Vulnerability archive: section 3, page 6

Open a report to review affected versions, available fixes and original sources. Each report covers a specific issue; its presence does not establish whether your website is affected.

• BERTHA AI <= 1.12.10.2 - Authenticated (Subscriber+) Arbitrary Content Deletion
• Lattice < 1.1.5 - Cross-Site Scripting
• WP Survey And Quiz Tool < 1.3 - Cross-Site Scripting
• WP Travel Gutenberg Blocks <= 3.9.2 - Authenticated (Contributor+) Stored Cross-Site Scripting
• Recent Posts Slider <= 1.1 - Reflected Cross-Site Scripting
• WordCamp Talks < 1.0.0 Beta3 - CSV Injection
• Bulk Categories Assign <= 1.0 - Reflected Cross-Site Scripting
• LIQUID SPEECH BALLOON < 1.0.7 - Cross-Site Scripting
• Profile Builder - User Profile & User Registration Forms <= 3.6.1 - Cross-Site Scripting via site_url Parameter
• TrueBooker – Appointment Booking and Scheduler System < 1.2.7 - Missing Authorization
• Built-in Widgets Query extend <= 1.05 - Reflected Cross-Site Scripting
• bBlocks – Essential Gutenberg Blocks & Patterns Collection <= 2.0.31 - Authenticated (Contributor+) Privilege Escalation
• Qards (Unspecified Version) - Stored Cross-Site Scripting
• Related Posts < 2.7.2 - Cross-Site Request Forgery
• WP PT-Viewer <= 2.0.2 - Reflected Cross-Site Scripting
• WordPress Video <= 1.0 - Authenticated (Contributor+) Stored Cross-Site Scripting
• WP Get The Table <= 1.5 - Authenticated (Contributor+) Stored Cross-Site Scripting via url Parameter
• MailPoet Newsletters (Previous) <= 2.6.10 - Cross-Site Request Forgery
• Soumettre.fr <= 2.1.3 - Missing Authorization
• WP Custom Fields Search <= 1.2.35 - Authenticated (Contributor+) Stored Cross-Site Scripting via wpcfs-preset Shortcode
• WooCommerce Warranty Requests <= 2.2.7 - Missing Authorization
• Manual Purchases < 1.1.0 - Reflected Cross-Site Scripting
• Docket (WooCommerce Collections / Wishlist / Watchlist) < 1.7.0 - Unauthenticated SQL Injection
• Coaching Staffs <= 1.5.1 - Authenticated (Contributor+) Stored Cross-Site Scripting
• Google Analyticator <= 6.4.9.5 - Cross-Site Scripting
• Able Player <= 1.0 - Authenticated (Contributor+) Stored Cross-Site Scripting
• Nextend Facebook Connect <= 3.1.19 - Authenticated (Contributor+) Stored Cross-Site Scripting
• WP Guppy < 1.3 - Information Disclosure
• SEO Rank Reporter <= 2.2.2 - Reflected Cross-Site Scripting
• Easy Social Share Buttons <= 9.4 - Authenticated (Subscriber+) Local File Inclusion
• Duplicate Page and Post <= 2.7 - Authenticated (Admin+) Stored Cross-Site Scripting
• EventON <= 2.2.2 - Reflected Cross-Site Scripting
• Mighty Classic Pros And Cons <= 2.0.9 - Authenticated (Contributor+) Stored Cross-Site Scripting
• ArtiBot Free Chat Bot for WebSites <= 1.1.7 - Reflected Cross-Site Scripting via PostMessage
• Gmedia Photo Gallery < 1.2.2 - Arbitrary File Upload
• User Registration Using Contact Form 7 <= 2.5 - Authenticated (Subscriber+) Information Exposure
• Charitable – Donation & Fundraising Platform (Donation Forms, Recurring Donations & Fundraising Campaigns) < 1.8.5.3 - Authenticated (Administrator+) Stored Cross-Site Scripting
• My Favorite Car <= 1.0 - Reflected Cross-Site Scripting
• IP Blacklist Cloud <= 5.00 - Authenticated (Administrator+) SQL Injection
• REST API TO MiniProgram <= 4.7.1 - Cross-Site Request Forgery
• Contact Form 7 <= 5.0.3 - Authorization Bypass
• Doctreat <= 1.6.7 - Authenticated (Subscriber+) Arbitrary Shortcode Execution
• miniOrange Social Login and Register (Discord, Google, Twitter, LinkedIn) < 7.8.0 - Unauthenticated Privilege Escalation via Account Takeover
• Easy Upload Files During Checkout <= 3.0.1 - Missing Authorization to Unauthenticated Arbitrary Attachment Deletion via 'eufdc-delete' Parameter
• Zip Recipes <= 8.0.7 - Cross-Site Request Forgery
• Export Users Data Distinct <= 1.3 - Authenticated (Subscriber+) CSV Injection
• Everest Forms (Pro) <= 1.9.4 - Unauthenticated Path Traversal to Arbitrary File Deletion
• Brizy – Page Builder <= 2.4.43 - Authenticated (Contributor+) Store Cross-Site Scripting via Widget Link To URL
• Magical Addons For Elementor <= 1.3.8 - Authenticated (Contributor+) Stored Cross-Site Scripting via Custom Attributes
• Mobile Navigation <= 1.5 - Authenticated (Administrator+) Stored Cross-Site Scripting
• CM E-Mail Blacklist <= 1.6.2 - Authenticated (Administrator+) Stored Cross-Site Scripting via 'black_email' Parameter
• vSlider Multi Image Slider <= 4.1.2 - Cross-Site Request Forgery
• Klarna Checkout for WooCommerce <= 2.0.9 - Arbitrary Plugin Installation, Activation and Deactivation
• Simple Link Directory < 14.8.1 - Reflected Cross-Site Scripting
• FileOrganizer <= 1.1.0 - Authenticated (Authenticated+) Local File Inclusion
• Valiance <= 1.2 - Unauthenticated PHP Object Injection
• miniOrange Social Login and Register (Discord, Google, Twitter, LinkedIn) Pro Addon <= 200.3.9 - Authentication Bypass
• Search Exclude <= 1.2.3 - Arbitrary Settings Change
• AI ChatBot with ChatGPT and Content Generator by AYS <= 2.7.4 - Missing Authorization
• Elementor Header & Footer Builder <= 1.6.28 - Authenticated (Contributor+) Stored Cross-Site Scripting
• Developer Formatter < 2013.0.1.41 - Cross-Site Request Forgery
• Bit Form – Contact Form, Payment Forms, Multi Step Forms, Calculator & Custom Form Builder < 3.1.4 - Authenticated (Administrator+) Stored Cross-Site Scripting
• Simple User Import Export <= 1.1.7 - Authenticated (Admin+) CSV Injection
• ElementsKit Elementor addons 3.0.7 - 3.1.2 - Authenticated (Contributor+) Stored Cross-Site Scripting via Image Accordion Widget
• Restrict Content <= 3.2.2 - Missing Authorization to Notice Dismissal
• Interactive US Map <= 2.7 - Cross-Site Request Forgery to Stored Cross-Site Scripting
• NewsPlugin <= 1.0.18 – Cross-Site Request Forgery to Stored Cross-Site Scripting
• Auto Thumbnailer <= 1.0 - Authenticated (Contributor+) Arbitrary File Upload
• Defender Security <= 4.4.1 - IP Address Spoofing
• Trinity Audio <= 5.20.2 - Cross-Site Request Forgery
• Administrator Z < 2026.05.10 - Cross-Site Request Forgery
• Photo Gallery <= 1.4.2 - Authenticated(Contributor+) PHP Object Injection via Shortcode
• Free Live Chat Support <= 1.0.11 - Cross-Site Request Forgery to Cross-Site Scripting
• SEO Plugin by Squirrly SEO <= 12.4.03 - Authenticated (Contributor+) SQL Injection
• Grou Random Image Widget <= 1.18 - Full Path Disclosure
• Dynamic Post <= 5.03 - Missing Authorization to Authenticated (Subscriber+) Settings Update
• Cost Calculator Builder <= 3.2.12 - Missing Authorization to Authenticated (Subscriber+) Arbitrary Content Creation
• Flow-Flow Social Feed Stream 3.0.0 - 4.7.5 - Missing Authorization to Authenticated (Subscriber+) Stored Cross-Site Scripting via flow_flow_social_auth AJAX action
• School Management <= 93.0.0 - Authenticated (Student+) Local File Inclusion
• s2Member® Framework (Membership, Member Level Roles, Access Capabilities, PayPal Members) < 111220 - Cross-Site Scripting
• Easy Form Builder <= 3.9.6 - Missing Authorization
• Croma Music <= 3.6 - Authenticated (Subscriber+) Arbitrary Options Update in ironMusic_ajax
• Docket Cache <= 24.07.02 - Unauthenticated Local File Inclusion
• WPcalc – Create any online calculators <= 2.1 - SQL Injection
• Audio Record <= 1.0 - Arbitrary File Upload
• WP Shortcodes Plugin — Shortcodes Ultimate <= 7.1.6 - Authenticated (Contributor+) Stored Cross-Site Scripting via su_lightbox Shortcode
• Team Master <= 1.1.2 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode Attributes
• MapSVG < 8.6.13 - Authenticated (Contributor+) Privilege Esclation
• Event Tickets and Registration <= 5.29.5 - Authenticated (Contributor+) SQL Injection
• ForumWP – Forum & Discussion Board <= 2.1.2 - Reflected Cross-Site Scripting
• EleForms – All In One Form Integration including DB for Elementor <= 2.9.9.7 - Missing Authorization to Sensitive Information Exposure
• CM Custom Reports <= 1.2.7 - Reflected Cross-Site Scripting via 'date_from' and 'date_to' Parameters
• EmailKit – Email Customizer for WooCommerce & WP <= 1.6.2 - Missing Authorization to Authenticated (Subscriber+) Arbitrary Post Title Modification
• Anonymize Links <= 1.1 - Cross-Site Request Forgery to Stored Cross-Site Scripting
• Awesome Support <= 6.1.1 - Insecure Direct Object Reference to (Subscriber+) Ticket Export
• XStore < 9.7.3 - Unauthenticated SQL Injection
• Royal Addons for Elementor – Addons and Templates Kit for Elementor < 1.7.1066 - Unauthenticated Like Count Manipulation
• Style Kits for Elementor <= 2.6.5 - Missing Authorization
• Podlove Podcast Publisher <= 4.5.6 - Unauthenticated Stored Cross-Site Scripting via Auphonic Webhook
• WooCommerce Designer Pro <= 1.9.26 - Unauthenticated Arbitrary File Upload