Vulnerability archive: section 5, page 5

Open a report to review affected versions, available fixes and original sources. Each report covers a specific issue; its presence does not establish whether your website is affected.

• Paid Member Subscriptions <= 3.0.8 - Unauthenticated Payment Bypass
• RPS Include Content <= 1.2.1 - Authenticated (Contributor+) Stored Cross-Site Scripting
• Live Streaming - Broadcast Live Video <= 5.5.15 - Missing Authorization to Unauthenticated Remote Code Execution
• Tipsy <= 1.6 - Unauthenticated PHP Object Injection
• LWS Hide Login <= 2.1.6 - Cross-Site Request Forgery
• Melhor Envio <= 2.11.19 - Cross-Site Request Forgery and Authenticated Settings Change
• Contact Forms by Cimatti <= 1.6.0 - Cross-Site Request Forgery via accua_forms_list_page_table
• Academy LMS <= 4.0.1 - Authenticated (Contributor+) Arbitrary HTML File Read via 'id' Parameter in /wp/v2/templates REST Route
• Funnel Kit Funnel Builder PRO <= 3.4.5 Authenticated(Contributor+) Stored Cross-Site Scripting via allow_iframe_tag_in_post
• Multi Step Form <= 1.2.5 - Stored Cross-Site Scripting
• Invoct – PDF Invoices & Billing for WooCommerce <= 1.6 - Missing Authorization to Authenticated (Subscriber+) Information Exposure
• WP iCal Availability <= 1.0.3 - Missing Authorization
• Cyberus Key <= 1.0 - Authenticated (Administrator+) Stored Cross-Site Scripting via 'uid' in 'cyberkey_settings' Plugin Setting
• Beaver Builder <= 2.5.4.3 - Missing Authorization
• Arconix FAQ <= 1.9.4 - Missing Authorization
• DTX – Dynamic Text Extension for Contact Form 7 <= 5.0.7 - Unauthenticated Information Exposure
• Contexto <= 1.0 - Reflected Cross-Site Scripting
• Ajax Search Lite <= 4.12.1 - Authenticated (Administrator+) Stored Cross-Site Scripting
• WP Delete Post Copies <= 6.0.2 - Authenticated (Admin+) Stored Cross-Site Scripting
• SVS Pricing Tables <= 1.0.4 - Cross-Site Request Forgery to Pricing Table Deletion
• EduAdmin Booking <= 5.4.2 - Unauthenticated Information Exposure
• WP Compress – Image Optimizer [All-In-One] <= 6.20.13 - Reflected Cross-Site Scripting
• Acnoo Flutter API <= 1.0.5 - Authentication Bypass via Account Takeover
• VW Wedding <= 1.3.7 - Missing Authorization
• Soccer Live Scores <= 1.0.5 - Cross-Site Request Forgery
• Auto Upload Images <= 3.3 - Cross-Site Request Forgery
• Product Feed Manager For WooCommerce – Sell on 200+ Online Marketplaces <= 7.6.1 - Unauthenticated Stored Cross-Site Scripting
• Powerkit <= 3.1.0 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode Attributes
• Beaver Builder <= 2.10.1.2 - Authenticated (Contributor+) SQL Injection
• Woo Custom Emails <= 2.2 - Reflected Cross-Site Scripting via wcemails_edit
• JetEngine <= 3.7.3 - Authenticated (Contributor+) Stored Cross-Site Scripting
• Reviews Sorted <= 3.0.0 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'space' Shortcode Attribute
• Service Finder Booking <= 6.2 - Missing Authorization
• JetEngine <= 3.8.8.1 - Unauthenticated SQL Injection
• vcOS <= 1.4.0 - Reflected Cross-Site Scripting
• Matix Popup Builder <= 1.0.0 - Unauthenticated Arbitrary Options Update
• TerraClassifieds <= 2.0.3 - Cross-Site Request Forgery
• Paid Memberships Pro < 1.8.4.3 - Multiple Cross-Site Scripting
• Toret Manager <= 1.2.7 - Authenticated (Subscriber+) Arbitrary Options Update via AJAX actions
• Subscribe to Comments <= 2.3.2 - Reflected Cross-Site Scripting
• Post Form – Registration Form – Profile Form for User Profiles – Frontend Content Forms for User Submissions (UGC) <= 2.9.0 - Missing Authorization
• WordPress Portfolio Plugin – A Plugin for Making Filterable Portfolio Grid, Portfolio Slider and more <= 1.6.3 - Authenticated (Contributor+) Stored Cross-Site Scripting
• Likes and Dislikes Plugin <= 1.0.0 - Unauthenticated SQL Injection
• Gallery with thumbnail slider <= 6.0 - Authenticated (Contributor+) Stored Cross-Site Scripting
• Find My Blocks < 3.4.0 - Sensitive Information Disclosure
• More Mime Type Filters <= 0.3 - Cross-Site Request Forgery to Stored Cross-Site Scripting
• Webenvo <= 0.0.6 - Authenticated (Subscriber+) Arbitrary File Upload
• Yacht Rental <= 2.6 - Unauthenticated Local File Inclusion
• MJM Clinic <= 1.1.22 - Authenticated (Administrator+) Stored Cross-Site Scripting
• WP Membership <= 1.6.3 - Missing Authorization to Authenticated (Subscriber+) Settings Update
• Stop User Enumeration <= 1.3.4 - Username Enumeration Bypasses
• Wawp < 3.0.18 - Unauthenticated Privilege Escalation
• Image News Slider <= 3.2 - Unspecified Vulnerability
• Autopay <= 5.0.0 - Missing Authorization
• WP Import Export Lite <= 3.9.28 - Authenticated (Subscriber+) Arbitrary File Upload
• TableOn <= 1.0.5.1 - Unauthenticated Blind SQL Injection via 'comment_count' Filter Parameter
• mb.YTPlayer <= 3.3.8 - Missing Authorization
• WP Shortcodes Plugin — Shortcodes Ultimate <= 7.0.1 - Authenticated(Contributor+) Stored Cross-Site Scripting via shortcode
• SupportCandy – AI Customer Support Ticket System & Live Chatbot Agent 3.2.9 - 3.5.2 - Unauthenticated Ticket Attachment Read
• Popup Box <= 6.1.1 - Cross-Site Request Forgery to Popup Status Change
• WordPress Sentinel <= 1.0.0 - Cross-Site Scripting
• Essential Addons for Elementor <= 6.6.11 - Authenticated (Contributor+) Stored Cross-Site Scripting via Fancy Text Widget
• TranslatePress – Translate Multilingual sites with AI Translation <= 3.3.6 - Unauthenticated Stored Cross-Site Scripting
• Patreon WordPress <= 1.8.1 - Authenticated Stored Cross-Site Scripting
• ShipTime: Discounted Shipping Rates <= 1.1.4 - Missing Authorization
• Floating Tweets <= 1.0.1 - Reflected Cross-Site Scripting
• WP Gmail SMTP <= 1.0.7 - Sensitive Information Exposure
• Visual Form Builder <= 2.8.2 - Reflected Cross-Site Scripting
• Javo Core <= 3.0.0.266 - Cross-Site Request Forgery
• Anesta - Intranet, Extranet, Community and BuddyPress WordPress Theme <= 1.5.3 - Unauthenticated PHP Object Injection
• EZPZ One Click Backup <= 12.03.10 - Cross-Site Scripting
• Breezing Forms <= 1.2.7.30 - SQL Injection
• BoldGrid Easy SEO – Simple and Effective SEO <= 1.6.14 - Information Exposure
• DSGVO All in one for WP <= 4.9 - Missing Authorization to Authenticated (Subscriber+) Settings Reset
• Nexter Blocks <= 4.5.4 - Missing Authorization
• Create by Mediavine <= 1.9.7 - Authenticated (Contributor+) Stored Cross-Site Scripting via Schema Meta Shortcode
• Ninja Forms - File Uploads <= 3.0.22 - Unauthenticated Arbitrary File Upload
• Super Video player – Fully Customizable Video Player with Playlist <= 1.8.14 - Authenticated (Editor+) PHP Object Injection
• IMPress for IDX Broker <= 2.6.1 - Authenticated Arbitrary Post Creation, Modification, and Deletion
• Follow Us Badges <= 3.1.11 - Authenticated (Contributor+) Stored Cross-Site Scripting
• WP Go Maps (formerly WP Google Maps) <= 9.0.32 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode
• Blogger Buzz <= 1.2.4 - Missing Authorization via activate_plugin
• Product Customizer Light <= 1.0.0 - Authenticated (Author+) Stored Cross-Site Scripting via SVG File Upload
• Quiz and Survey Master <= 7.1.13 - Cross-Site Scripting
• Booster for WooCommerce <= 5.6.6 - Cross-Site Request Forgery
• xili-tidy-tags <= 1.12.06 - Reflected Cross-Site Scripting
• Beebee Mini <= 1.2.0 - Unauthorized File Upload via ACF
• The Plus Addons for Elementor – Elementor Addons, Page Templates, Widgets, Mega Menu, WooCommerce <= 5.5.6 - Authenticated (Contributor+) Local File Inclusion
• Booking Manager <= 2.1.20 - Authenticated (Author+) SQL Injection
• WP AUDIO GALLERY <= 2.0 - Authenticated (Subscriber+) Arbitrary File Read via .htaccess Manipulation
• Auto Affiliate Links <= 6.4.2.4 - Cross-Site Request Forgery to Stored Cross-Site Scripting
• WPSSO Core <= 18.18.1 - Missing Authorization
• Support Genix <= 1.4.11 - Authenticated (Subscriber+) Insecure Direct Object Reference
• Ad Inserter <= 2.8.7 - Authenticated (Contributor+) Stored Cross-Site Scripting via Custom Field
• Responsive Plus <= 3.5.3 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode Attributes
• WooCommerce Affiliate Plugin - Coupon Affiliates < 4.16.4.5 - Stored Cross-Site Scripting
• Html5 Video Player <= 2.5.18 - Authenticated (Subscriber+) Stored Cross-Site Scripting
• Forminator Forms – Contact Form, Payment Form & Custom Form Builder < 1.57.0.7 - Authenticated (Custom Role+) Privilege Escalation
• Kopa Framework <= 1.3.5 - Cross-Site Request Forgery
• Automatic Translator with Google Translate <= 1.5.4 - Authenticated (Administrator+) Stored Cross-Site Scripting via Custom Font