Vulnerability archive: section 4, page 11

Open a report to review affected versions, available fixes and original sources. Each report covers a specific issue; its presence does not establish whether your website is affected.

• SVT Simple <= 1.0.1 - Reflected Cross-Site Scripting
• PowerPress <= 6.0.4 - Reflected Cross-Site Scripting
• ACF Front End Editor <= 2.0.2 - Missing Authorization to Authenticated (Subscriber+) Arbitrary Content Update
• Accessibility Checker by Equalize Digital <= 1.31.0 - Missing Authorization
• WP Travel – Ultimate Travel Booking System, Tour Management Engine <= 12.0.3 - Missing Authorization
• Himer - Social Questions and Answers <= 2.1.0 - Authenticated (Subscriber+) Insecure Direct Object Reference
• Redirect Redirection <= 1.1.3 - Cross-Site Request Forgery via 'saveRedirectSettings' function
• Featured Image from URL (FIFU) <= 5.2.7 - Authenticated (Contributor+) Stored Cross-Site Scripting via Featured Image Custom Fields
• Cost Calculator Builder <= 3.2.65 - Unauthenticated SQL Injection
• Quran Translations <= 1.7 - Cross-Site Request Forgery to Playlist Settings Form
• Listdom: AI-powered Business Directory with Classifieds Ads Listings <= 6.1.2 - Authenticated (Administrator+) Path Traversal to Arbitrary File Deletion via 'ix[file]' Parameter
• GutenKit <= 2.4.2 - Authenticated (Contributor+) Stored Cross-Site Scripting
• WP DS Blog Map <= 3.1.3 - Authenticated (Admin+) Stored Cross-Site Scripting
• Link Whisper Free <= 0.6.9
• Vertex Addons for Elementor <= 1.6.4 - Missing Authorization
• Download buttons for Youtube videos <= 1.03 - Reflected Cross-Site Scripting
• User Control <= 2.1.0 - SQL Injection
• Supra CSV <= 4.0.3 - Stored Cross-Site Scripting via Cross-Site Request Forgery
• Pixel Manager for WooCommerce (PRO) <= 1.49.0 - Authenticated (Contributor+) Cross-Site Scripting via Shortcode
• Welcart e-Commerce <= 2.2.3 - Reflected Cross-Site Scripting
• LTL Freight Quotes – Worldwide Express Edition <= 5.0.20 - Unauthenticated SQL Injection
• WordPress Multisite User Sync/Unsync (Premium) <= 2.1.1 Reflected Cross-Site Scripting
• Squeeze <= 1.7.11 - Authenticated (Author+) Arbitrary File Upload
• HTML5 Responsive FAQ <= 2.8.5 - Authenticated Stored Cross-Site Scripting
• Migration, Backup, Staging – WPvivid <= 0.9.35 - Authenticated (Subscriber+) Arbitrary File Upload
• Freemind Viewer <= 1.0 - Authenticated (Contributor+) Stored Cross-Site Scripting
• Name Directory <= 1.27.1 - Cross Site Request Forgery
• WishList Member X < 3.26.7 - Unauthenticated Information Exposure
• Additional Order Filters for WooCommerce <= 1.21 - Reflected Cross-Site Scripting
• Web Accessibility By accessiBe <= 1.15 - Authenticated (Administrator+) Stored Cross-Site Scripting
• Spacer <= 3.0.6 - Authenticated (Administrator+) Stored Cross-Site Scripting
• Integration of Moneybird for WooCommerce <= 2.1.2 - Reflected Cross-Site Scripting
• jAlbum Bridge <= 2.0.17 - Authenticated (Contributor+) Stored Cross-Site Scripting
• Smart Post – Post Grid, Post Carousel, Post Slider Gutenberg Blocks for Blog & News 4.0.0 - 4.0.7 - Unauthenticated Password-Protected Post Content Disclosure
• Modal Dialog <= 3.5.16 - Authenticated (Admin+) Remote Code Execution
• Blockspare <= 3.2.13.2 - Authenticated (Contributor+) Sensitive Information Exposure
• Comments Ratings <= 1.1.7 - Cross-Site Request Forgery
• Stripe Payment Plugin for WooCommerce <= 3.7.9 - Unauthenticated SQL Injection
• Divi <= 4.27.6 - Authenticated (Contributor+) DOM-Based Stored Cross-Site Scripting via Video Slider 'image_src' Shortcode Parameter
• Contest Gallery <= 21.1.2 - Reflected Cross-Site Scripting
• Tourfic <= 2.11.15 - Authenticated (Subscriber+) Arbitrary File Upload
• Custom Login and Registration <= 1.0.0 - Missing Authorization
• Revo <= 4.0.26 - Unauthenticated Local File Inclusion
• 1 Click WordPress Migration Plugin – 100% FREE for a limited time <= 2.2 - Cross-Site Request Forgery to Backup Process Cancellation
• WPide <= 2.6 - Authenticated (Administrator+) Arbitrary File Upload
• Quick Page/Post Redirect Plugin <= 5.1.9 - Redirect Security Bypass
• The Plus Addons for Elementor PRO <= 4.1.9 & The Plus Addons for Elementor <= 2.0.6 - Authenticated (Contributor+) Arbitrary File Read
• Five Star Restaurant Reservations – WordPress Booking Plugin <= 2.7.19 - Missing Authorization
• Blog Filter <= 1.5.3 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode
• Newsletters <= 4.8.8 - Cross-Site Request Forgery
• Aalto - Architecture and Interior Design WordPress Theme <= 1.8 - Unauthenticated Local File Inclusion
• LiteSpeed Cache <= 7.9 - Reflected Cross-Site Scripting via ESI 'esi' Parameter
• Ebook Store <= 5.8008 - Authenticated (Administrator+) Stored Cross-Site Scripting
• Noo JobMonster <= 4.6.6 - Sensitive Information Disclosure via Directory Listing
• IMPress for IDX Broker <= 3.2.2 - Authenticated (Contributor+) Stored Cross-Site Scripting
• Photo Gallery by 10Web <= 1.2.10 - Authenticated Cross-Site Scripting
• Buddyboss Platform <= 1.7.8 - SQL Injection
• Craftis - Handcraft & Artisan Elementor Template Kit <= 1.2.8 - Unauthenticated Local File Inclusion
• Easy Digital Downloads – PDF Invoices < 1.0.4 - Cross-Site Scripting
• Email Subscribers & Newsletters <= 5.3.1 - Authenticated (or Cross-Site Request Forgery) Blind SQL Injection
• Travelers' Map <= 2.3.2 - Authenticated (Contributor+) Stored Cross-Site Scripting
• WP Subtitle <= 3.4 - Cross-Site Scripting
• Super Testimonials <= 2.9 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode
• Admin Menu Plugin <= 1.1 - Reflected Cross-Site Scripting
• Amilia Store <= 2.9.8 - Authenticated (Contributor+) Stored Cross-Site Scripting
• Fluent Forms <= 6.1.7 - Missing Authorization to Authenticated (Subscriber+) Arbitrary Form Creation via AI Builder
• uListing plugin <= 2.0.5 - Authenticated Insecure Direct Object References (IDOR)
• Page Builder by SiteOrigin <= 2.31.0 - Authenticated (Contributor+) Stored Cross-Site Scripting via Row Label Parameter
• Blog Designer <=1.8.10 - Unauthenticated Stored Cross-Site Scripting
• LeadBI Plugin for WordPress <= 1.7 - Authenticated (Subscriber+) Stored Cross-Site Scripting
• Brave <= 0.8.3 - Missing Authorization
• Smart WooCommerce Search <= 2.5.0 - Missing Authorization
• onOffice for WP-Websites <= 6.5 - Authenticated (Administrator+) SQL Injection
• Brands for WooCommerce <= 3.8.2.2 - Cross-Site Request Forgery
• Infility Global <= 2.13.4 - Reflected Cross-Site Scripting
• Popup by Supsystic <= 1.10.18 - Prototype Pollution
• Eventin – Events Calendar, Tickets, Registration, Booking & WooCommerce <= 4.1.25 - Missing Authorization
• BlockSpare - Gutenberg Site Builder Blocks & Starter Sites <= 4.2.6 - Incorrect Authorization to Authenticated (Subscriber+) Arbitrary Post Creation
• Portfolio Gallery – Image Gallery Plugin <= 1.6.4 - Authenticated (Contributor+) DOM-Based Stored Cross-Site Scripting
• Business Card Block <= 1.0.5 - Authenticated (Contributor+) Stored Cross-Site Scripting
• WP AVCL Automation Helper (formerly WPFlyLeads) <= 3.4 - Authenticated (Subscriber+) Server-Side Request Forgery
• Otter Blocks PRO <= 2.6.3 - Unauthenticated Stored Cross-Site Scripting via SVG Upload
• Redirection for Contact Form 7 <= 2.3.3 - Authenticated Arbitrary Post Deletion
• FancyPost – Best Ultimate Post Block, Post Grid, Layouts, Carousel, Slider For Gutenberg & Elementor <= 6.0.0 - Missing Authorization to Authenticated (Subscriber+) Shortcode Export
• Event Easy Calendar <= 1.0.0 - Multiple Cross-Site Request Forgery
• Feather Login Page 1.0.7 - 1.1.1 - Missing Authorization to Authentication Bypass and Privilege Escalation
• Social Rocket – Social Sharing Plugin <= 1.3.4.2 - Authenticated (Subscriber+) Stored Cross-Site Scripting via id
• Decorator - WooCommerce Email Customizer <= 1.2.7 - Cross-Site Request Forgery
• MasterStudy LMS <= 3.7.49 - Authenticated (Subscriber+) HTML Injection
• CM Answers <= 3.1.9 - Authenticated (Administrator+) Stored Cross-Site Scripting
• Post Views Counter <= 1.4.4 - Cross-Site Request Forgery via save_bulk_post_views()
• ARMember <= 4.0.10 - Authenticated (Subscriber+) Membership Plan Bypass
• Unlimited Elements for Elementor <= 2.0.22 - Missing Authorization
• Flashlight <= 2.8.4 - Cross-Site Scripting
• Innovs HR <= 1.0.3.6 - Reflected Cross-Site Scripting
• Subscribe <= 1.2.16 - Missing Authorization
• ERI File Library <= 1.1.0 - Missing Authorization to Unauthenticated Protected File Download
• Google Fonts For WordPress <= 3.0.0 - Reflected Cross-Site Scripting
• Chat2 <= 4.0 - Cross-Site Request Forgery to Stored Cross-Site Scripting
• Book appointment online <= 1.38 - Cross-Site Scripting