Vulnerability archive: section 5, page 11

Open a report to review affected versions, available fixes and original sources. Each report covers a specific issue; its presence does not establish whether your website is affected.

• Better Messages <= 3.0.4 - Authenticated (Subscriber+) SQL Injection via 'group_id' Message Meta Parameter
• Media Library Assistant <= 3.00 - Information Disclosure
• WP Maintenance Mode <= 2.0.6 - Missing Authorization
• LearnPress <= 4.1.7.3.2 - Unauthenticated SQL Injection
• Gallery PhotoBlocks <= 1.1.42 - Reflected Cross-Site Scripting
• WP Find Your Nearest <= 0.3.1 - Cross-Site Request Forgery to Stored Cross-Site Scripting
• Question Answer <= 1.2.70 - Authenticated (Subscriber+) PHP Object Injection
• Foliopress WYSIWYG < 2.6.8.5 - Cross-Site Scripting
• Webpushr <= 4.35.0 - Reflected Cross-Site Scripting
• Ditty – Responsive News Tickers, Sliders, and Lists <= 3.1.69 - Authenticated (Author+) Stored Cross-Site Scripting
• Yoo Slider plugin <= 2.0.0 - Stored Cross-Site Scripting
• VintWood <= 1.1.8 - Unauthenticated Local File Inclusion
• Simply Schedule Appointments <= 1.5.7.5 - Authenticated (Admin+) Stored Cross-Site Scripting
• 10WebAnalytics <= 1.2.8 - Cross-Site Request Forgery Bypass
• Payment Forms for Paystack <= 4.0.1 - Authenticated (Administrator+) SQL Injection
• StyleAI <= 1.0.4 - Missing Authorization
• Super Addons for Elementor <= 1.0 - Authenticated (Contributor+) Stored Cross-Site Scripting
• Ghost (Hide My WP Ghost) <= 7.0.10 - Unauthenticated Login Protection Bypass
• Advanced WordPress Reset <= 1.5 - Reflected Cross-Site Scripting
• BitFire <= 4.5 - Unauthenticated Information Exposure
• Arkhe Blocks <= 2.23.0 - Authenticated (Contributor+) Stored Cross-Site Scripting
• EventPrime <= 2.8.6 - Sensitive Information Exposure
• Fast User Switching <= 1.4.10 - Cross-Site Request Forgery
• Innovio - Multipurpose Landing Page WordPress Theme <= 1.9 - Unauthenticated Local File Inclusion
• Crowdfunding for WooCommerce <= 3.1.14 - Authenticated (Contributor+) Stored Cross-Site Scripting via width Parameter
• EventPrime – Events Calendar, Bookings and Tickets <= 4.3.4.1 - Authenticated (Subscriber+) PHP Object Injection
• Kadence Blocks <= 3.7.8.1 - Authenticated (Contributor+) Stored Cross-Site Scripting via Identity Block Inner Image Content
• WP STAGING WordPress Backup Plugin < 3.2.0 - Sensitive Information Exposure via cache files
• WPBakery Page Builder <= 8.4.1 - Authenticated (Author+) Stored Cross-Site Scripting via Grid Builder
• Wp Ultimate Review <= 2.2.5 - Missing Authorization
• All in One SEO <= 2.2.4.1 - Privilege Escalation to Arbitrary Post Modification
• WP Business Intelligence Lite <= 1.6.2 - SQL Injection
• Absolute Links <= 1.1.1 - Authenticated (Administrator+) SQL Injection
• Booster for WooCommerce <= 5.5.9 - Reflected Cross-Site Scripting
• Dealia – Request a quote <= 1.0.7 - Missing Authorization to Authenticated (Contributor+) Plugin Configuration Reset
• Awesome Support – WordPress HelpDesk & Support Plugin <= 6.1.7 - Missing Authorization via editor_html()
• Togo < 1.0.4 - Authenticated (subscriber+) Privilege Escalation
• Real Cookie Banner: GDPR & ePrivacy Cookie Consent <= 5.2.4 - Authenticated (Admin+) Server-Side Request Forgery via scan-without-login Endpoint
• Post views Stats <= 1.3 - Reflected Cross-Site Scripting via from and to
• RSS Aggregator by Feedzy – Feed to Post, Autoblogging, News & YouTube Video Feeds Aggregator <= 4.3.3 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode Error Message
• Surfer <= 1.6.4.574 - Missing Authorization
• Contest Gallery <= 19.1.4.1 - Authenticated (Author+) SQL Injection via option_id GET
• WP Hardening – Fix Your WordPress Security <= 1.2.1 - Reflected Cross-Site Scripting
• Wp Easy Allopass <= 4.1.1 - Cross-Site Request Forgery
• Keap Official Opt-in Forms <= 1.0.11 - Authenticated (Admin+) Stored Cross-Site Scripting
• Email Keep <= 1.1 - Reflected Cross-Site Scripting
• Armania <= 1.4.8 - Unauthenticated Arbitrary Shortcode Execution
• Swiss Toolkit For WP <= 1.4.1 - Missing Authorization
• Simple Membership MailChimp Integration <= 1.9.7 - Cross-Site Request Forgery
• MemberPress <= 1.11.29 - Authenticated (Contributor+) Stored Cross-Site Scripting via arglist Parameter
• Related Posts for WordPress <= 2.1.1 - Reflected Cross-Site Scripting
• Menu Icons by ThemeIsle <= 0.13.20 - Authenticated (Author+) Stored Cross-Site Scripting
• Video Share VOD – Turnkey Video Site Builder Script <= 2.6.31 - Authenticated (Contributor+) Stored Cross-Site Scripting
• Responsive Addons for Elementor – Free Elementor Addons Plugin and Elementor Templates <= 1.6.4 - Authenticated (Contributor+) Stored Cross-Site Scripting
• Marketo Forms and Tracking <= 1.0.2 - Cross-Site Request Forgery
• Easy Elementor Addons <= 2.1.5 - Authenticated (Contributor+) Stored Cross-Site Scripting
• TranslatePress – Translate Multilingual sites with AI Translation <= 3.2.5 - Unauthenticated Stored Cross-Site Scripting
• Reservation <= 1.7 - Missing Authorization to Unauthenticated Settings Update
• WPBakery Page Builder for WordPress <= 6.12.0 - Authenticated (Contributor+) Stored Cross-Site Scripting
• Gallery - Video Gallery and YouTube Gallery <= 1.7.01 - Stored Cross-Site Scripting
• Auto Amazon Links <= 5.3.1 - Authenticated (Contributor+) Stored Cross-Site Scripting via style
• odPhotogallery <= 0.5.3 - Reflected Cross-Site Scripting
• Checkout Field Manager (Checkout Manager) for WooCommerce <= 7.8.5 - Missing Authorization to Unauthenticated Arbitrary Attachment Deletion
• Biagiotti Core <= 2.1.3 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode
• WP YouTube Live <= 1.8.2 - Admin+ Stored Cross-Site Scripting
• All in One SEO <= 5.0.1.1 - Reflected DOM-Based Cross-Site Scripting via URL Pathname
• WP Super Cache < 1.4.3 - Cross Site Scripting
• Etsy Shop <= 3.0.3 - Cross-Site Request Forgery to Plugin Settings Update
• BitFire Security – Firewall, Malware Scanner, Bot Blocker, Login Protection <= 5.0.3 - Missing Authorization
• Restrict Categories <= 2.6.4 - Reflected Cross-Site Scripting via rc-search
• Contact Form DB - Elementor <= 1.7 - Reflected Cross-Site Scripting
• Debug Log Manager <= 2.2.0 - Cross-Site Request Forgery
• WhyDoWork AdSense <= 1.2 - Reflected Cross-Site Scripting
• Ludos Paradise <= 2.1.3 - Unauthenticated Local File Inclusion
• Subscriptions for WooCommerce <= 2.0.2 - Cross-Site Request Forgery
• Masterstudy Elementor Widgets <= 1.2.4 - Missing Authorization
• Demon image annotation <= 5.3 - Authenticated (Administrator+) SQL Injection
• WP-FB-AutoConnect <= 4.0.5 - Cross-Site Request Forgery to Stored Cross-Site Scripting
• Sessions Time Monitoring Full Automatic <= 1.1.3 - Missing Authorization
• Mediavine Control Panel <= 2.10.2 - Cross-Site Request Forgery via render_settings_page
• Spiraclethemes Site Library <= 1.5.4 - Authenticated (Contributor+) Stored Cross-Site Scripting
• About Author <= 1.3.9 - Authenticated Stored Cross-Site Scripting
• WP-Easy Menu <= 0.41 - Cross-Site Request Forgery to Stored Cross-Site Scripting
• Verified Reviews (Avis Vérifiés) <= 2.4.6 - Unauthenticated Stored Cross-Site Scripting via 'moderation' Parameter (discussion.commentaire)
• Comfino Payment Gateway <= 4.1.1 - Reflected Cross-Site Scripting
• Recipe Card Blocks Lite <= 3.4.18 - Unauthenticated Stored Cross-Site Scripting
• Instant Appointment <= 1.2 - Unauthenticated SQL Injection
• GeoDirectory – WP Business Directory Plugin and Classified Listings Directory <= 2.8.177 - Authenticated (Contributor+) Stored Cross-Site Scripting
• Zoner - Real Estate <= 4.1 - Cross-Site Scripting
• WP to LinkedIn Auto Publish <= 1.9.8 - Reflected Cross-Site Scripting via PostMessage
• User Extra Fields <= 17.0 - Authenticated (Subscriber+) Arbitrary File Deletion
• Avada (Fusion) Builder <= 3.15.4 - Authenticated (Contributor+) Arbitrary File Deletion
• Everest Forms – Contact Form, Payment Form, Quiz, Survey & Custom Form Builder with AI <= 3.4.8 - Reflected Cross-Site Scripting
• Save as PDF Plugin by Pdfcrowd <= 4.4.0 - Unauthenticated PHP Object Injection
• Two Way CHAT – Send or receive messages to your user <= 3.1.4 - Cross-Site Request Forgery
• WPKoi Templates for Elementor <= 3.1.3 - Authenticated (Contributor+) Stored Cross-Site Scripting
• CodeMirror Blocks <= 1.2.4 - Authenticated (Contributor+) Stored Cross-Site Scripting
• Simple Wp colorfull Accordion <= 1.0 - Authenticated (Contributor+) Cross-Site Scripting via 'title' Shortcode Attribute
• iThemes Security <= 6.9.0 - Cross-Site Scripting
• GiveWP <= 2.20.2 - Authenticated Arbitrary File Creation