Vulnerability archive: section 4, page 18

Open a report to review affected versions, available fixes and original sources. Each report covers a specific issue; its presence does not establish whether your website is affected.

• Salesmate Add-On for Gravity Forms <= 2.0.3 - Missing Authorization
• Simple-Audioplayer <= 1.1 - Authenticated (Contributor+) Stored Cross-Site Scripting
• Hero Mega Menu - Responsive WordPress Menu Plugin <= 1.16.5 - Reflected Cross-Site Scripting
• Ally - Web Accessibility & Usability <= 3.8.0 - Cross-Site Request Forgery to Plugin Settings Update
• WPGraphQL <= 2.24.0 - Unauthenticated Information Exposure
• Metform Elementor Contact Form Builder <= 3.3.1 - Authenticated (Subscriber+) Information Disclosure via mf_last_name shortcode
• Canto <= 3.0.6 - Remote File Inclusion to Code Execution
• InBoundio Marketing < 2.0.1 - Arbitrary File Upload
• Search Autocomplete < 1.0.9 - SQL Injection
• BUKAZU Search widget <= 3.3.2 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'shortcode' Shortcode Attribute
• FancyBox <= 1.0.1 - Reflected Cross-Site Scripting
• Translate WordPress with GTranslate < 3.0.10 - Authenticated (Administrator+) Stored Cross-Site Scripting
• Ultimate Member <= 2.11.0 - Authenticated (Subscriber+) Profile Privacy Setting Bypass
• Announcement & Notification Banner – Bulletin <= 3.6.0 - Missing Authorization Checks
• WP Crontrol <= 1.16.1 - Remote Code Execution
• MyTicket Events <= 1.2.4 - Unauthenticated Limited File Read
• Injection Guard <= 1.2.1 - Missing Authorization via ig_update
• Slider Revolution <= 6.7.10 - Authenticated (Author+) Stored Cross-Site Scripting
• WordPress Core < 3.3.2 - Authorization Bypass
• Multiple XforWooCommerce Add-On Plugins (Various Versions) - Missing Authorization
• Links shortcode <= 1.8.3 - Authenticated (Contributor+) Stored Cross-Site Scripting
• Download Manager <= 2.8.7 - Missing Authorization
• HT Easy GA4 ( Google Analytics 4 ) <= 1.1.7 - Reflected Cross-Site Scripting
• Bus Ticket Booking with Seat Reservation <= 5.3.5 - Authenticated (Administrator+) Stored Cross-Site Scripting
• SKT Blocks <= 1.6 - Authenticated (Contributor+) Stored Cross-Site Scripting
• XStore Core < 5.6 - Authenticated (Contributor+) Stored Cross-Site Scripting
• Related Posts for WordPress <= 2.0.3 - Reflected Cross-Site Scripting
• BackWPup – WordPress Backup Plugin < 1.4.1 - Directory Traversal
• Abandoned Cart Lite for WooCommerce <= 6.8.0 - Cross-Site Request Forgery
• Royal Elementor Addons <= 1.3.980 - Authenticated (Author+) External Entity Injection
• GenerateBlocks <= 2.2.0 - Insecure Direct Object Reference to Authenticated (Contributor+) Sensitive Information Exposure via Dynamic Tag Replacements
• Handyman <= 1.4 - Unauthenticated PHP Object Injection
• PhastPress <= 1.110 - Open Redirect
• WPCRM - CRM for Contact form CF7 & WooCommerce <= 3.2.0 - Reflected Cross-Site Scripting
• Simple Social Media Share Buttons – Social Sharing for Everyone <= 6.2.0 - Cross-Site Request Forgery
• Easy Social Feed <= 6.5.3 - Authenticated (Contributor+) Stored Cross-Site Scripting via fb_appid
• Block Country <= 1.0 - Cross-Site Request Forgery
• Premium Age Verification / Restriction for WordPress <= 3.0.2 - Unauthenticated Arbitrary File Download
• Geo Mashup <= 1.13.21 - Authenticated (Contributor+) Stored Cross-Site Scripting
• Opal Estate Pro <= 1.7.5 - Unauthenticated Privilege Escalation via 'on_regiser_user'
• Donation Thermometer < 2.3.0 - Authenticated (Contributor+) Stored Cross-Site Scripting
• WordPress Galleria <= 1.4 - Reflected Cross-Site Scripting
• Arigato Autoresponder and Newsletter <= 2.7.1 - Authenticated (Contributor+) Stored Cross-Site Scripting
• LTL Freight Quotes – SAIA Edition <= 2.2.10 - Unauthenticated SQL Injection
• MStore API <= 3.9.2 - Authentication Bypass
• User Toolkit <= 1.2.3 - Authenticated (Subscriber+) Authentication Bypass
• Schema & Structured Data for WP & AMP <= 1.66 - Authenticated (Editor+) Stored Cross-Site Scripting
• jQuery Hover Footnotes <= 1.4 - Authenticated (Author+) Stored Cross-Site Scripting via Footnote Qualifier ('{{...}}' Syntax)
• WordPress Download Manager < 3.1.19 - Arbitrary File Upload
• WP Editor.md – The Perfect WordPress Markdown Editor < 10.0.4 - Cross-Site Scripting
• Amazon Native Shopping Recommendations <= 1.3 - Unauthenticated SQL Injection
• Sendinblue for WooCommerce <= 4.0.49 - Missing Authorization
• OpenAI Chatbot for WordPress – Helper <= 1.1.4 - Missing Authorization to Unauthenticated Arbitrary Content Deletion
• Simple Tableau Viz <= 2.0 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode
• WP Activity Log <= 5.6.4 - Cross-Site Request Forgery
• Buzzsprout Podcasting <= 1.8.4 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode
• Quick Paypal Payments <= 5.7.25 - Missing Authorization
• Content Syndication Toolkit Reader <= 1.5 - Reflected Cross-Site Scripting
• GD Rating System <= 3.6 - Authenticated (Contributor+) Local File Inclusion
• Element Pack Elementor Addons (Header Footer, Free Template Library, Grid, Carousel, Table, Parallax Animation, Register Form, Twitter Grid) <= 5.6.0 - Authenticated (Contributor+) Stored Cross-Site Scripting via Panel Slider Widget
• Vitepos – Point of Sale (POS) for WooCommerce <= 3.5.0 - Authenticated (Custom Role+) Privilege Escalation
• Sticky Chat Widget <= 1.4.2 - Unauthenticated SQL Injection
• Zoho Marketing Automation <= 1.2.7 - Authenticated (Contributor+) SQL Injection
• rognone <= 0.6.2 - Reflected Cross-Site Scripting via 'mode' Parameter
• wpsection <= 1.5.1 - Missing Authorization
• WooCommerce Tranzila Gateway <= 1.0.8 - Unauthenticated PHP Object Injection
• Studiocart <= 2.9.0 - Reflected Cross-Site Scripting
• BMI Adult & Kid Calculator <= 1.2.2 - Reflected Cross-Site Scripting
• Booked <= 2.2.5 - Missing Authorization on AJAX Actions
• RedLine < 1.66 - Reflected Cross-Site Scripting
• Page and Post Clone <= 6.0 - Insecure Direct Object Reference to Authenticated (Author+) Sensitive Information Exposure
• TableOn <= 1.0.5.1 - Unauthenticated Arbitrary Shortcode Execution
• Tube Video Ads Lite <= 1.5.7 - Reflected Cross-Site Scripting
• PilotPress <= 2.0.39 - Missing Authorization
• WCP Contact Form <= 3.1.0 - Missing Authorization via downloadCsv
• Statify – Extended Evaluation <= 2.6.3 - Authenticated (Admin+) CSV Injection
• Ultimate WP Mail 1.0.17 - 1.3.6 - Missing Authorization to Authenticated (Contributor+) Privilege Escalation via get_email_log_details Function
• WPFunnels <= 3.6.2 - Unauthorized User Registration
• Shortcodes Ultimate Pro <= 7.1.4 - Authenticated (Contributor+) Stored Cross-Site Scripting
• Active Directory Integration / LDAP Integration <= 4.1.0 - Unauthenticated Information Disclosure
• Element Pack - Addon for Elementor Page Builder WordPress Plugin <= 7.9.0 - Authenticated(Contributor+) Stored Cross-Site Scripting via Wrapper Link URL
• Traveler <= 3.1.9 - Authenticated (Contributor+) Local File Inclusion via Shortcode
• Ocean Extra <= 2.0.4 - Authenticated (Administrator+) PHP Object Injection
• Shortcodes and extra features for Phlox theme <= 2.15.7 - Authenticated (Contributor+) Stored Cross-Site Scripting
• Tabby Checkout <= 5.8.4 - Unauthenticated Information Exposure
• All-in-One WP Migration <= 7.14 - Unauthenticated Backup Download
• Add Multiple Marker <= 1.2 - Cross-Site Request Forgery
• Gallery Plugin for WordPress – Envira Photo Gallery <= 1.8.14 - Authenticated (Author+) Stored Cross-Site Scripting
• Customer Email Verification for WooCommerce <= 2.7.4 - Email Verification and Authentication Bypass due to Insufficient Randomness
• Giveaways and Contests by PromoSimple <= 1.24 - Authenticated (Contributor+) Stored Cross-Site Scripting
• Drag and Drop Multiple File Upload – Contact Form 7 <= 1.3.9.2 - Unauthenticated Limited Arbitrary File Upload
• Viral Loops WP Integration <= 3.8.1 - Missing Authorization
• WooCommerce <= 4.2.0 - Reflected Cross-Site Scripting
• Slider Pro <= 4.8.6 - Missing Authorization via AJAX actions
• Accessibility by AudioEye <= 1.0.49 - Missing Authorization
• Forminator Forms – Contact Form, Payment Form & Custom Form Builder <= 1.50.2 - Authenticated (Administrator+) Stored Cross-Site Scripting
• WP-Iconics <= 0.0.4 - Authenticated (Contributor+) Stored Cross-Site Scripting
• AFFI – Affiliate Marketing for WooCommerce <= 1.0.10 - Unauthenticated PHP Object Injection
• SMS Alert Order Notifications <= 3.9.7 - Unauthenticated Privilege Escalation
• Ditty <= 3.1.65 - Missing Authorization to Unauthenticated Sensitive Information Disclosure via ditty_init AJAX Action