Vulnerability archive: section 4, page 8

Open a report to review affected versions, available fixes and original sources. Each report covers a specific issue; its presence does not establish whether your website is affected.

• WP Show Stats <= 1.5 - Cross-Site Request Forgery
• Simple File List <= 6.3.7 - Missing Authorization
• Fancy Product Designer <= 6.4.3 - Unauthenticated SQL Injection
• Donate visa <= 1.0.0 - Missing Authorization
• Delete Custom Fields <= 0.3.1 - Cross-Site Request Forgery to Post Meta Deletion
• Classy Addons for Elementor <= 1.2.7 - Authenticated (Contributor+) Stored Cross-Site Scripting
• EmbedPress – PDF Embedder, 3D PDF FlipBook, Google Reviews, YouTube Videos, Upload & Embed PDF documents 4.6.0 - 4.6.3 - Missing Authorization to Authenticated (Contributor+) Site-Wide Places Library Modification
• Blrt WP Embed <= 1.6.9 - Authenticated (Contributor+) SQL Injection
• WordPress File Upload <= 4.25.2 - Cross-Site Request Forgery in wfu_file_details
• YITH WooCommerce Product Add-Ons <= 4.2.0 - Missing Authorization
• dsIDXpress < 2.1.1 - Cross-Site Scripting
• Image Uploader for Welcart <= 1.4.6 - Authenticated (Author+) SQL Injection via Attachment 'post_title' Parameter
• Simple Image Popup <= 1.3.6 - Authenticated (Admin+) Stored Cross-Site Scripting
• Easy Quotes <= 1.2.4 - Missing Authorization
• Contest Gallery < 21.2.8.1 - Unauthenticated Stored Cross-Site Scripting via headers
• 3D Avatar User Profile <= 1.0.0 - Reflected Cross-Site Scripting
• Simple Excel Pricelist for WooCommerce <= 1.13 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode
• King Addons for Elementor <= 51.1.62 - Authenticated (Subscriber+) Stored Cross-Site Scripting via 'form_page_id' Parameter
• ARMember – Membership Plugin, Content Restriction, Member Levels, User Profile & User signup <= 4.0.28 - Missing Authorization
• IDonate 2.1.5 - 2.1.9 - Missing Authorization to Authenticated (Subscriber+) Account Takeover/Privilege Escalation via idonate_donor_profile Function
• Infility Global <= 2.15.36 - Unauthenticated SQL Injection
• Advanced Element Bucket Addons for Elementor <= 1.0.2 - Authenticated (Contributor+) Stored Cross-Site Scripting
• Sandwich Adsense <= 4.0.2 - Missing Authorization
• Quiz And Survey Master <= 7.3.10 - Unauthenticated Stored Cross-Site Scripting
• WCFM Marketplace <= 3.7.3 - Missing Authorization
• Copperleaf Photolog <= 0.16- SQL injection
• Product XML Feed Manager for WooCommerce <= 2.9.2 - Missing Authorization
• GreenCon <= 1.0.1 - Authenticated (Contributor+) Stored Cross-Site Scripting
• Database Backup for WordPress <= 2.5.2 - Missing Authorization to Unauthenticated Database Export
• File Provider <= 1.2.3 - Cross-Site Request Forgery to Item Deletion
• 畅言评论系统 <= 2.0.5 - Missing Authorization
• NewStatPress <= 1.3.5 - Reflected Cross-Site Scripting
• Quotes Collection < 2.0.6 - Cross-Site Scripting
• WordPress Core < 3.4.2 - Missing Authorization Checks
• Coming Soon & Maintenance Mode Page <= 1.57 - Cross-Site Request Forgery
• SureForms Pro <= 2.8.0 - Missing Authorization
• WP Maintenance <= 6.0.5 - Authenticated (Admin+) Stored Cross-Site Scripting
• Activity Log – Monitor & Record User Changes <= 2.11.1 - Unauthenticated Stored Cross-Site Scripting via Event Context
• FooGallery <= 2.2.35 - Reflected Cross-Site Scripting
• Ubigeo de Perú para Woocommerce y WordPress <= 3.6.3 - Unauthenticated SQL Injection
• Checkout Files Upload for WooCommerce <= 2.2.0 - Authenticated (Contributor+) Stored Cross-Site Scripting
• Booking Calendar Contact Form <= 1.0.23 - Reflected Cross-Site Scripting
• Youzify – BuddyPress Community, User Profile, Social Network & Membership Plugin for WordPress <= 1.3.7 - Unauthenticated PHP Object Injection
• YITH Maintenance Mode <= 1.3.8 - Multiple Authenticated Stored Cross-Site Scripting
• Social Media Share Buttons & Social Sharing Icons <= 1.2.1 - Unspecified Vulnerabilities
• CP Contact Form with Paypal <= 1.3.34 - Authenticated Feedback Submission
• VibeBP <= 1.9.9.4.1 - Unauthenticated Privilege Escalation
• Sky Addons for Elementor (Free Templates Library, Live Copy, Animations, Post Grid, Post Carousel, Particles, Sliders, Chart, Blogs) <= 2.6.1 - Cross-Site Request Forgery to Limited Arbitrary Options Update
• Smooth Scroll Page Up/Down Buttons <= 1.3 - Admin+ Stored Cross-Site Scripting
• article2pdf <= 0.27 - Denial of Service
• Widgets for Tiktok Feed <= 1.7.3 - Authenticated (Contributor+) Stored Cross-Site Scripting
• Hospital Management System <= 47.0(20-11-2023) - Reflected Cross-Site Scripting
• Woopy - Multipurpose Store WooCommerce WordPress Shop Theme <= 1.2 - Unauthenticated Local File Inclusion
• Sticky Buttons <= 3.2.2 - Authenticated (Admin+) Stored Cross-Site Scripting
• Image Photo Gallery Final Tiles Grid <= 3.6.11 - Authenticated (Author+) Insecure Direct Object Reference
• Captcha < 4.3.0 - Reflected Cross-Site Scripting
• Fancy Product Designer <= 4.6.8 - Unauthenticated Arbitrary File Upload
• Web3 – Crypto wallet Login & NFT token gating <= 2.6.0 - Authentication Bypass
• SpiderCalendar <= 1.4.9 - Unauthenticated SQL Injection
• Starter Templates by Kadence WP <= 1.2.16 - Authenticated (Admin+) PHP Object Injection
• Themify Builder <= 7.8.0 - Missing Authorization to Unauthenticated Arbitrary Builder Data Modification via 'tb_update_old_data' AJAX Action
• Japanized For WooCommerce <= 2.5.6 - Reflected Cross-Site Scripting
• Simple Blog Stats <= 20250416 - Authenticated (Contributor+) Stored Cross-Site Scripting
• Network Summary <= 2.0.11 - Unauthenticated SQL Injection
• Insert HTML Here <= 1.0 - Reflected Cross-Site Scripting
• Online Scheduling and Appointment Booking System <= 28.2 - Authenticated (Custom+) PHP Object Injection via 'value' Parameter
• Build Private Store For Woocommerce <= 1.0 - Cross-Site Request Forgery
• Flattr <= 1.2.2 - Authenticated (Admin+) Stored Cross-Site Scripting
• Post Duplicator <= 3.0.8 - Missing Authorization to Authenticated (Contributor+) Protected Post Meta Insertion via 'customMetaData' Parameter
• WP-Members < 3.1.8 - Cross-Site Scripting
• LucidLMS <= 1.0.5 - Reflected Cross-Site Scripting
• Invetex <= 2.18 - Unauthenticated Local File Inclusion
• Eventer <= 3.9.9.4 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode
• Transition Slider – Responsive Image Slider and Gallery <= 2.20.3 - Authenticated (Editor+) Stored Cross-Site Scripting
• Construction Landing Page <= 1.4.1 - Missing Authorization
• Watu Quiz <= 3.4.1 - Sensitive Information Disclosure
• Mautic Integration for WooCommerce < 1.0.3 - Cross-Site Request Forgery leading to Arbitrary Options Update
• PDF Light Viewer <= 1.4.11 - Authenticated Command Injection
• WordPress Core < 4.5.3 - Bypass sanitize_file_name Protection
• EchBay Admin Security <= 1.3.0 - Reflected Cross-Site Scripting
• Motors – Car Dealership & Classified Listings Plugin <= 1.4.103 - Missing Authorization to Authenticated (Subscriber+) Payment Bypass via 'stm_payment_status' Parameter
• Price Drop Alert for WooCommerce <= 1.1 - Unauthenticated SQL Injection
• Ruza <= 1.0.7 - Unauthenticated Local File Inclusion
• Advanced Product Labels for WooCommerce <= 1.2.3.6 - Reflected Cross-Site Scripting
• Property 1.0.5 - 1.0.6 - Missing Authorization to Authenticated (Author+) Privilege Escalation via property_package_user_role Metadata in PayPal Registration
• WP Meta SEO <= 4.5.2 - Authenticated (Subscriber+) SQL Injection
• Quiz and Survey Master (QSM) <= 11.2.6 - Unauthenticated Stored DOM-Based Cross-Site Scripting via 'qsm_hidden_questions' Parameter
• ThinkIT WP Contact Form < 0.3 - Cross-Site Request Forgery
• LatePoint – Calendar Booking Plugin for Appointments and Events <= 5.5.1 - Authenticated (Contributor+) Privilege Escalation
• WP SMS <= 6.5.1 - Authenticated (Contributor+) Stored Cross-Site Scripting
• AI Content Writing Assistant (Content Writer, ChatGPT, Image Generator) All in One <= 1.1.7 - Missing Authorization
• LA-Studio Element Kit for Elementor <= 1.3.8.1 - Authenticated (Contributor+) Local File Inclusion via 'progress_type'
• Weblizar Pin It Button On Image Hover And Post < 3.4 - Authorization Bypass
• GiveWP <= 2.33.3 - Cross-Site Request Forgery to Stripe Integration Deletion
• Clever Mega Menu for Visual Composer <= 1.0.1 - Missing Authorization
• Image Hover Effects For WPBakery Page Builder <= 2.0 - Authenticated (Contributor+) Stored Cross-Site Scripting
• Spam protection, Honeypot, Anti-Spam by CleanTalk <= 6.71 - Authorization Bypass via Reverse DNS (PTR record) Spoofing to Unauthenticated Arbitrary Plugin Installation
• Madara – Responsive and modern WordPress theme for manga sites <= 2.2.2 - Unauthenticated Local File Inclusion
• Table & Contact Form 7 Database – Tablesome <= 1.0.27 - Reflected Cross-Site Scripting
• Booster (<= 6.0.0), Booster Plus (<= 6.0.0), and Booster Elite (<= 6.0.0) for WooCommerce - Cross-Site Request Forgery