Vulnerability archive: section 3, page 16

Open a report to review affected versions, available fixes and original sources. Each report covers a specific issue; its presence does not establish whether your website is affected.

• Favorites <= 2.3.6 - Unauthenticated Local File Inclusion
• Elementor Website Builder <= 3.16.4 - Authenticated (Contributor+) Stored Cross-Site Scripting via get_inline_svg()
• Uploadcare File Uploader and Adaptive Delivery (beta) <= 3.0.11 - Cross-Site Request Forgery
• Mobile App for WooCommerce: ShopApper Mobile App Builder Service for WooCommerce <= 0.4.62 - Missing Authorization
• Printo <= 1.11 - Unauthenticated Local File Inclusion
• Mailjet Email Marketing <= 6.2.3 - Unauthenticated Information Exposure
• SP Project & Document Manager <= 4.69 - Authenticated (Contributor+) SQL Injection via Shortcode
• PowerPack Elementor Addons (Free Widgets, Extensions and Templates) <= 2.8.1 - Authenticated (Contributor+) Post Disclosure
• ShortPixel Image Optimizer <= 5.6.3 - Authenticated (Editor+) SQL Injection
• Essential Addons for Elementor <= 5.0.4 - Local File Inclusion
• Optima Express 8.5.0 - 8.7.5 - Missing Authorization
• Social Boost: Giveaways, Instant win and Contests. Grow followers, shares, subscribers, traffic, referrals, sales and more <= 3.6.2 - Missing Authorization
• GuCherry Blog <= 1.1.8 - Reflected Cross-Site Scripting
• Listing, Classified Ads & Business Directory – uListing <= 2.0.5 - Cross-Site Request Forgery
• Beaver Builder – WordPress Page Builder <= 2.7.4.4 - Authenticated(Contributor+) Stored Cross-Site Scripting via heading tag
• WP Go Maps <= 9.0.15 - Authenticated (Admin+) Directory Traversal
• VikRentCar <= 1.4.0 - Unauthenticated SQL Injection
• WPSchoolPress <= 2.2.4 - Cross-Site Request Forgery
• User Activity Log <= 1.6.6 - IP Address Spoofing
• No API Amazon Affiliate <= 4.2.2 - Authenticated (Administrator+) Stored Cross-Site Scripting
• Predictive Search <= 1.2.2 - Missing Authorization
• Directorist AddonsKit for Elementor <= 1.1.6 - Authenticated (Contributor+) Stored Cross-Site Scripting
• WordPress Plugin Tournamatch < 4.6.1 - Authenticated (Admin+) Stored Cross-Site Scripting
• TP Education <= 4.4 - Authenticated (Contributor+) Stored Cross-Site Scripting via shortcodes
• Gestpay for WooCommerce <= 20221130 - Cross-Site Request Forgery (CSRF) via ajax_set_default_card
• Salon booking system <= 10.30.3 - Authenticated (Subscriber+) Information Exposure
• HT Mega – Absolute Addons For Elementor <= 2.9.1 - Improper Authorization to Authenticated (Contributor+) Limited Administrator Actions
• JetEngine <= 3.8.9.1 - Unauthenticated Stored Cross-Site Scripting
• GetShop ecommerce <= 1.3 - Unauthenticated Local File Inclusion
• wpDiscuz <= 7.6.10 - Unauthenticated Content Injection
• CTL Arcade Lite <= 1.0 - Cross-Site Request Forgery to Plugin Activation and Deactivation
• Spectra <= 2.19.14 - Authenticated (Contributor+) Stored Cross-Site Scripting via Custom CSS
• YayMail – WooCommerce Email Customizer <= 4.3.2 - Missing Authorization
• Goya <= 1.0.8.7 - Unauthenticated Reflected Cross-Site Scripting via Multiple Parameters
• WP Users Media <= 4.2.3 - Cross-Site Request Forgery in wpusme_save_settings
• MailPoet Newsletters <= 2.7.2 - SQL Injection
• Visual Form Builder <= 2.8.2 - Authenticated SQL Injection
• All In One WP Security & Firewall <= 4.1.2 - Captcha Bypass
• Themes4WP YouTube External Subtitles <= 1.0 - Authenticated (Contributor+) Stored Cross-Site Scripting
• Posts and Products Views for WooCommerce <= 2.1 - Authenticated (Contributor+) Stored Cross-Site Scripting
• WP Docs <= 2.2.9 - Authenticated (Subscriber+) Stored Cross-Site Scripting via 'wpdocs_options[icon_size]'
• AlT Monitoring <= 1.0.3 - Cross-Site Request Forgery to Stored Cross-Site Scripting
• Posts Date Ranges <= 2.2 - Reflected Cross-Site Scripting
• Colibri Page Builder <= 1.0.248 - Missing Authorization
• Memberlite Shortcodes <= 1.3.8 - Authenticated (Contributor+) Stored Cross-Site Scripting
• Qubely – Advanced Gutenberg Blocks <= 1.8.14 - Missing Authorization
• which template file <= 5.0.0 - Unauthenticated Cross-Site Scripting
• Directorist <= 7.5.3 - Authenticated (Administrator+) Local File Inclusion
• Buy one click WooCommerce <= 2.3.0 - Missing Authorization to Authenticated (Subscriber+) Order Deletion
• Dokan Pro <= 5.0.2 - Authenticated (Subscriber+) SQL Injection
• LadiApp: Landing Page, PopupX, Marketing Automation, Affiliate Marketing… <= 4.3 - Missing Authorization via init_endpoint
• iMoney <= 0.36 - Reflected Cross-Site Scripting
• Hippoo Mobile App for WooCommerce <= 1.9.5 - Missing Authorization
• WPS Limit Login < 1.4.6.1 - Stored Cross-Site Scripting
• Flash Video Player <= 5.0.4 - Cross-Site Request Forgery
• Booking Calendar <= 11.8.3 - Reflected Cross-Site Scripting via 'wpbc_auto_fill' Parameter
• BasePress Migration Tools <= 1.0.0 - Authenticated (Subscriber+) Arbitrary File Upload
• WordPress Content Slide <= 1.4.2 - Cross-Site Scripting
• User Registration & Membership – Free & Paid Memberships, Subscriptions, Content Restriction, User Profile, Custom User Registration & Login Builder <= 5.2.8 - Authenticated (Contributor+) Stored Cross-Site Scripting
• MaxButtons <= 9.2 - Authenticated (Administrator+) Stored Cross-Site Scripting
• PowerPress Podcasting plugin by Blubrry < 11.17.1 - Authenticated (Contributor+) Server-Side Request Forgery
• amtyThumb posts <= 8.2.0 - Cross-Site Scripting
• iSape <= 0.72 - Reflected Cross-Site Scripting
• MSRP (RRP) Pricing for WooCommerce <= 1.8.1 - Reflected Cross-Site Scripting
• Easy Media Replace <= 0.2.0 - Authenticated (Author+) Stored Cross-Site Scripting
• XPlainer - WooCommerce Product FAQ <= 1.6.3 - Reflected Cross-Site Scripting
• Workio <= 1.0.2 - Reflected Cross-Site Scripting
• Send From <= 2.2 - Authenticated (Administrator+) Stored Cross-Site Scripting
• WP w3all phpBB <= 2.9.9 - Cross-Site Request Forgery to Stored Cross-Site Scripting
• Custom Field Suite <= 2.6.5 - Authenticated (Admin+) Stored Cross-Site Scripting
• Integration for Epos Now and WooCommerce 4.6.0 - 4.11.1 - Missing Authorization
• Samex - Clean, Minimal Shop WooCommerce WordPress Theme <= 2.6 - Unauthenticated Local File Inclusion
• Elementor Website Builder Pro <= 3.20.1 - Authenticated (Contributor+) Stored Cross-Site Scripting via Form Widget SVGZ File Upload
• Formidable Forms – Contact Form Plugin, Survey, Quiz, Payment, Calculator Form & Custom Form Builder <= 6.16.1.2 - Reflected Cross-Site Scripting via Custom HTML Form Parameter
• Qi Blocks <= 1.3.6 - Authenticated (Contributor+) Stored Cross-Site Scripting via ToC Block
• Dadevarzan WordPress Common <= 2.2.2 - Authenticated (Contributor+) Stored Cross-Site Scripting
• Photo Gallery by Ays <= 5.1.6 - Reflected Cross-Site Scripting
• CSS3 Tooltips for WordPress <= 1.8 - Missing Authorization
• CodeablePress <= 1.0.0 - Missing Authorization
• jQuery T(-) Countdown Widget <= 2.3.25 - Authenticated (Contributor+) Stored Cross-Site Scripting via tminus Shortcode
• wordpress vertical image slider plugin < 1.2 - Cross-Site Request Forgery
• Mediabay <= 1.6 - Authenticated (Editor+) Stored Cross-Site Scripting Vulnerability
• Cache control by Cacholong <= 5.4.1 - Authenticated (Administrator+) Stored Cross-Site Scripting
• Custom Comment Notifications <= 1.0.8 - Cross-Site Request Forgery to Stored Cross-Site Scripting
• WP-T-Wap <= 1.13.2 - Reflected Cross-Site Scripting
• Metform Elementor Contact Form Builder <= 3.3.1 - Authenticated (Subscriber+) Information Disclosure via mf shortcode
• WP Post Author – Author Box, Multiple Authors, Guest Authors & Custom Avatars <= 4.0.0 - Authenticated (Administrator+) SQL Injection
• Shipdeo <= 1.2.8 - Reflected Cross-Site Scripting
• User Submitted Posts – Enable Users to Submit Posts from the Front End <= 20260810 - Authenticated (Contributor+) Stored Cross-Site Scripting
• Animal Captcha <= 1.6.2 - Reflected Cross-Site Scripting
• Contest Gallery <= 28.1.6 - Unauthenticated SQL Injection
• Post Grid and Gutenberg Blocks <= 2.2.92 - Authenticated (Contributor+) Stored Cross-Site Scripting
• WordPress Ad Widget <= 2.20.0 - Authenticated (Admin+) Stored Cross-Site Scripting
• VideoWhisper Video Presentation <= 4.1.4 - Arbitrary File Upload
• FV Simpler SEO <= 1.9.6 - Missing Authorization
• Ocean Extra <= 2.4.6 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode
• ProfileGrid <= 5.5.2 - Missing Authorization to Arbitrary Group Option Modification and Privilege Escalation
• DeBounce Email Validator <= 5.6.5 - Reflected Cross-Site Scripting
• SVG Shortcode <= 1.0.1 - Authenticated (Author+) Stored Cross-Site Scripting via SVG Upload
• HD Quiz <= 2.0.9 - Missing Authorization