Vulnerability archive: section 4, page 12

Open a report to review affected versions, available fixes and original sources. Each report covers a specific issue; its presence does not establish whether your website is affected.

• Authorizer <= 3.15.1 - Unauthenticated Privilege Escalation
• Wabi-Sabi <= 1.2 - Unauthenticated Local File Inclusion
• WPPizza – A Restaurant Plugin <= 3.18.13 - Reflected Cross-Site Scripting
• Share This Image <= 1.98 - Open Redirect
• Classified Listing – AI-Powered Classified ads & Business Directory Plugin <= 5.2.0 - Missing Authorization to Authenticated (Subscriber+) Listing Types Tampering
• Recover abandoned cart for WooCommerce <= 2.5 - Unauthenticated SQL Injection
• coreActivity <= 1.8 - Unauthenticated Stored Cross-Site Scripting
• Custom Contact Forms Plugin <= 5.1.0.2 - Reflected Cross-Site Scripting
• Blogroll Fun – Show Last Post and Last Update Time < 0.8.5 - Reflected Cross-Site Scripting
• Rank Math SEO – AI SEO Tools to Dominate SEO Rankings < 1.0.277 - Authenticated (Author+) Information Exposure
• WordPress Core < 6.0.2 - Authenticated (Contributor+) Stored Cross-Site Scripting via use of the_meta(); function
• Nokri <= 1.6.4 - Cross-Site Request Forgery
• Travel Booking <= 1.3.9 - Missing Authorization
• Spider Elements – Addons for Elementor <= 1.6.3 - Missing Authorization
• Shipping via Planzer for WooCommerce <= 1.0.25 - Reflected Cross-Site Scripting via processed-ids
• PHP Everywhere <= 2.0.3 - Authenticated (Contributor+) Remote Code Execution via Metabox
• Bluff Post <= 1.1.1 - Unauthenticated SQL Injection
• Customer Service Software & Support Ticket System < 5.10.4 - Authenticated (Admin+) Stored Cross-Site Scripting
• RegistrationMagic <= 5.1.9.2 - Improper Authorization to Price Change
• Hiroshi <= 1.5.1 - Unauthenticated PHP Object Injection
• Fribbo <= 1.1.0 - Unauthenticated Local File Inclusion
• Multiple Plugins by KlbTheme <= (Various Versions) - Reflected Cross-Site Scripting
• wpMandrill <= 1.33 - Missing Authorization via getAjaxStats
• Ultimate Addons for Elementor <= 1.45.2 - Authenticated (Contributor+) Stored Cross-Site Scripting
• User Activity Log Pro <= 2.3.3 - Unauthenticated Stored Cross-Site Scripting via User-Agent header
• Flexible Captcha <= 4.1 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode
• Lock User Account <= 1.0.3 - Cross-Site Request Forgery to Account Lock/Unlock
• YITH WooCommerce Ajax Search <= 2.8.0 - Unauthenticated SQL Injection
• SEO Booster <= 7.4.7 - Authenticated (Subscriber+) Missing Authorization to Arbitrary Options Modification via handle_oauth_callback()
• Travelfic Toolkit <= 1.3.3 - Missing Authorization
• Pont <= 1.5 - Arbitrary Options Update
• Formidable Forms <= 6.1.2 - Unauthenticated PHP Object Injection
• Ni WooCommerce Sales Report <= 4.1.0 - Unauthenticated SQL Injection
• WP Stacker <= 1.8.5 - Cross-Site Request Forgery to Stored Cross-Site Scripting
• WordPress Core < 5.0.1 - PHAR Unserialization
• Master Slider – Responsive Touch Slider <= 3.10.7 - Authenticated (Contributor+) Stored Cross-Site Scripting via ms_slider Shortcode
• Portfolio Manager Pro 3.8 - Unauthenticated Arbitrary File Upload
• WP Popup Banners <= 1.2.5 - Authenticated (Subscriber+) SQL Injection via 'value'
• Livemesh Addons for Elementor <= 8.3 - Authenticated (Contributor+) Stored Cross-Site Scripting via animated_text_class
• ClearSale Total <= 3.4.2 - Unauthenticated SQL Injection
• LearnPress – WordPress LMS Plugin for Create and Sell Online Courses <= 4.4.9.1 - Authenticated (Instructor+) Stored Cross-Site Scripting
• ePayco plugin for WooCommerce <= 8.4.6 - Unauthenticated SQL Injection
• myCred – Points Management System For Gamification, Ranks, Badges, and Loyalty Rewards Program. <= 2.9.7.6 - Authenticated (Contributor+) Stored Cross-Site Scripting
• Easy PopUp Show <= 0.12 - Cross-Site Request Forgery
• JoomSport <= 5.6.17 - Reflected Cross-Site Scripting via page
• Random Featured Post <= 1.1.3 - Cross-Site Request Forgery to Stored Cross-Site Scripting
• Parallelus Unite, Interscet, Traject, & Salutation < 2.0 - Reflected Cross-Site Scripting
• LatePoint <= 5.1.94 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode
• click5 CRM add-on to Gravity Forms <= 1.0.3 - Unauthenticated Stored Cross-Site Scripting
• MyAnime Widget <= 1.0 - Cross-Site Request Forgery to Privilege Escalation
• Borgholm < 1.6 - Unauthenticated PHP Object Injection
• WordPress Core <= 7.1 - Authenticated (Author+) Missing Authorization to Comment/Note Reparenting via REST API
• Mail Mint – Email Marketing, Newsletter, Email Automation & WooCommerce Emails <= 1.19.5 - Authenticated (Subscriber+) Information Exposure
• Slash WP (All Versions) - Multiple Vulnerabilities
• Telegram Widget and Join Link <= 2.2.12 - Missing Authorization
• Easy Affiliate Links <= 3.7.2 - Authenticated (Contributor+) Stored Cross-Site Scripting
• Hide Admin Bar From Front End <= 1.0.0 - Cross-Site Request Forgery
• HT Slider for Elementor <= 1.7.4 - Authenticated (Contributor+) Stored Cross-Site Scripting
• ClickSold IDX < 1.49 - Reflected Cross-Site Scripting
• SEO Booster <= 3.7 - Admin+ SQL Injection
• WP Editor < 1.2.6 - Cross-Site Request Forgery
• Paid Memberships Pro <= 2.5.5 - Authenticated SQL Injection
• Gallery – Image and Video Gallery with Thumbnails <= 2.0.3 - Authenticated (Contributor+) SQL Injection
• MCP Content Manager Lite <= 1.1.0 - Missing Authorization
• SendPulse Email Marketing Newsletter <= 2.2.1 - Authenticated (Subscriber+) Information Exposure
• EazyDocs <= 2.5.0 - Missing Authorization
• Responsive Lightbox2 <= 1.0.3 - Authenticated (Contributor+) Stored Cross-Site Scripting
• Category Dropdown List <= 1.0 - Reflected Cross-Site Scripting via $_SERVER['PHP_SELF']
• Review Slider Pro <= 12.7.11 - Authenticated (Subscriber+) Stored Cross-Site Scripting
• Portable phpMyAdmin <= 1.5.0 - Authentication Bypass
• Post Grid, Slider & Carousel Ultimate – with Shortcode, Gutenberg Block & Elementor Widget <= 1.6.10 - Authenticated (Contributor+) Local File Inclusion via post_type_ajax_handler()
• HL Twitter <= 2014.1.18 - Cross-Site Request Forgery to Settings Update
• Perfmatters <= 2.6.3 - Reflected Cross-Site Scripting
• ECT Social Share <= 1.3 - Cross-Site Request Forgery to Stored Cross-Site Scripting
• StoryMap <= 2.1 - Authenticated (Contributor+) Stored Cross-Site Scripting
• Zero Spam for WordPress <= 5.7.11 - Unauthenticated Spam Protection Bypass on Login
• Opor Ayam <= 1.8 - Reflected Cross-Site Scripting
• RepairBuddy <= 4.1132 - Missing Authorization to Authenticated (Subscriber+) Plugin Settings Modification via wc_rep_shop_settings_submission AJAX Action
• Sunshine Photo Cart <= 3.5.3 - Missing Authorization
• WS Form LITE and WS Form Pro < 1.8.176 - Stored Cross-Site Scripting
• Kiamo - Responsive Business Service WordPress Theme < 1.3.6 - Unauthenticated Local File Inclusion
• Hubbub Lite <= 1.31.1 - Authenticated (Admin+) Stored Cross-Site Scripting
• PDF Creator Lite <= 1.2 - Cross-Site Request Forgery
• Counter Box – WordPress plugin for countdown, timer, counter <= 1.2.3 - Cross-Site Request Forgery
• PDF & Print Button Joliprint <= 1.3.0 - Cross-Site Scripting
• WP Custom Admin Interface <= 7.32 - Cross-Site Request Forgery to Transients Deletion
• Jet Skinner for BuddyPress <= 1.2.5 - Reflected Cross-Site Scripting
• Google Authenticator <= 0.55 - Cross-Site Request Forgery
• YITH WooCommerce Compare <= 2.0.9 - Unauthenticated PHP Object Injection
• Hello Bar Popup Builder <= 1.5.1 - Authenticated (Contributor+) Stored Cross-Site Scripting
• Simple 301 Redirects 2.0.0 - 2.0.3 - Authenticated Arbitrary Plugin Activation
• Mega Addons For WPBakery Page Builder <= 4.2.7 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode
• Enable SVG, WebP, and ICO Upload <= 1.1.2 - Authenticated (Author+) Stored Cross-Site Scripting via SVG File Uploads
• Mediamatic – Media Library Folders <= 2.8.0 - SQL Injection
• Quiz And Survey Master <= 10.2.5 - Unauthenticated PHP Object Injection
• WP Helper Premium <= 4.6.1 - Missing Authorization in whp_smtp_send_mail_test
• Smart Maintenance Mode <= 1.5.1 - Authenticated (Admin+) Stored Cross-Site Scripting
• Directories Pro <= 2.0.5 - Authenticated (Subscriber+) Privilege Escalation
• WebinarIgnition <= 3.05.8 - Cross-Site Request Forgery
• Bstone Demo Importer <= 1.0.1 - Missing Authorization to Authenticated (Subscriber+) Privilege Escalation