= 0.1.9.5 - Reflected Cross-Site Scripting
• WP Visitor Statistics (Real Time Traffic) <= 5.5 - SQL Injection
• PlugNedit Adaptive Editor < 6.2.0 - Cross-Site Request Forgery leading to Stored Cross-Site Scripting
• Revolut Gateway for WooCommerce <= 4.17.3 - Missing Authorization to Unauthenticated Order Status Update
• TablePress <= 1.14 - Authenticated (Author+) CSV Injection
• Modal Window – create popup modal window <= 5.3.8 - Authenticated(Contributor+) Stored Cross-Site Scripting via Shortcode
• Dokan <= 5.0.8 - Insecure Direct Object Reference to Authenticated (Vendor+) Arbitrary Order Status Modification
• WP Vehicle Manager <= 3.1 - Unauthenticated Local File Inclusion
• Cryptocurrency Donation Box – Bitcoin & Crypto Donations <= 2.2.13 - Missing Authorization
• Web Directory Free <= 1.6.9 - Unauthenticated SQL Injection
• Simple AL Slider <= 1.2.10 - Reflected Cross-Site Scripting via $_SERVER['PHP_SELF']
• WP-SVG <= 0.9 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode
• Unlimited Elements For Elementor (Free Widgets, Addons, Templates) <= 1.5.102 - Reflected Cross-Site Scripting
• Enter Addons <= 2.2.7 - Authenticated (Contributor+) Stored Cross-Site Scripting via Countdown and Image Comparison Widgets
• MapSVG <= 8.14.0 - Authenticated (Administrator+) Arbitrary File Upload via '/mapsvg/v1/svgfile' Endpoint
• Sirv <= 7.5.3 - Authenticated (Contributor+) Stored Cross-Site Scripting
• System Dashboard <= 2.8.9 - Reflected Cross-Site Scripting via X-Forwarded-For
• AcyMailing – An Ultimate Newsletter Plugin and Marketing Automation Solution for WordPress <= 10.11.0 - Unauthenticated SQL Injection
• Master Blocks 1.4.1 - 1.4.1.4 - Unauthenticated Stored Cross-Site Scripting
• Yobazar < 1.6.7 - Reflected Cross-Site Scripting
• Simple:Press <= 6.8 - Authenticated (Admin+) Path Traversal to Arbitrary File Modification
• Official StatCounter Plugin <= 2.1.0 - Authenticated (Contributor+) Stored Cross-Site Scripting via Nickname
• Passwords Manager <= 1.4.8 - Missing Authorization to Authenticated (Subscriber+) Add Password + Update Encryption Key
• Doctreat <= 1.6.7 - Reflected Cross-Site Scripting
• WP User Frontend <= 3.5.28 - Privilege Escalation
• WOOCS <= 1.3.7.4 - Reflected Cross-Site Scripting via AJAX action
• CJ Change Howdy <= 3.3.1 - Cross-Site Request Forgery to Stored Cross-Site Scripting
• Aphorismus <= 1.2.0 - Cross-Site Request Forgery to Stored Cross-Site Scripting