Vulnerability archive: section 5, page 13

Open a report to review affected versions, available fixes and original sources. Each report covers a specific issue; its presence does not establish whether your website is affected.

• WooCommerce Social Login <= 2.6.3 - Unauthenticated PHP Object Injection
• WP Airbnb Review Slider <= 3.2 - Authenticated (Subscriber+) SQL Injection
• PopAd <= 1.0.4 - Cross-Site Request Forgery to Settings Update
• HT Mega – Absolute Addons For Elementor <= 2.5.0 - Authenticated (Contributor+) Stored Cross-Site Scripting via Gallery Justify
• Embed Swagger UI <= 1.0.0 - Authenticated (Contributor+) Stored Cross-Site Scripting
• Notification for Telegram <= 3.5.1 - Missing Authorization to Authenticated (Subscriber+) Cron Modification via nftb_cron_action_set AJAX Action
• Simple Post Notes <= 1.7.7 - Authenticated (Administrator+) Stored Cross-Site Scripting
• WPeMatico RSS Feed Fetcher <= 2.8.26 - Authenticated (Contributor+) Server-Side Request Forgery
• Redirection for Contact Form 7 <= 3.2.6 - Authenticated (Contributor+) Stored Cross-Site Scripting via qs_date Shortcode
• WordPress Core <= 2.0.5 - Cross-Site Request Forgery to Cross-Site Scripting
• ImageRecycle pdf & image compression <= 3.1.13 - Missing Authorization to Settings Update in optimizeAllOn
• VikAppointments Services Booking Calendar <= 1.2.16 - Cross-Site Request Forgery
• WP Telegram Widget and Join Link <= 2.2.13 - Reflected Cross-Site Scripting
• Kirki <= 6.0.11 - Unauthenticated Insecure Direct Object Reference
• Google CSE <= 1.0.7 - Authenticated (Admin+) Stored Cross-Site Scripting
• RJ Quickcharts <= 0.6.1 - Authenticated (Subscriber+) Stored Cross-Site Scripting
• JetEngine <= 3.2.4 - Missing Authorization
• Media Library Assistant <= 3.09 - Unauthenticated Local/Remote File Inclusion & Remote Code Execution
• LatePoint Plugin <= 4.9.9 - Missing Authorization and Sensitive Information Exposure via IDOR
• Kirki – Freeform Page Builder, Website Builder & Customizer <= 6.3.1 - Unauthenticated Remote Code Execution
• Simple Membership <= 4.7.6 - Unauthenticated Payment Verification Bypass
• Redirect Redirection <= 1.1.3 - Cross-Site Request Forgery via 'cronLogDeleteOption' function
• Kiwi Social Sharing 2.1.0 - 2.1.2 - Arbitrary Options Change
• License Manager for WooCommerce <= 3.0.6 - Improper Authorization to Authenticated(Contributor+) Sensitive Information Exposure
• Simple Giveaways <= 2.36.1 - Reflected Cross-Site Scripting
• WP Maps – Display Google Maps Perfectly with Ease <= 4.7.1 - Authenticated (Admin+) Stored Cross-Site Scripting
• All-in-One Addons for Elementor – WidgetKit <= 2.4.8 - Authenticated (Contributor+) Stored Cross-Site Scripting
• WpTravelly <= 1.8.7 - Authenticated (Contributor+) PHP Object Injection
• The ShopEngine Elementor WooCommerce Builder Addon – All in One WooCommerce Solution with eCommerce Templates & Woo Widgets <= 4.9.5 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'shopengine_product_title_header_size' Parameter
• TNC Toolbox: Web Performance <= 2.0.4 - Missing Authorization
• JobCareer | Job Board Responsive WordPress Theme < 2.4 - User Enumeration
• The Guardian News Feed <= 1.2 - Cross-Site Request Forgery to Settings Update
• NextScripts: Social Networks Auto-Poster <= 4.3.25 - Reflected Cross-Site Scripting
• EduMall < 4.4.5 - Unauthenticated Local File Inclusion
• WP Custom Cursors | WordPress Cursor <= 3.2 - Authenticated (Admin+) Stored Cross-Site Scripting
• Travelpayouts <= 1.0.16 - Cross-Site Request Forgery
• Member Directory and Contact Form <= 1.7.0 - Missing Authorization
• Persian Elementor (المنتور فارسی) <= 2.8.1 - Unauthenticated Price Manipulation via ZarinPal Widget
• LWS Tools <= 2.4.1 - Cross-Site Request Forgery
• URL Shortify <= 1.11.3 - Reflected Cross-Site Scripting
• Administrator Z <= 2025.09.27 - Authenticated (Contributor+) Stored Cross-Site Scripting
• Bookly 23.2 - 28.2 - Authenticated (Bookly Administrator+) PHP Object Injection
• Affiliator <= 2.1.3 - Unauthenticated Arbitrary File Upload
• Event Easy Calendar <= 1.0.0 - Cross-Site Scripting
• CoSchool LMS <= 1.4.3 - Unauthenticated PHP Object Injection
• WP-Advanced-Search <= 3.3.9.3 - Authenticated (Admin+) Arbitrary File Upload
• WordPress Core < 4.4 - Brute Force Password Recovery Tokens
• Integrio Core < 1.2.8 - Unauthenticated Local File Inclusion
• Tainacan <= 1.0.0 - Unauthenticated Information Exposure
• Forminator Forms – Contact Form, Payment Form & Custom Form Builder <= 1.57.3 - Missing Authorization
• Inline Text Popup <= 1.0.0 - Authenticated (Contributor+) Stored Cross-Site Scripting
• The Events Calendar Countdown Addon <= 1.4.15 - Missing Authorization
• The Post Grid <= 7.7.11 - Authenticated (Contributor+) Information Disclosure
• Contest Gallery <= 23.1.2 - Unauthenticated Information Exposure
• VR <= 8.5.48 - Authenticated (Contributor+) Stored Cross-Site Scripting
• Comment SPAM Wiper <= 1.2.1 - Authenticated (Administrator+) Stored Cross-Site Scripting via 'API Key' Setting
• Doneren met Mollie <= 2.8.4 - Information Disclosure
• Smush – Image Optimization, Compression, Lazy Load, WebP & CDN <= 4.2.0 - Unauthenticated Denial of Service
• Support Board <= 3.8.0 - Unauthenticated Local File Inclusion
• Chatbot for WordPress by Collect.chat ⚡️ <= 2.4.9 - Unauthenticated Stored Cross-Site Scripting
• Infusionsoft Gravity Forms Add-on < 1.5.7 - Cross-Site Scripting
• Cancel Order & Request Woocommerce <= 1.3.4.33 - Missing Authorization
• WCPOS – Point of Sale (POS) plugin for WooCommerce <= 1.8.14 - Missing Authorization
• WordPress Tag, Category, and Taxonomy Manager – AI Autotagger <= 3.32.0 - Authenticated (Admin+) Stored Cross-Site Scripting
• Protect WP Admin <= 4.1 - Missing Authorization
• Ocean Extra <= 2.4.6 - Unauthenticated Arbitrary Shortcode Execution
• LTL Freight Quotes – FreightQuote Edition <= 2.3.11 - Unauthenticated SQL Injection
• Simple Donate <= 1.0 - Authenticated (Contributor+) Stored Cross-Site Scripting
• XiSearch bar <= 2.6 - Cross-Site Request Forgery to Stored Cross-Site Scripting
• VR-Frases (collect & share quotes) <= 3.0.1 - Authenticated (Admin+) SQL Injection
• Social Sharing Plugin – Sassy Social Share <= 3.3.69 - Reflected Cross-Site Scripting via heateor_mastodon_share Parameter
• Citadela Listing <= 5.18.1 - Unauthenticated Sensitive Information Exposure
• Custom DataBase Tables <= 2.1.34 - Reflected Cross-Site Scripting
• Gravityforms <= 1.8.19 - Arbitrary File Upload
• Apollo - Sticky Full Width HTML5 Audio Player <= 3.4 - Reflected Cross-Site Scripting
• OpenID Connect Generic Client 3.8.0-3.8.1 - Reflected Cross-Site Scripting
• CaPa Protect <= 0.5.8.2 - Cross-Site Request Forgery to Settings Update
• Confidant - Startup & Consulting Services WordPress Theme <= 1.4 - Unauthenticated Local File Inclusion
• WP Editor <= 1.2.9.2 - Cross-Site Request Forgery to Remote Code Execution via Plugin and Theme File Editor
• Rally <= 1.1 - Unauthenticated Local File Inclusion
• Newsletter <= 3.8.2 - Open Redirect
• Remember Me Controls <= 2.0.1 - Unauthenticated Full Path Disclosure
• Popup Box Business (7.0.0 - 7.9.0) and Developer (20.0.0 - 20.9.0) - Authenticated (Admin+) Stored Cross-Site Scripting
• EventPrime < 3.2.0 - Cross-Site Request Forgery
• GamiPress <= 7.2.1 - Unauthenticated Arbitrary Shortcode Execution via gamipress_ajax_get_logs Function
• UpdraftPlus - Backup/Restore <= 1.24.12 - Reflected Cross-Site Scripting
• Nested Pages <= 3.2.6 - Authenticated (Administrator+) Stored Cross-Site Scripting
• Cart66 Cloud <= 2.3.7 - Reflected Cross-Site Scripting
• Button Generator – easily Button Builder <= 2.3.2 - Cross-Site Request Forgery
• BizLibrary <= 1.1 - Reflected Cross-Site Scripting
• ContentStudio <= 1.2.5 - Information Exposure
• Lettuce <= 1.1.7 - Unauthenticated Local File Inclusion
• TI WooCommerce Wishlist <= 1.21.11 and TI WooCommerce Wishlist Pro <= 1.21.4 - Arbitrary Options Update
• Klaviyo <= 3.0.7 - Authenticated (Administrator+) Stored Cross-Site Scripting
• bSuite <= 5 alpha 2 - Multiple Cross-Site Scripting
• Woffice Core <= 5.4.21 - Cross-Site Request Forgery to User Registration Approval
• Event Tickets and Registration <= 5.8.1 - Missing Authorization
• WP Hotel Booking <= 2.0.0 - Missing Authorization to Settings Update
• WPFunnels – Funnel Builder for WooCommerce with Checkout & One Click Upsell < 3.13.0 - Unauthenticated Product Price Manipulation
• Catch Themes Demo Import <= 1.7 - Arbitrary File Upload