Vulnerability archive: section 5, page 18

Open a report to review affected versions, available fixes and original sources. Each report covers a specific issue; its presence does not establish whether your website is affected.

• BuddyPress <= 2.3.4 - Privilege Escalation
• WPKoi Templates for Elementor <= 3.7.2 - Authenticated (Contributor+) Stored Cross-Site Scripting
• NotificationX <= 3.3.3 - Missing Authorization to Unauthenticated Arbitrary Content Injection via 'nx_id' Parameter on /popup-submit REST Route
• Blog2Social: Social Media Auto Post & Scheduler <= 8.6.0 - Authenticated (Subscriber+) Blind Server-Side Request Forgery via post_url
• Frontend Admin by DynamiApps <= 3.29.13 - Authenticated (Administrator+) SQL Injection
• All In One WP Security & Firewall <= 3.8.2 - Authenticated Access or Cross-Site Request Forgery leading to SQL Injection via orderby, order Parameters
• Site Reviews <= 6.11.4 - Authenticated(Subscriber+) Stored Cross-Site Scripting via display name
• ConvertPlus <= 3.5.26 - Authenticated (Contributor+) PHP Object Injection
• Exclusive Addons for Elementor <= 2.6.9.2 - Authenticated(Contributor+) Stored Cross-Site Scripting via Post Grid
• WPCargo Track & Trace <= 8.0.2 - Missing Authorization
• Dokan: AI Powered WooCommerce Multivendor Marketplace Solution – Build Your Own Amazon, eBay, Etsy <= 5.0.6 - Unauthenticated Stored Cross-Site Scripting
• Profile Builder Pro <= 3.15.0 - Unauthenticated Stored Cross-Site Scripting
• WP User Switch <= 1.1.0 - Authenticated (Subscriber+) Privilege Escalation
• Product Configurator for WooCommerce <= 1.2.31 - Arbitrary File Deletion
• Responsive HTML5 Audio Player PRO With Playlist <= 3.5.7 - Authenticated (Contributor+) SQL Injection
• Sticky Anything <= 2.1.5 - Missing Authorization
• MasterBip para Elementor <= 1.6.3 - Authenticated (Contributor+) Stored Cross-Site Scripting
• Membership Plugin – Restrict Content <= 3.2.22 - Missing Authorization
• Lightbox slider – Responsive Lightbox Gallery <= 1.10.2 - Authenticated (Author+) Stored Cross-Site Scripting
• e.nigma buttons <= 1.1.3 - Authenticated (Contributor+) Stored Cross-Site Scripting
• Popup Builder <= 1.1.35 - Authenticated (Subscriber+) Local File Inclusion
• FV Flowplayer Video Player <= 7.3.14.727 - Sensitive Information Exposure
• Sales Page Addon – Elementor & Beaver Builder <= 1.4.5 - Authenticated (Contributor+) Stored Cross-Site Scripting
• Urdu Formatter – Shamil <= 0.1 - Authenticated (Contributor+) Stored Cross-Site Scripting
• Woocommerce Product Design <= 1.0.0 - Unauthenticated Arbitrary File Deletion
• Simplebooklet PDF Viewer and Embedder <= 1.1.2 - Authenticated (Contributor+) Stored Cross-Site Scripting
• verwei.se – WordPress – Twitter <= 1.0 2 - Cross-Site Scripting
• Frontend File Manager <= 23.6 - Missing Authorization to Authenticated (Author+) Arbitrary Post Deletion
• Alter <= 1.0 - Cross-Site Request Forgery
• WPFront Notification Bar <= 3.3.2 - Authenticated (Admin+) Stored Cross-Site Scripting via wpfront-notification-bar-options[custom_class]
• Wsify Widget <= 1.0 - Cross-Site Request Forgery to Stored Cross-Site Scripting
• The Plus Addons for Elementor – Elementor Addons, Page Templates, Widgets, Mega Menu, WooCommerce <= 5.6.11 - Authenticated (Contributor+) Sensitive Information Exposure via content_template
• Gravity Bookings <= 2.1 - Authenticated (Subscriber+) SQL Injection
• Sticky <= 2.5.6 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'readmoretext' Shortcode Attribute
• Ninja Forms – The Contact Form Builder That Grows With You 3.14.0 - 3.15.1 - Authenticated (Custom Role+) Information Exposure
• ShopLentor – WooCommerce Builder for Elementor & Gutenberg +12 Modules – All in One Solution (formerly WooLentor) <= 2.9.7 - Authenticated (Contributor+) DOM-Based Stored Cross-Site Scripting
• WP Project Manager Pro <= 4.0.1 - Authenticated (Subscriber+) SQL Injection
• cformsII < 14.8 - Arbitrary File Upload
• Fluent Forms <= 5.1.5 - Authenticated(Administrator+) Stored Cross-Site Scripting via imported form title
• WP Umbrella: Security Backup Restore & Monitoring 2.24.2-2.26.2 - Cross-Site Request Forgery
• Availability Calendar <= 0.2.4 - Cross-Site Request Forgery
• Windsor <= 2.5.0 - Unauthenticated Local File Inclusion
• WP Fundraising Donation and Crowdfunding Platform <= 1.6.4 - Missing Authorization
• Form Builder CP <= 1.2.41 - Authenticated (Contributor+) SQL Injection
• FV Flowplayer Video Player <= 7.5.15.727 - SQL Injection
• CAS Maestro <= 1.1.3 - Cross-Site Request Forgery to Stored Cross-Site Scripting
• AnyComment <= 0.0.32 - Cross-Site Scripting
• Icegram Express <= 5.7.22 - Authenticated (Subscriber+) SQL Injection Vulnerability via options[list_id]
• ERP: Complete HR, Accounting & CRM Suite Built for WooCommerce <= 1.17.9 - Authenticated (Author+) SQL Injection
• Video Gallery <= 4.0.4 - Authenticated (Author+) Stored Cross-Site Scripting via Attachment 'post_title' via emd_mb_meta Shortcode
• Levo Slideshow <= 2.3 - Cross-Site Scripting
• Yoast SEO <= 21.0 - Authenticated (Seo Manager+) Stored Cross-Site Scripting
• Paid Member Subscriptions <= 2.16.8 - Authenticated (Subscriber+) Insecure Direct Object Reference
• Gutentor <= 3.4.3 - Authenticated (Contributor+) Stored Cross-Site Scripting
• Multiple Themes - Authenticated (Subscriber+) Arbitrary Plugin Activation and Deactivation
• Admin and Site Enhancements (ASE) Pro <= 8.8.5 - Unauthenticated Stored Cross-Site Scripting
• NewStatPress < 1.0.6 - SQL Injection
• Post SMTP – Complete SMTP Solution with Logs, Alerts, Backup SMTP & Mobile App <= 3.6.0 - Missing Authorization to Account Takeover via Unauthenticated Email Log Disclosure
• Travel Tour < 5.2.4 - Reflected Cross-Site Scripting
• Landing Page Builder <= 1.5.2.0 - Authenticated (Editor+) Local File Inlcusion
• JW Player for Flash & HTML5 Video < 2.1.4 - Cross-Site Request Forgery leading to player deletion
• Related Posts Lite <= 1.12 - Authenticated (Admin+) Stored Cross-Site Scripting
• Master Slider <= 3.9.5 - Unauthenticated PHP Object Injection
• Newsmatic <= 1.3.4 - Unauthenticated Information Exposure via newsmatic_filter_posts_load_tab_content
• YellowPencil Visual CSS Style Editor <= 7.6.4 - Reflected Cross-Site Scripting
• GigPress <= 2.3.8 - SQL Injection
• Easy Form Builder <= 3.8.15 - Unauthenticated SQL Injection
• Meks Flexible Shortcodes <= 1.3.7 - Authenticated (Contributor+) Stored Cross-Site Scripting
• Woocommerce CSV importer <= 3.3.6 - Arbitrary File Deletion
• WP Post Statistics (Visitors & Visits Counter) <= 2.5 - Cross-Site Scripting
• AutoNetTV Relay <= 3.0.13 - Unauthenticated Privilege Escalation
• Post Grid Gutenberg Blocks and WordPress Blog Plugin – PostX <= 4.0.1 - Authenticated (Contributor+) Stored Cross-Site Scripting
• CSSTidy - Server-Side Request Forgery
• Poll Maker – Versus Polls, Anonymous Polls, Image Polls <= 5.4.6 - Authenticated (Administrator+) Stored Cross-Site Scripting via Poll Settings
• WooCommerce Order Status Change Notifier <= 1.1.0 - Authenticated (Subscriber+) Arbitrary Order Status Update
• Simple Author Box <= 2.50 - Cross-Site Request Forgery via save_user_profile
• WooCommerce - Social Login <= 2.8.7 - Unauthenticated Authentication Bypass via Forged Apple 'id_token' JWT
• Robots.txt optimization <= 1.4.5 - Cross Site Request Forgery
• Premmerce User Roles <= 1.0.13 - Missing Authorization
• Contact Form, Survey, Quiz & Popup Form Builder – ARForms <= 1.7.0 - Unauthenticated Stored Cross-Site Scripting
• Thim Elementor Kit <= 1.3.3 - Authenticated (Contributor+) Insecure Direct Object Reference
• Ultimate Member <= 2.11.4 - Authenticated (Subscriber+) Stored Cross-Site Scripting via Non-HTML Custom Textarea Profile Field
• MainWP Boilerplate Extension <= 4.1 - Missing Authorization to Plugin Settings Change
• Request Call Back <= 1.4.1 - Authenticated (Administrator+) Stored Cross-Site Scripting
• Custom Frames <= 1.0.1 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'class' Shortcode Parameter
• Jazz Popups <= 1.8.7 - Cross-Site Request Forgery
• Soledad <= 8.6.8 - Authenticated (Contributor+) Stored Cross-Site Scripting
• Essential Blocks – Page Builder Gutenberg Blocks, Patterns & Templates <= 4.6.1 - Authenticated (Contributor+) Stored Cross-Site Scripting
• Xllentech English Islamic Calendar <= 2.6.7 - SQL Injection
• AJAX Multi Upload <= 1.1 - Arbitrary File Upload
• MicroCopy <= 1.1.0 - Authenticated (Admin+) SQL Injection
• Top Bar <= 3.0.5 - Authenticated (Admin+) Stored Cross-Site Scripting
• Push Notifications for WordPress by PushAssist <= 3.0.8 - Reflected Cross-Site Scripting
• WP Forms Connector <= 1.8 - Unauthenticated SQL Injection via 'order' Parameter
• YOGO Booking <= 1.6.2 - Authenticated (Contributor+) Stored Cross-Site Scripting
• WP Radio – Worldwide Online Radio Stations Directory for WordPress <= 3.1.9 - Cross-Site Request Forgery
• Admin renamer extended <= 3.2.1 - Cross-Site Request Forgery
• Form Maker by 10Web <= 1.12.21 - CSV Injection
• Five Star Restaurant Reservations – WordPress Booking Plugin <= 2.7.14 - Missing Authorization
• Shortcodes Ultimate <= 7.4.0 - Authenticted (Contributor+) Stored Cross-Site Scripting via 'data-url' Attribute