Vulnerability archive: section 5, page 12

Open a report to review affected versions, available fixes and original sources. Each report covers a specific issue; its presence does not establish whether your website is affected.

• ARMember <= 4.0.10 - Authenticated(Subscriber+) Privilege Escalation
• Academy LMS <= 1.9.25 - Unauthenticated Sensitive Information Exposure
• Download Manager <= 3.2.50 - Authenticated (Contributor+) Arbitrary File Deletion
• Pet Manager <= 1.4 - Reflected Cross-Site Scripting
• WordPress Core < 4.7.5 - Cross-Site Scripting via Customizer
• Eventin <= 4.1.20 - Insecure Direct Object Reference to Authenticated (Contributor+) Schedule Deletion and Modification
• Funnel Builder for WordPress by FunnelKit <= 3.10.1 - Authenticated (Administrator+) SQL Injection
• JetEngine <= 3.7.7 - Unauthenticated Stored Cross-Site Scripting
• JetBlog <= 2.4.10 - Authenticated (Contributor+) Stored Cross-Site Scripting
• FULL Customer <= 3.1.25 - Authenticated (Contributor+) Local File Inclusion
• OPSI Israel Domestic Shipments <= 2.6.5 - Reflected Cross-Site Scripting
• Herd Effects – fake notifications and social proof plugin <= 5.2.6 - Cross-Site Request Forgery
• WP Booking System <= 2.0.19.2 - Missing Authorization
• WPAdverts – Classifieds Plugin <= 2.1.7 - Reflected Cross-Site Scripting
• Mobile Pages <= 1.0.2 - Reflected Cross-Site Scripting
• BackUpWordPress <= 0.4.2b - Remote File Inclusion
• InstaWP Connect <= 0.1.0.8 - Missing Authorization to Arbitrary Options Update
• Link Library <= 7.8.7 - Authenticated (Contributor+) Server-Side Request Forgery
• iThemes Security <= 4.6.12 - Stored Cross-Site Scripting
• Affiliates Manager Google reCAPTCHA Integration <= 1.0.6 - Cross-Site Request Forgery to Stored Cross-Site Scripting
• Paid Member Subscriptions <= 3.0.0 - Unauthenticated CAPTCHA Bypass
• Kalrav AI Agent <= 2.3.8 - Unauthenticated Arbitrary File Upload via kalrav_upload_file AJAX Action
• Video Gallery – Vimeo and YouTube Gallery <= 1.1.7 - Authenticated (Contributor+) Stored Cross-Site Scripting
• FluentCart A New Era of eCommerce <= 1.7.0 - Insecure Direct Object Reference to Unauthenticated Sensitive Information Disclosure via 'order_id' and 'billing_address_id' Parameters
• myLinksDump <= 1.6 - Authenticated (Administrator+) Stored Cross-Site Scripting via 'link_title' Parameter
• Confetti Fall Animation <= 1.3.0 - Authenticated (Contributor+) Stored Cross-Site Scripting
• Welcome Bar <= 2.0.3 - Missing Authorization
• Gutenberg Block Editor Toolkit – EditorsKit <= 1.40.4 - Authenticated (Contributor+) Stored Cross-Site Scripting
• Pixel Tag Manager for WooCommerce – Google Analytics 4, Google Ads, and More Pixels < 2.2.1 - Unauthenticated Conversion Forge
• Photo Gallery <= 1.5.67 - Reflected Cross-Site Scripting
• Tennis Court Bookings <= 1.2.7 - Reflected Cross-Site Scripting
• Exertio <= 1.3.2 - Unauthenticated PHP Object Injection
• Newspack Ads <= 1.47.1 - Authenticated (Contributor+) Stored Cross-Site Scripting
• GiveWP – Donation Plugin and Fundraising Platform < 4.16.3 - Unauthenticated Payment Bypass
• SocialV - Social Network and Community BuddyPress Theme <= 2.0.15 - Missing Authorization to Arbitrary File Download
• MIMO Woocommerce Order Tracking <= 1.0.2 - Missing Authorization to Limited Settings Update
• Video Conferencing with Zoom <= 3.8.16 - E-mail Address Disclosure
• Shabbos and Yom Tov <= 1.9 - Cross-Site Request Forgery to Stored Cross-Site Scripting
• Loginizer Security and Loginizer <= 1.9.2 - Authentication Bypass via WordPress.com OAuth provider
• MailOptin <= 1.2.75.0 - Authenticated (Administrator+) Stored Cross-Site Scripting
• Accordion title for Elementor <= 1.2.1 - Authenticated (Author+) Stored Cross-Site Scripting
• Alex User Counter <= 6.0 - Cross-Site Request Forgery to Settings Update
• JetEngine <= 3.8.9.1 - Unauthenticated SQL Injection
• The Barber Shop <= 1.9 - Unauthenticated PHP Object Injection
• Ocean Extra <= 2.2.6 - Authenticated (Contributor+) Stored Cross-Site Scripting
• RapidLoad Power-Up for Autoptimize <= 1.7.1 - Cross-Site Request Forgery via 'ucss_connect'
• GS Logo Slider <= 3.5.1 - Cross-Site Request Forgery
• Smush – Lazy Load Images, Optimize & Compress Images <= 2.7.5 - Directory Traversal
• Canadian Nutrition Facts Label <= 3.0 - Authenticated (Contributor+) Stored Cross-Site Scripting via Nutrition Label Custom Post Type
• Wolmart Core <= 1.9.6 - Unauthenticated SQL Injection
• WP Sticky Side Buttons <= 2.1 - Cross-Site Request Forgery
• YouTube Playlist Player <= 4.6.7 - Authenticated (Contributor+) Stored Cross-Site Scripting
• RokIntroScroller <= 1.8 - Abuse of Functionality
• UTM Tracker <= 1.3.1 - Authenticated (Administrator+) Stored Cross-Site Scripting
• Cloak & Encrypt < 3.8.0 - Cross-Site Scripting
• Font Organizer <= 2.1.1 - Reflected Cross-Site Scripting
• WowOptin: Next-Gen Popup Maker <= 1.4.29 - Unauthenticated Server-Side Request Forgery via 'link' Parameter in REST API
• Inisev Plugins (Various Versions) - Missing Authorization on handle_installation function
• Hide Dashboard Notifications <= 1.2.3 - Cross-Site Request Forgery
• WordPress Meta Data and Taxonomies Filter (MDTF) <= 1.3.2 - Authenticated (Contributor+) Stored Cross-Site Scripting
• eCommerce Product Catalog <= 3.3.28 - Cross-Site Request Forgery
• WP Cost Estimation < 10.3.0 - Missing Authorization
• MonsterInsights – Google Analytics Dashboard for WordPress <= 5.3.2 - Authenticated Stored Cross-Site Scripting
• Surfer <= 1.5.0.502 - Authenticated (Administrator+) SQL Injection
• GWD Connect <= 2.9 - Unauthenticated Limited Code Execution via update_agent
• Checkout Files Upload for WooCommerce <= 2.2.5 - Unauthenticated Insecure Direct Object Reference
• Category and Product Woocommerce Tabs <= 1.0 - Authenticated (Contributor+) Local File Inclusion
• User Verification <= 2.0.47 - Unauthenticated Insecure Direct Object Reference
• WP Inventory Manager <= 2.3.2 - Reflected Cross-Site Scripting
• Breeze <= 2.1.14 - Missing Authorization
• Import and export users and customers <= 2.5.2 - Authenticated (Subscriber+) Privilege Escalation
• School Management System – SakolaWP <= 1.0.8 - Cross-Site Request Forgery to Exam Setting Manipulation
• WordPress Core < 4.7.1 - Cross-Site Scripting via Name and Version Header of Plugin
• Adifier System < 3.1.4 - Unauthenticated Local File Inclusion
• Devs Accounting <= 1.2.0 - Missing Authorization to Unauthenticated Sensitive Information Exposure via 'id' Parameter
• Forminator Forms <= 1.57.2 - Unauthenticated Stored Cross-Site Scripting via 'postdata-1[post-custom]' Parameter
• Gravity Forms Keap/Infusionsoft <= 1.2.3 - Unauthenticated PHP Object Injection
• Gravity Forms CSS Themes with Fontawesome and Placeholders <= 8.5 - Authenticated (Administrator+) Stored Cross-Site Scripting
• Jetpack – WP Security, Backup, Speed, & Growth < 4.2 - Reflected Cross-Site Scripting
• Auto Excerpt everywhere <= 1.5 - Cross-Site Request Forgery
• WP-Members Membership Plugin <= 3.4.8 - Missing Authorization to Sensitive Information Exposure
• Link Library < 7.9.4 - Reflected Cross-Site Scripting
• Magical Addons For Elementor ( Header Footer Builder, Free Elementor Widgets, Elementor Templates Library ) <= 1.1.37 - Authenticated (Contributor+) Stored Cross-Site Scripting via Text Effect Widget
• Shortcodes Ultimate <= 7.4.2 - Cross-Site Request Forgery to Arbitrary Shortcode Execution
• Contact Form 7 <= 5.3.1 - Arbitrary File Upload via Bypass
• Support Plus Responsive Ticket System <= 9.1.2 - Unauthenticated SQL Injection
• The Plus Addons for Elementor Pro <= 5.2.8 - Unauthenticated Local File Inclusion
• Umberto <= 1.2.8 - Unauthenticated PHP Object Injection
• Eventin – Events Calendar, Tickets, Registration, Booking & WooCommerce <= 4.1.25 - Missing Authorization
• Post Author <= 1.1.1 - Cross-Site Request Forgery
• GiveWP – Donation Plugin and Fundraising Platform <= 4.16.5.1 - Missing Authorization
• Fluent Forms – Customizable Contact Forms, Survey, Quiz, & Conversational Form Builder <= 6.2.14 - Authenticated (Contributor+) Stored Cross-Site Scripting
• Elementor Timeline Widget <= 2.2 - Missing Authorization to Notice Dismissal
• Otaku <= 1.8.0 - Unauthenticated Local File Inclusion
• Awesome Shortcodes <= 1.7.2 - Reflected Cross-Site Scripting
• Wicked Folders <= 2.18.16 - Cross-Site Request Forgery on ajax_move_object
• Ziston < 1.4.5 - Unauthenticated Local File Inclusion
• Greenshift 11.4 - 11.4.5 - Authenticated (Subscriber+) Arbitrary File Upload
• Elementor <= 3.30.2 - Authenticated (Administrator+) Arbitrary File Read via Image Import
• Responsive Lightbox & Gallery < 2.6.1 - Unauthenticated Stored Cross-Site Scripting