Vulnerability archive: section 3, page 11

Open a report to review affected versions, available fixes and original sources. Each report covers a specific issue; its presence does not establish whether your website is affected.

• BJ Lazy Load < 1.0 - Remote File Inclusion via TimThumb
• Post-to-Post Links <= 4.2 - Authenticated (Administrator+) Stored Cross-Site Scripting
• Directorist: AI-Powered Business Directory, Listings & Classified Ads < 8.9 - Authenticated (Subscriber+) Insecure Direct Object Reference
• Inline Related Posts <= 3.4.0 - Authenticated (Administrator+) Stored Cross-Site Scripting
• Appointment Hour Booking <= 1.5.97 - Unauthenticated Stored DOM-Based Cross-Site Scripting via Booking Form Single-Line Field via Schedule Calendar List Renderer
• King Addons for Elementor <= 24.12.58 - Missing Authorization
• Masteriyo - LMS <= 1.7.2 - Unauthenticated Privilege Escalation
• CM On Demand Search And Replace <= 1.5.2 - Authenticated (Administrator+) Stored Cross-Site Scripting
• Salon Booking System – Free Version <= 10.30.33 - Missing Authorization
• Responsive Filterable Portfolio <= 1.0.22 - Server-Side Request Forgery
• s2Framework <= 4.1.5 - Reflected Cross-Site Scripting
• Simple Banner <= 3.0.4 - Authenticated (Administrator+) Stored Cross-Site Scripting
• Booking Calendar <= 9.9 - Unauthenticated SQL Injection
• Booster for WooCommerce <= 7.1.0 - Authenticated (Subscriber+) Information Disclosure via Shortcode
• Featured Video for WordPress – VideographyWP <= 1.0.18 - Authenticated (Contributor+) Stored Cross-Site Scripting
• Gecko 6.0 - Responsive Shopify Theme - RTL support <= 1.9.8 - Reflected Cross-Site Scripting
• WooCommerce Conversion Tracking <= 2.0.11 - Missing Authorization
• Manufactory <= 1.4 - Unauthenticated Local File Inclusion
• Advanced Contact form 7 DB <= 2.0.2 - Missing Authorization to Unauthenticated Information Disclosure
• Floating Action Button <= 1.2.1 - Cross-Site Request Forgery
• Deny All Firewall <= 1.1.6 - Cross-Site Request Forgery
• Easy Logo <= 1.9.3 - Authenticated (Admin+) Stored Cross-Site Scripting
• LDD Directory Lite <= 3.3 - Reflected Cross-Site Scripting
• Eventin – Events Calendar, Tickets, Registration, Booking & WooCommerce <= 4.1.25 - Missing Authorization
• Starbox <= 3.4.9 - Authenticated (Contributor+) Stored Cross-Site Scripting
• Custom User Profile Fields <= 1.8 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode
• WP Optin Wheel <= 1.4.7 - Authenticated (Admin+) Server-Side Request Forgery
• RokNewsPager <= 1.17 - Denial of Service
• Lets-Box < 1.15.3 - Reflected Cross-Site Scripting
• Coins MarketCap <= 5.5.8 - Authenticated (Contributor+) Stored Cross-Site Scripting
• Prime Mover – Backup and Migration <= 2.2.0 - Authenticated (Admin+) Stored Cross-Site Scripting
• LWSCache <= 2.8.5 - Missing Authorization to Authenticated (Subscriber+) Limited Plugin Activation via lwscache_activatePlugin Function
• Drag & Drop Builder, Human Face Detector, Pre-built Templates, Spam Protection, User Email Notifications & more! <= 1.4.19 - Reflected Cross-Site Scripting
• Eventer - WordPress Event & Booking Manager Plugin <= 3.9.9.2 - Authenticated (Subscriber+) SQL Injection via reg_id
• Core Tweaks WP Setup <= 4.1 - Cross-Site Request Forgery
• Conversion Helper <= 1.12 - Reflected Cross-Site Scripting
• E2Pdf <= 1.20.18 - Authenticated (Administrator+) PHP Object Injection
• WP Testimonials <= 1.4.2 - Cross-Site Request Forgery to Widget Deletion
• WooCommerce PDF Vouchers <= 4.9.4 - Reflected Cross-Site Scripting
• Integration for WooCommerce and Zoho CRM <= 1.3.6 - Open Redirect via setup_plugin
• Astra <= 4.13.12 - Authenticated (Shop Manager+) Arbitrary CSS Injection
• Infility Global <= 2.14.42 - Authenticated (Subscriber+) Arbitrary File Upload
• WP Directory Kit <= 1.5.0 - Missing Authorization
• Unify <= 3.2.5 - Cross-Site Scripting
• Bold Page Builder <= 2.3.1 - Missing Authorization to Settings Update
• Online Booking & Scheduling Calendar for WordPress by vcita <= 4.5.3 - Authenticated (Contributor+) Stored Cross-Site Scripting
• YouTube Video Inserter <= 1.2.1.0 Reflected Cross-Site Scripting
• Vision Interactive <= 1.5.3 - Authenticated (Contributor+) Stored Cross-Site Scripting
• WP DPE-GES <= 1.6 - Authenticated (Contributor+) Stored Cross-Site Scripting
• Webmention <= 5.6.2 - Authenticated (Subscriber+) Server-Side Request Forgery
• News Element Elementor Blog Magazine <= 1.0.8 - Missing Authorization to Authenticated (Subscriber+) Data Loss
• ShopBuilder – Elementor WooCommerce Builder Addons <= 3.2.4 - Unauthenticated Information Exposure
• Post Export Import with Media <= 1.17.2 - Authenticated (Administrator+) Path Traversal via 'theme_slug' Parameter
• Email Address Obfuscation <= 1.0.1 - Authenticated (Contributor+) Stored Cross-Site Scripting via class Parameter
• Visit Site Link enhanced <= 1.0 - Cross-Site Request Forgery to Stored Cross-Site Scripting
• FeedWordPress < 2015.0514 - SQL Injection
• Spectra <= 2.19.22 - Missing Authorization
• VPSUForm <= 3.2.24 - Authenticated (Contributor+) Information Exposure
• Morning for WooCommerce <= 2.4.1 - Missing Authorization
• WP Project Manager <= 2.6.25 - Unauthenticated Sensitive Information Exposure
• WP Status Notifier <= 1.0 - Cross-Site Request Forgery to Settings Update
• Google News Editors Picks Feed Generator <= 2.1 - Cross-Site Request Forgery to Stored Cross-Site Scripting
• Event Management Tickets Booking <= 1.4.6 - Authenticated (Administrator+) Stored Cross-Site Scripting via settings
• Post From Frontend <= 1.0.0 - Cross-Site Request Forgery to Arbitrary Post Deletion
• Wicked Folders <= 2.18.16 - Cross-Site Request Forgery on ajax_save_folder
• Nexter Blocks <= 5.0.0 - Authenticated (Subscriber+) Path Traversal to Arbitrary CSS/JS File Deletion via 'plus_name' Parameter
• Valeska <= 1.2.2 - Unauthenticated PHP Object Injection
• CSS & JavaScript Toolbox <= 8.4.1 - Information Exposure
• Kubio AI Page Builder <= 2.9.3 - Unauthenticated Stored Cross-Site Scripting
• ManageWP Worker < 4.9.37 - Authentication Bypass
• Contest Gallery <= 19.1.4.1 - Unauthenticated SQL Injection via cg_Fields
• Petitioner <= 0.7.3 - Missing Authorization
• Post and Page Builder by BoldGrid – Visual Drag and Drop Editor <= 1.27.8 - Cross-Site Request Forgery
• HK Exif Tags <= 1.11 - Cross-Site Scripting
• Easy Social Icons <= 3.2.0 - Admin+ Stored Cross-Site Scripting
• MasterStudy LMS Pro < 4.7.16 - Authenticated (Subscriber+) Information Exposure
• Contact Form 7 <= 6.0.5 - Order Replay Vulnerability
• Clicky by Yoast <= 1.5 - Stored Cross-Site Scripting
• iQ Block Country < 1.1.20 - Reflected Cross-Site Scripting
• Taskbuilder <= 5.0.2 - Authenticated (Subscriber+) SQL Injection via 'order' and 'sort_by' Parameters
• Ads Pro <= 5.0 - Missing Authorization
• Login With OTP Over SMS, Email, WhatsApp and Google Authenticator <= 1.0.4 - Cross-Site Request Forgery to Cross-Site Scripting
• Starter Templates — Elementor, WordPress & Beaver Builder Templates <= 4.1.6 - Authenticated (Contributor+) Server-Side Request Forgery
• Peach Payments Gateway <= 3.1.9 - Missing Authorization via peach_core_version_rollback()
• GeoDirectory – WP Business Directory Plugin and Classified Listings Directory <= 2.8.139 - Missing Authorization to Authenticated (Author+) Arbitrary Image Attachment
• Gallery – Image and Video Gallery with Thumbnails <= 1.9.9 - Reflected Cross-Site Scripting
• Shariff Wrapper <= 4.6.13 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode
• URL Image Importer <= 1.0.6 - Authenticated (Author+) Arbitrary File Upload
• Houzez <= 1.8.3 - Reflected Cross-Site Scripting
• WpDevTool <= 0.1.1 - Reflected Cross-Site Scripting
• AutomatorWP – No-Code Workflow Automation, Integration & Webhooks Plugin, now with AI <= 5.8.3 - Missing Authorization
• Page/Post Specific Social Share Buttons <= 2.1 - Cross-Site Request Forgery to Stored Cross-Site Scripting
• Nelio Popups <= 1.3.0 - Authenticated (Contributor+) Stored Cross-Site Scripting
• The Events Calendar <= 6.5.1.4 - Cross-Site Request Forgery via action_restore_events
• ExactMetrics <= 9.1.2 - Authenticated (Subscriber+) Missing Authorization to Google Ads Access Token Retrieval via AJAX Action 'exactmetrics_ads_get_token'
• Consulting Elementor Widgets <= 1.3.0 - Unauthenticated Local File Inclusion
• WP Circliful <= 1.2 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'id' Shortcode Attribute
• Tutor LMS – eLearning and online course solution <= 2.7.1 -Authenticated (Administrator+) SQL Injection
• Buying Buddy IDX CRM <= 1.2.8 - Cross-Site Request Forgery to PHP Object Injection
• WP Inventory Manager <= 2.1.0.13 - Cross-Site Request Forgery via delete_item