Vulnerability archive: section 3, page 23

Open a report to review affected versions, available fixes and original sources. Each report covers a specific issue; its presence does not establish whether your website is affected.

• Download Manager <= 3.3.52 - Missing Authorization
• Prowess <= 2.3 - Authenticated (Contributor+) Local File Inclusion
• JS Help Desk <= 2.9.2 - Missing Authorization
• Paid Membership Plugin, Ecommerce, User Registration Form, Login Form, User Profile & Restrict Content – ProfilePress <= 4.15.19 - Authenticated (Admin+) Stored Cross-Site Scripting
• Mentoring <= 1.2.8 - Unauthenticated Privilege Escalation in mentoring_process_registration
• SKT Blocks – Gutenberg based Page Builder <= 1.9 - Authenticated (Contributor+) Stored Cross-Site Scripting
• WooCommerce <= 7.8.2 - Sensitive Information Exposure
• Multivendor Marketplace Solution for WooCommerce – WC Marketplace <= 3.8.11.8 - Cross-Site Request Forgery
• WP Log Action <= 0.51 - Reflected Cross-Site Scripting
• Simple Retail Menus <= 4.0.1 - SQL Injection
• Print Invoice & Delivery Notes for WooCommerce <= 5.4.0 - Missing Authorization to Authenticated (Subscriber+) Logo Deletion
• B Slider - Gutenberg Slider Block for WP <= 2.0.0 - Authenticated (Subscriber+) Server-Side Request Forgery
• Extendify <= 3.1.6 - Unauthenticated Stored Cross-Site Scripting via 'styles.blocks' Block Type Key
• Extensions For CF7 (Contact form 7 Database, Conditional Fields and Redirection) <= 3.2.8 - Unauthenticated Arbitrary File Deletion Triggered via Admin Form Submission Deletion
• WPC Badge Management for WooCommerce <= 3.1.6 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'text' Attribute
• Bitly <= 2.7.4 - Authenticated (Contributor+) Stored Cross-Site Scripting
• Timetics <= 1.0.23 - Authorization Bypass
• WDS Multisite Aggregate <= 1.0.0 - Reflected Cross-Site Scripting
• AutoCatSet <= 2.1.4 - Cross-Site Request Forgery
• User Activity Log <= 2.2 - Unauthenticated Limited Arbitrary Option Update
• demon image annotation <= 5.0 - Improper Input Restriction Validation
• InfiniteWP Client <= 1.6.0 - Unauthenticated PHP Object Injection
• Smartarget Message Bar <= 1.4 - Authenticated (Admin+) Stored Cross-Site Scripting
• Download Manager <= 3.2.48 - Authenticated (Contributor+) Stored Cross-Site Scripting
• Age Gate <= 3.5.4 - Missing Authorization
• Unlimited Pop-Ups < 1.4.4 - Cross-Site Scripting
• Alpine PhotoTile for Pinterest <= 1.3.1 - Authenticated (Admin+) Stored Cross-Site Scripting
• Quill Forms <= 3.3.0 - Cross-Site Request Forgery
• g-FFL Checkout <= 2.1.0 - Unauthenticated Arbitrary File Upload
• Importify <= 1.0.4 - Unauthenticated Sensitive Information Exposure
• WordPress Core < 6.2.1 - Directory Traversal
• Quiz Maker Business, Developer, and Agency <= (Multiple Versions) - Unauthenticated SQL Injection via id
• Maspik – Spam blacklist <= 2.9.1 - Unauthenticated Stored Cross-Site Scripting
• WP Google Ad Manager Plugin <= 1.1.0 - Authenticated (Administrator+) Stored Cross-Site Scripting via Admin Settings
• AdSense Privacy Policy <= 1.1.1 - Cross-Site Request Forgery to Stored Cross-Site Scripting
• Plugin for Google Reviews <= 2.2.2 - Missing Authorization
• Click to Chat – WP Support All-in-One Floating Widget <= 2.3.3 - Authenticated (Contributor+) Stored Cross-Site Scripting via wpsaio_snapchat Shortcode
• WordPress Button Plugin MaxButtons <= 9.8.0 - Authenticated (Admin+) Stored Cross-Site Scripting via Button Width
• MP3-jPlayer <= 1.8.11 - Cross-Site Scripting
• Sirat <= 1.5.1 - Missing Authorization
• Jobmonster <= 4.7.8 - Reflected Cross-Site Scripting
• Post Grid Master <= 3.4.12 - Missing Authorization to Unauthenticated Local PHP File Inclusion
• UNIVERSAM < 9.08 - Unauthenticated PHP Object Injection
• Hostel <= 1.1.6 - Reflected Cross-Site Scripting via 'shortcode_id' Parameter
• Download Monitor <= 5.1.10 - Cross-Site Request Forgery to Download Path Deletion and Disabling
• WooCommerce Dynamic Pricing and Discount Rules <= 2.4.0 - Cross-Site Request Forgery
• Scroll To Top <= 1.4.0 - Authenticated (Administrator+) Stored Cross-Site Scripting
• SMS Alert – SMS & OTP for WooCommerce, Order Notifications & Abandoned Cart Recovery <= 3.9.6 - Unauthenticated Privilege Escalation
• Five Star Restaurant Reservations <= 2.7.22 - Unauthenticated Insecure Direct Object Reference to Payment Bypass
• WordPress Core <= 7.0.2 - Authenticated (Author+) CSS Injection
• REDIRECTION PLUS <= 2.0.0 - Reflected Cross-Site Scripting
• WBC907 Core <= 3.4.1 - Authenticated (Contributor+) Stored Cross-Site Scripting
• WassUp Real Time Analytics < 1.8.3.1 - Cross-Site Scripting
• Travel Booking WordPress Theme < 2.7.8.4 - Cross-Site Scripting
• FormGent – Next-Gen AI Form Builder for WordPress with Multi-Step, Quizzes, Payments & More < 1.0.4 - Unauthenticated Arbitrary File Deletion
• Lumise Product Designer < 2.0.9 - Unauthenticated SQL Injection
• Easy Digital Downloads (EDD) Digital Store < 1.3.3 - Cross-Site Scripting
• Tracking Code Manager <= 2.3.0 - Authenticated (Contributor+) Stored Cross-Site Scripting
• Wired Impact Volunteer Management <= 2.5 - Authenticated (Contributor+) Stored Cross-Site Scripting
• Smooth Maps <= 1.1 - Authenticated (Contributor+) Stored Cross-Site Scripting
• AdMail – Multilingual Back in-Stock Notifier for WooCommerce <= 1.7.0 - Missing Authorization
• TheGem Theme Elements (for Elementor) <= 5.11.0 - Authenticated (Contributor+) Stored Cross-Site Scripting
• Banner Effect Header < 1.2.8 - Cross-Site Scripting
• MarketKing — Ultimate WooCommerce Multivendor Marketplace Solution <= 2.1.71 - Missing Authorization
• Nexter Blocks <= 4.7.0 - Unauthenticated Information Exposure
• PDF Builder for WooCommerce. Create invoices,packing slips and more <= 1.2.136 - Reflected Cross-Site Scripting
• SEO Link Rotator <= 1.0 - Cross-Site Scripting
• Easy Cookie Law <= 3.1 - Cross-Site Request Forgery via 'ecl_options'
• Media Library Assistant <= 3.35 - Authenticated (Contributor+) SQL Injection
• Accept Stripe Payments Using Contact Form 7 <= 3.0 - Unauthenticated Information Exposure
• WP REST API <= 1.2.2 - Cross-Site Scripting
• Stock Locations for WooCommerce <= 3.1.8 - Missing Authorization
• Simple Iframe <= 1.1.1 - Authenticated(Contributor+) Stored Cross-Site Scripting via block attributes
• Arigato Autoresponder and Newsletter <= 2.7.1 - Authenticated (Admin+) Stored Cross-Site Scripting
• Official Integration for Billingo <= 4.3.2 - Authenticated (Shop Manager+) Privilege Escalation
• Tiki Time <= 1.3 - Reflected Cross-Site Scripting
• Leadrebel <= 1.0.2 - Missing Authorization
• Toocheke Companion <= 1.194 - Authenticated (Contributor+) Stored Cross-Site Scripting
• Orion SMS OTP Verification <= 1.1.7 - Authentication Bypass via Account Takeover
• Banner System <= 1.0.0 - Authenticated (Contributor+) Stored Cross-Site Scripting
• Bitly's WordPress Plugin <= 2.7.1 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode
• Essential Addons for Elementor – Best Elementor Templates, Widgets, Kits & WooCommerce Builders <= 5.9.8 - Authenticated (Contributor+) Stored Cross-Site Scripting
• User Profile Builder <= 3.15.7 - Unauthenticated Stored Cross-Site Scripting via 'Biographical Info' Meta Field
• Custom Post Types and Custom Fields creator <= 2.3.2 - Authenticated (Administrator+) Stored Cross-Site Scripting
• WordPress Core < 4.9.5 - Authenticated Stored Cross-Site Scripting via Generator Tag
• AdPush <= 1.50 - Reflected Cross-Site Scripting
• BA Book Everything <= 1.8.16 - Missing Authorization
• SKT Blocks <= 2.2 - Authenticated (Contributor+) Stored Cross-Site Scripting
• Premium Addons for Elementor <= 4.11.63 - Missing Authorization to Authenticated (Subscriber+) Settings Update
• EventPrime <= 4.2.8.4 - Missing Authorization to Authenticated (Subscriber+) Arbitrary Event Modification via 'event_id' Parameter
• rng-refresh <= 1.0 - Reflected Cross-Site Scripting
• WP2LEADS <= 3.3.3 - Reflected Cross-Site Scripting
• Jobs for WordPress <= 2.5.10.2 - Authenticated (Administrator+) Stored Cross-Site Scripting
• Accordion Slider PRO <= 1.2 - Authenticated (Contributor+) SQL Injection
• AutoWP <= 2.2.2 - Missing Authorization
• SAICO <= 1.0.2 - Arbitrary File Upload
• Hide My WP < 6.2.9 - Unauthenticated SQL Injection
• WPBot <= 8.5.9 - Unauthenticated Sensitive Information Exposure in 'wpbot_send_email_transcript' AJAX Action
• LWS Optimize – All-in-One Speed Booster & Cache Tools < 3.4 - Missing Authorization
• GeoDirectory <= 2.8.188 - Authenticated (Subscriber+) Stored Cross-Site Scripting via Contact Email Custom Field