Vulnerability archive: section 3, page 26

Open a report to review affected versions, available fixes and original sources. Each report covers a specific issue; its presence does not establish whether your website is affected.

• WP2LEADS <= 3.5.0 - Cross-Site Request Forgery
• GSheetConnector <= 5.2.1 - Authenticated (Administrator+) SQL Injection via 's' Parameter
• SP Rental Manager <= 1.5.3 - Unauthenticated SQL Injection
• All-in-one Like Widget <= 2.2.7 - Authenticated (Admin+) Stored Cross-Site Scripting
• Shortcode Addons- with Visual Composer, Divi, Beaver Builder and Elementor Extension <= 3.1.2 - Authenticated Arbitrary Options Update
• WordPress File Upload <= 4.24.11 - Unauthenticated Path Traversal to Arbitrary File Read and Deletion in wfu_file_downloader.php
• All-in-One WP Migration <= 7.58 - Directory Traversal to File Deletion on Windows Hosts
• CSS & JavaScript Toolbox <= 12.0.6 - Authenticated (Administrator+) Stored Cross-Site Scripting via Assignment Engine Fields
• Easy Form Builder by WhiteStudio <= 4.0.11 - Unauthenticated Privilege Escalation to Administrator via Password Recovery REST Endpoint
• WP Headless CMS Framework <= 1.15 - Unauthenticated Protection Mechanism Bypass
• Yoo Slider <= 2.1.1 - Reflected Cross-Site Scripting
• Simple Real Estate Pack <= 1.4.8 - Authenticated (Admin+) Stored Cross-Site Scripting
• Advanced Booking Calendar <= 1.6.9 - Unauthenticated SQL Injection
• Meetup <= 0.1 - Authentication Bypass via Account Takeover
• Block for Mailchimp – Add Email Subscription Forms and Collect Leads <= 1.1.15 - Missing Authorization
• Bit Form <= 1.8.1 - Unauthenticated Arbitrary File Upload to Remote Code Execution
• WP Home Page Menu < 3.1 - Authenticated (Admin+) Stored Cross-Site Scripting
• Dokan: AI Powered WooCommerce Multivendor Marketplace Solution – Build Your Own Amazon, eBay, Etsy <= 5.0.10 - Missing Authorization
• Salon booking system <= 10.30.3 - Cross-Site Request Forgery
• Quiz And Survey Master <= 7.3.6 - Cross-Site Request Forgery
• Divi Essentials <= 5.8.1 - Missing Authorization to Authenticated (Subscriber+) Sensitive Information Disclosure via dnxte_get_database_data AJAX Action
• Seraphinite Accelerator <= 2.28.14 - Missing Authorization to Authenticated (Subscriber+) Log Clearing
• Unlimited Timeline < 1.6.1 - Missing Authorization
• Appointment Booking Calendar — Simply Schedule Appointments Booking Plugin <= 1.6.7.7 - Authenticated (Subscriber+) SQL Injection
• Ace User Management <= 2.0.3 - Unauthenticated Privilege Escalation via Password Reset
• Titan Anti-spam & Security <= 4.1 - Cross-Site Scripting
• Campaign Monitor for WordPress <= 2.8.12 - Reflected Cross-Site Scripting
• Stripe for WooCommerce 3.0.0 - 3.3.9 - Missing Authorization Controls to Financial Account Hijacking
• Countdown and CountUp, WooCommerce Sales Timers <= 1.5.7 - Cross-Site Request Forgery to Stored Cross-Site Scripting
• VK All in One Expansion Unit <= 9.96.0.1 - Authenticated (Contributor+) Stored Cross-Site Scripting via className
• Insert or Embed Articulate Content into WordPress <= 4.3000000025 - Authenticated (Editor+) Arbitrary File Upload
• WP Sort Order <= 1.3.1 - Missing Authorization
• Post Expirator <= 2.5.1 - Contributor+ Arbitrary Post Schedule Deletion
• Advanced Popups <= 1.1.1 - Cross-Site Request Forgery Bypass
• PPOM for WooCommerce <= 32.0.6 - Reflected Cross-Site Scripting
• Locatoraid Store Locator <= 3.9.72 - Unauthenticated SQL Injection
• SEO Plugin by Squirrly SEO <= 11.1.11 - Reflected Cross-Site Scripting
• Kallyas <= 4.24.0 - Authenticated (Contributor+) Remote Code Execution
• AHAthat Plugin <= 1.6 - Authenticated (Administrator+) SQL Injection via id Parameter
• Gutenverse <= 1.9.2 - Authenticated (Contributor+) Stored Cross-Site Scripting
• SMTP2GO <= 1.4.2 - Authenticated (Administrator+) Stored Cross-Site Scripting via admin settings
• Contest Gallery <= 30.0.6 - Authenticated (Author+) Second-Order SQL Injection via MultipleFiles Second-Order Payload via 'cg_multiple_files_for_post' -> 'cgRealId'
• PlugNedit Adaptive Editor < 6.2.0 - Authenticated Stored Cross-Site Scripting
• Education Center | LMS & Online Courses WordPress Theme <= 3.6.10 - PHP Object Injection
• CGD Arrange Terms <= 1.1.3 - Reflected Cross-Site Scripting
• BigBlueButton <= 3.0.0-beta.4 - Reflected Cross-Site Scripting
• Easy Forms for Mailchimp <= 6.8.8 - Reflected Cross-Site Scripting via 'sql_error'
• DsgnWrks Twitter Importer <= 1.1.4 - Reflected Cross-Site Scripting
• JetElements For Elementor <= 2.7.12 - Authenticated (Contributor+) Stored Cross-Site Scripting
• Frontend Dashboard 3.0.0 - 3.0.4 - Unauthenticated Privilege Escalation
• Contest Gallery – Upload, Vote & Sell with PayPal and Stripe <= 27.0.2 - Authenticated (Author+) Stored Cross-Site Scripting
• Post Expirator <= 4.9.4 - Authenticated (Contributor+) Stored Cross-Site Scripting
• Post State Tags <= 2.0.6 - Cross-Site Request Forgery to Settings Reset
• NanoCare < 1.2.2 - Missing Authorization
• Dynamic Product Category Grid, Slider for WooCommerce <= 1.1.3 - Authenticated (Contributor+) Local File Inclusion
• Privacy Policy Generator, Terms & Conditions Generator WordPress Plugin : WP Legal Pages <= 3.2.7 - Cross-Site Request Forgery
• All in One SEO – Powerful SEO Plugin to Boost SEO Rankings & Increase Traffic <= 4.9.2 - Missing Authorization to Authenticated (Contributor+) AI Access Token and Credit Disclosure
• User Management <= 1.1 - Authenticated (Subscriber+) Arbitrary File Upload
• Emberlyn <= 1.3.1 - Unauthenticated Local File Inclusion
• Salevo Boost Sales for WooCommerce – Set up Up-Sells & Cross-Sells Popups & Auto Apply Coupon <= 1.3.0 - Missing Authorization
• Ultimate Member <= 2.13.1 - Missing Authorization to Unauthenticated Sensitive Profile Field Disclosure via Member Directory Field Privacy Bypass
• Premium Addons for Elementor <= 4.10.33 - Authenticated (Contributor+) DOM-Based Stored Cross-Site Scripting
• Flo Forms <= 1.0.42 - Missing Authorization
• EC Stars Rating <= 1.0.11 - Authenticated (Administrator+) Stored Cross-Site Scripting
• WRC Pricing Tables <= 2.3.4 - Authenticated (Administrator+) Stored Cross-Site Scripting
• Exquisite PayPal Donation <= v2.0.0 - Authenticated(Admin+) Stored Cross-Site Scripting
• Views for WPForms – Display & Edit WPForms Entries on your site frontend <= 3.4.6 - Authenticated (Contributor+) SQL Injection
• WP Coder <= 2.5.2 - Cross-Site Request Forgery
• Gallery – Photo Albums Plugin < 1.3.47 - Cross-Site Scripting
• Course Booking System <= 6.1.2 - Reflected Cross-Site Scripting
• Broadstreet <= 1.51.1 - Cross-Site Request Forgery
• WP Pipes <= 1.4.2 - Unauthenticated Arbitrary File Deletion
• Newsletters <= 4.13 - Missing Authorization
• Burst Statistics <= 2.0.6 - Cross-Site Request Forgery
• AJAX Report Comments <= 2.0.4 - Cross-Site Request Forgery to Settings Update
• LoginPress <= 1.5.11 - Reflected Cross-Site Scripting via redirect-page Parameter
• Widget Countdown <= 2.7.4 - Authenticated (Contributor+) Stored Cross-Site Scripting
• Sessions <= 3.2.0 - Authenticated (Administrator+) Stored Cross-Site Scripting
• VatanSMS WP SMS <= 1.01 - Reflected Cross-Site Scripting via 'page' Parameter
• WooCommerce Store Exporter <= 1.7.5 - Reflected Cross-Site Scripting
• WP Affiliate Disclosure <= 1.2.7 - Authenticated (Contributor+) Stored Cross-Site Scripting via $id
• Site Setup Wizard <= 1.5.8 - Unauthenticated SQL Injection
• EasyEvent <= 1.0.0 - Authenticated (Admin+) Cross-Site Scripting
• Link Library <= 7.6.6 - Reflected Cross-Site Scripting
• Site Kit by Google <= 1.7.1 - Sensitive Information Disclosure
• Website Builder by SeedProd - Theme Builder, Landing Page Builder, Coming Soon Page, Maintenance Mode <= 6.20.2 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'seedprodnestedmenuwidget' Shortcode
• Easy Digital Downloads – eCommerce Payments and Subscriptions made easy < 3.7.1 - Authenticated (Subscriber+) Information Exposure
• Ghost (Hide My WP Ghost) <= 7.0.10 - Unauthenticated Protection Mechanism Bypass
• WorkScout-Core <= 1.7.08 - Cross-Site Request Forgery
• Elementor <= 3.33.3 - Authenticated (Contributor+) Stored DOM-Based Cross-Site Scripting via Text Path
• Consensu.io <= 1.0.3 - Missing Authorization via update_config_db()
• RWS Enquiry And Lead Follow-up <= 1.0 - Reflected Cross-Site Scripting
• Quick Contact Form <= 8.2.5 - Cross-Site Request Forgery
• Depicter Slider <= 3.2.2 - Authenticated (Editor+) Stored Cross-Site Scripting
• Responsive Column Widgets <= 1.2.7 - Open Redirect via responsive_column_widgets_link
• Wordfence Security – Firewall & Malware Scan <= 7.6.0 - Authenticated (Admin+) Stored Cross-Site Scripting
• Simple Social Media Share Buttons <= 3.2.3 - Admin+ Stored Cross-Site Scripting
• Online Booking & Scheduling Calendar for WordPress by vcita <= 4.3.0 - Unauthenticated Stored Cross-Site Scripting
• audioCase <= 1.2.1 - Authenticated (Contributor+) Stored Cross-Site Scripting
• Jetpack <= 4.0.3 - Cross-Site Scripting