Vulnerability archive: section 3, page 14

Open a report to review affected versions, available fixes and original sources. Each report covers a specific issue; its presence does not establish whether your website is affected.

• Analytics Germanized for Google Analytics <= 1.6.2 - Authenticated (Contributor+) Stored Cross-Site Scripting
• Theme Switcher Reloaded <= 1.1 - Reflected Cross-Site Scripting
• JobCareer <= 3.4 - Multiple Cross-Site Scripting
• WP Project Manager Pro <= 4.0.1 - Authenticated (Subscriber+) SQL Injection
• Mail Subscribe List <= 2.1.10 - Authenticated (Contributor+) Stored Cross-Site Scripting
• Exclusive Addons Elementor <= 2.6.8 - Authenticated (Contributor+) Stored Cross-Site Scripting
• WPBifröst – Instant Passwordless Temporary Login Links <= 1.0.7 - Missing Authorization to Authenticated (Subscriber+) Privilege Escalation
• HUSKY – Products Filter Professional for WooCommerce <= 1.3.7.2 - Authenticated (Subscriber+) Insecure Direct Object Reference via 'woof_add_query/woof_remove_query'
• Users Ultra Membership, Users Community and Member Profiles With PayPal Integration Plugin <= 1.3.58 - SQL Injection
• Jupiterx Core <= 4.8.7 - Authenticated (Contributor+) Arbitrary File Read
• Gallery Metabox <= 1.5 - Missing Authorization via gallery_remove
• WP Dropzone <= 1.1.1 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'callback' Shortcode Attribute
• Pootle button <= 1.2.0 - Reflected Cross-Site Scripting
• Super Forms – Drag & Drop Form Builder <= 6.3.316 - Authenticated (Subscriber+) Privilege Escalation via 'user_id' Parameter in Register & Login
• Directorist: AI-Powered Business Directory, Listings & Classified Ads <= 8.10.2.1 - Missing Authorization to Authenticated (Subscriber+) Arbitrary Listing Deletion via 'listing_id' Parameter
• Parcel Tracker eCourier <= 1.0.1 - Cross-Site Request Forgery
• Internal Linking for SEO traffic & Ranking – Auto internal links (100% automatic) <= 1.2.1 - Authenticated (Administrator+) SQL Injection via post_id Parameter
• Annual Archive <= 1.6.0 - Authenticated (Admin+) Stored Cross-Site Scripting
• Simple SEO <= 2.0.25 - Cross-Site Request Forgery via multiple admin_post functions
• Gravity Forms Insightly <= 1.1.6 - Unauthenticated PHP Object Injection
• WP Data Access – App Builder for Tables, Forms, Charts, Maps & Dashboards <= 5.5.81 - Unauthenticated SQL Injection
• MasterStudy LMS Pro <= 4.7.0 - Authenticated (Subscriber+) Arbitrary File Upload
• Little Birdies | Multipurpose Children PSD Template <= 1.3.16 - Unauthenticated Local File Inclusion
• WPB Elementor Addons <= 1.0.9 - Authenticated (Contributor+) Stored Cross-Site Scripting
• Complianz – GDPR/CCPA Cookie Consent <= 7.5.1 - Unauthenticated Information Exposure
• Turnkey bbPress by WeaverTheme <= 1.6.3 - Reflected Cross-Site Scripting via _wpnonce Parameter
• SiteSkite – Secure MCP & AI WebOps. Connect ChatGPT, Claude, or Any AI Agent via MCP <= 2.1.8 - Unauthenticated Remote Code Execution
• PropertyHive <= 2.1.12 - Missing Authorization
• Tutor LMS <=1.8.2 - SQL Injection via tutor_quiz_builder_get_answers_by_question
• Unlimited Elements For Elementor <= 2.0.12 - Unauthenticated Stored Cross-Site Scripting
• Import any XML or CSV File to WordPress <= 3.6.8 - Authenticated (Administrator+) Arbitrary File Upload via Path Traversal
• Echelon <= 2.4 - Arbitrary File Download
• Ecwid Shopping Cart <= 7.0.5 - Missing Authorization
• eMagicOne Store Manager for WooCommerce <= 1.3.2 - Unauthenticated SQL Injection
• Emoji Shortcode <= 1.0.0 - Authenticated (Contributor+) Stored Cross-Site Scripting
• ElementsReady Addons for Elementor 6.4.2 - Open Redirect
• Elementor Pro <= 3.0.5 - Authenticated Remote Code Execution in Dynamic OOO Widget
• WP ERP <= 1.12.6 - Missing Authorization via admin notice dismissal
• Royal Elementor Addons <= 1.3.59 - Insufficient Access Control to Template Activation
• Photo Gallery <= 1.5.66 - Authenticated Stored Cross-Site Scripting via Gallery Title
• Podlove Podcast Publisher <= 4.1.13 - Cross-Site Request Forgery to Remote Code Execution
• WPS Hide Login <= 1.5.2.2 - Login Page Disclosure via 'action=confirmaction'
• Watu Quiz <= 3.4.4 - Unauthenticated Stored Cross-Site Scripting via HTTP Referer
• WooCommerce – Store Exporter <= 2.7.4 - Reflected Cross-Site Scripting
• LearnPress Export Import <= 4.0.9 - Reflected Cross-Site Scripting
• FontAwesome.io ShortCodes <= 1.0 - Authenticated (Contributor+) Stored Cross-Site Scripting
• Advanced Google reCaptcha <= 1.27 - Built-in Math CAPTCHA Bypass
• Responsive Blocks <= 2.0.5 - Authenticated (Contributor+) Stored Cross-Site Scripting
• Search & Go - Directory WordPress Theme <= 2.7 - Authentication Bypass to Privilege Escalation via Account Takeover
• WPBot – AI ChatBot for Live Support, Lead Generation, AI Services <= 8.3.2 - Reflected Cross-Site Scripting
• Direct checkout, Add to cart redirect for Woocommerce <= 2.1.48 - Authenticated (Administrator+) Stored Cross-Site Scripting
• WooCommerce <= 5.1.3 - Authenticated (Admin+) Stored Cross-Site Scripting
• Slideshow < 2.1.13 - Cross-Site Scripting and Sensitive Information Disclosure
• WP VR <= 8.2.9 - Missing Authorization
• Grand Photography WordPress <= 5.7.8 - Unauthenticated PHP Object Injection
• Tonda - Elegant Shop WordPress Theme < 2.6 - Unauthenticated Local File Inclusion
• Chained Quiz <= 1.1.8.1 - Reflected Cross-Site Scripting
• RD Station <= 5.3.2 - Authenticated (Contributor+) Stored Cross-Site Scripting
• Noindex by Path <= 1.0 - Cross-Site Request Forgery
• Modern <= 1.4.1 - Cross-Site Scripting
• WP Google Fonts <= 3.1.3 - Reflected Cross-Site Scripting
• Acobot Live Chat & Contact Form <= 2.0 - Cross-Site Request Forgery and Cross-Site Scripting
• User Language Switch <= 1.6.10 - Reflected Cross-Site Scripting
• Integration for Salesforce and Contact Form 7, WPForms, Elementor, Formidable, Ninja Forms <= 1.4.4 - Unauthenticated Full Path Disclosure
• Upload Fields for WPForms <= 1.0.2 - Missing Authorization
• WP SuperBackup <= 2.3.3 - Missing Authorization to Unauthenticated Back-Up File Download
• Community by PeepSo <= 6.1.6.0 - Cross-Site Request Forgery via delete
• The Events Calendar <= 6.6.3 - Unauthenticated Stored Cross-Site Scripting
• Gardis <= 1.2.13 - Unauthenticated Local File Inclusion
• Child Themes <= 1.0.1 - Reflected Cross-Site Scripting
• Email on Publish <= 1.5 - Cross-Site Request Forgery to Stored Cross-Site Scripting
• WordPress Landing Pages <= 1.8.7 - Cross-Site Scripting
• TAX SERVICE Electronic HDM <= 1.1.2 - Unauthenticated SQL Injection
• Star CloudPRNT for WooCommerce <= 2.0.3 - Reflected Cross-Site Scripting
• Booking Manager <= 2.1.20 - Authenticated (Subscriber+) Insecure Direct Object Reference
• Extra Fees Plugin for WooCommerce <= 4.3.3 - Cross-Site Request Forgery
• LatePoint <= 5.6.2 - Unauthenticated Insecure Direct Object Reference to Arbitrary Creation via 'service_id' Parameter
• Leaflet Map <= 3.4.4 - Authenticated (Contributor+) Stored Cross-Site Scripting
• Content Control – The Ultimate Content Restriction Plugin! Restrict Content, Create Conditional Blocks & More <= 2.5.0 - Unauthenticated Content Restriction Bypass to Sensitive Information Exposure
• Uncanny Automator <= 7.3.1.4 - Unauthenticated PHP Object Injection to Arbitrary File Deletion via Forminator Submitted-Field Token
• Print PDF Generator and Publisher <= 1.2.0 - Cross-Site Request Forgery
• Social Pixel <= 2.1 - Authenticated (Admin+) Stored Cross-Site Scripting
• Team Showcase <= 2.9 - Authenticated (Contributor+) Stored Cross-Site Scripting
• WP Fastest Cache <= 1.1.2 - Missing Authorization in 'wpfc_clear_cache_of_allsites_callback'
• Simple Payment <= 2.5.4 - Authenticated (Contributor+) Stored Cross-Site Scripting
• Booking and Rental Manager <= 1.2.1 - Authenticated (Administrator+) Stored Cross-Site Scripting
• Email Log <= 2.4.6 - Admin+ SQL Injection
• Grand Blog < 3.1.5 - Unauthenticated Server-Side Request Forgery
• Poll, Survey & Quiz Maker Plugin by Opinion Stage <= 19.12.0 - Cross-Site Request Forgery to Account Disconnection
• WordPress RokBox <= 2.13 - Abuse of Functionality
• Scroll Top Advanced <= 2.5 - Authenticated (Subscriber+) Stored Cross-Site Scripting
• Twitget < 3.3.3 - Cross-Site Request Forgery
• Quiz Maker <= 6.4.9.4 - Missing Authorization to Email Disclosure
• Jquery news ticker <= 3.0 - Authenticated (Subscriber+) SQL Injection via Shortcode
• The Events Calendar Countdown Addon <= 1.4.9 - Authenticated (Contributor+) Stored Cross-Site Scripting
• Video Background Block – Add Stunning Video Backgrounds to Any Section <= 2.0.3 - Unauthenticated Stored Cross-Site Scripting
• Stellissimo Text Box <= 1.1.4 - Authenticated (Admin+) Stored Cross-Site Scripting
• Getwid <= 2.1.2 - Authenticated (Contributor+) Sensitive Information Exposure
• Spreadconnect <= 2.1.6 - Missing Authorization
• WP doodlez <= 1.0.10 - Unauthenticated Stored Cross-Site Scripting