Vulnerability archive: section 6, page 11

Open a report to review affected versions, available fixes and original sources. Each report covers a specific issue; its presence does not establish whether your website is affected.

• ZoxPress - The All-In-One WordPress News Theme <= 2.12.0 - Missing Authorization to Authenticated (Subscriber+) Arbitrary Options Update
• Unlimited Elements For Elementor <= 2.0.16 - Reflected Cross-Site Scripting
• WP-CFM <= 1.7.8 - Cross-Site Request Forgery via multiple AJAX functions
• Page View Count 2.8.0 - 2.8.4 - Missing Authorization to Authenticated (Subscriber+) Limited Options Update
• Barter <= 1.6 - Authenticated (Contributor+) Stored Cross-Site Scripting
• Minimal Coming Soon & Maintenance Mode <= 2.16 - Missing Authorization to Export Settings/Theme Change
• Upfrontwp <= 1.0 - Authenticated (Subscriber+) Stored Cross-Site Scripting
• HT Mega – Absolute Addons For Elementor <= 2.4.8 - Authenticated (Contributor+) Stored Cross-Site Scripting via Accordion/FAQ
• NPS computy <= 2.8.0 - Reflected Cross-Site Scripting
• Contact Form & Lead Form Elementor Builder < 1.7.4 - Arbitrary Settings Change
• WP Sitemap <= 1.0 - Authenticated (Contributor+) SQL Injection
• Custom Website Data <= 2.2 - Reflected Cross-Site Scripting
• WooCommerce Product Table Lite <= 3.9.5 - Missing Authorization
• EmbedPress – Embed PDF, 3D Flipbook, Social Feeds, Google Docs, Vimeo, Wistia, YouTube Videos, Audios, Google Maps in Gutenberg Block & Elementor <= 4.1.3 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'provider_name'
• Blightly Explorer <= 2.3.0 - Cross-Site Request Forgery to Stored Cross-Site Scripting
• SMSA Shipping for WooCommerce <= 1.0.4 - Authenticated (Subscriber+) Arbitrary File Download
• SoundSt SEO Search <= 1.2.3 - Reflected Cross-Site Scripting
• JetElements For Elementor <= 2.7.4.1 - Authenticated (Contributor+) Stored Cross-Site Scripting
• Post Views Counter <= 1.3.4 - Authenticated Stored Cross-Site Scripting
• ImageRecycle pdf & image compression <= 3.1.13 - Missing Authorization to Plugin Data Removal in reinitialize
• Apocalypse Meow 21.1.3 - 21.2.7 - Authentication Bypass
• WP Project Manager <= 2.6.14 - Missing Authorization to Project Milestone and Task Creation/Deletion
• LifterLMS <= 7.7.5 - Authenticated (Admin+) SQL Injection
• Frontend Registration – Contact Form 7 <= 5.1 - Authenticated (Editor+) Privilege Escalation
• Elementor Addons by Livemesh <= 8.3.2 - Authenticated (Contributor+) Stored Cross-Site Scripting
• Under Construction, Coming Soon & Maintenance Mode <= 2.1.1 - Cross-Site Request Forgery
• Newsletters <= 4.9.9.2 - Authenticated Privilege Escalation
• Chakra test <= 1.0.1 - Missing Authorization
• Mailgun for WordPress <= 2.2.0 - Unauthenticated Server-Side Request Forgery (SSRF) via 'addresses' Array Keys
• LatePoint <= 5.1.94 - Cross-Site Request Forgery to Account Takeover via change_password() Function
• Tiktok Feed <= 1.0.23 - Missing Authorization
• Portfolio and Projects <= 1.5.5 - Authenticated (Contributor+) Information Exposure
• Comment Link Remove and Other Comment Tools <= 2.1.4 - Arbitrary Comment Deletion via Cross-Site Request Forgery
• Contact Form to Chat Apps | Click to Chat to Order – FormyChat <= 2.15.3 - Unauthenticated Stored Cross-Site Scripting
• Starbox – the Author Box for Humans <= 3.4.7 - Insecure Direct Object Reference
• teachPress <= 9.0.9 - Cross-Site Request Forgery to Import Delete
• Yolox <= 1.0.15 - Unauthenticated Local File Inclusion
• BlossomThemes Email Newsletter <= 2.2.6 - Authenticated (Admin+) Server-Side Request Forgery
• Pretty Links – Link Management, Branding, Tracking & Sharing Plugin <= 1.6.7 - SQL Injection
• Stratum – Elementor Widgets <= 1.4.1 - Authenticated (Contributor+) Stored Cross-Site Scripting via Countdown Widget
• Responsive Addons for Elementor <= 1.7.3 - Authenticated (Contributor+) Stored Cross-Site Scripting
• TinyPNG <= 3.6.13 - Authenticated (Author+) Arbitrary File Deletion via 'convert.path' in 'tiny_compress_images' Post Meta
• Ultimate Member <= 2.8.6 - Cross-Site Request Forgery to Membership Status Change
• Pretty Link Lite < 1.5.4 - Cross-Site Scripting
• Pagopar – WooCommerce Gateway <= 2.7.1 - Cross-Site Request Forgery to Stored Cross-Site Scripting
• Education Addon for Elementor <= 1.3.1 - Authenticated (Contributor+) Insecure Direct Object Reference via naedu_elementor_template Shortcode
• MotoPress Appointment Booking <= 2.4.5 - Authenticated (Staff+) SQL Injection via 's' Parameter
• WP Review Slider <= 12.1 - Authenticated (Subscriber+) SQL Injection
• Send to Twitter <= 1.7.2 - Cross-Site Request Forgery to Stored Cross-Site Scripting
• Welcart e-Commerce <= 2.9.1 - SQL Injection
• Software Issue Manager <= 5.0.1 - Authenticated (Contributor+) Stored Cross-Site Scripting via noaccess_msg Parameter
• Tutor LMS <= 3.9.9 - Insecure Direct Object Reference to Authenticated (Instructor+) Arbitrary Post Deletion via 'course' GET Parameter
• PSW Front-end Login & Registration <= 1.12 - Insufficiently Random Values to Unauthenticated Account Takeover/Privilege Escalation via customer_registration Function
• Corsa Theme <= 1.5 - Authenticated Arbitrary File Upload
• UXsniff <= 1.2.8 - Reflected Cross-Site Scripting
• Site Info <= 1.1 - Authenticated (Editor+) Information Exposure
• AnimateGL Animations for WordPress – Elementor & Gutenberg Blocks Animations <= 1.4.23 - Missing Authorization to Unauthenticated Settings Update
• Civi - Job Board & Freelance Marketplace WordPress Theme <= 2.1.4 - Sensitive Information Exposure
• Page Builder: Pagelayer – Drag and Drop website builder <= 1.8.2 - Authenticated (Contributor+) Stored Cross-Site Scripting via Button
• Top 10 <= 3.3.2 - Cross-Site Request Forgery via edit_count_ajax
• Restaurante <= 3.0.7 - Reflected Cross-Site Scripting
• Database Collation Fix <= 1.2.10 - Unauthenticated SQL Injection via 'force-collation-algorithm' Parameter
• Quick Localization <= 0.1.0 - Reflected Cross-Site Scripting
• Revive.so <= 2.0.7 - Missing Authorization
• WP GDPR Compliance <= 2.0.23 - Cross-Site Request Forgery
• Form to Chat App <= 1.2.5 - Authenticated (Contributor+) Stored Cross-Site Scripting
• Photo Gallery by 10Web – Mobile-Friendly Image Gallery <= 1.8.7 - Open Redirect
• Bit File Manager – 100% free file manager for WordPress <= 5.2.2 - Subscriber+ Arbitrary File Creation/Upload/Deletion
• AM-HiLi <= 1.0 - Authenticated (Administrator+) Stored Cross-Site Scripting
• RegistrationMagic <= 6.0.9.4 - Unauthenticated Price Manipulation
• SP Project & Document Manager <= 4.69 - Missing Authorization
• Korea for WooCommerce <= 1.1.11 - Authenticated (Subscriber+) Sensitive Information Exposure
• Automatic.css 4.0.0 - Unauthenticated Stored Cross-Site Scripting via REQUEST_URI
• SVS Pricing Tables <= 1.0.4 - Authenticated (Admin+) Stored Cross-Site Scripting
• Bloggie <= 2.0.8 - Unauthenticated Stored Cross-Site Scripting
• Magical Addons For Elementor ( Header Footer Builder, Free Elementor Widgets, Elementor Templates Library ) <= 1.1.34 - Authenticated (Contributor+) Stored Cross-Site Scripting
• Global Elementor Buttons <= 1.1.0 - Authenticated(Contributor+) Stored Cross-Site Scripting via button link
• Dokan: AI Powered WooCommerce Multivendor Marketplace Solution – Build Your Own Amazon, eBay, Etsy <= 4.2.4 - Insecure Direct Object Reference to PayPal Account Takeover and Sensitive Information Disclosure
• Vilva <= 1.2.2 - Cross-Site Request Forgery to Notice Dismissal
• WizShop <= 3.0.2 - Unauthenticated Local File Inclusion
• Amfissa <= 1.1 - Unauthenticated Local File Inclusion
• Tickera <= 3.6.0.1 - Authenticated (Staff+) SQL Injection via 'tc_order_status_filter' Parameter
• Easy Social Icons <= 1.2.2 - Cross-Site Request Forgery to Stored Cross-Site Scripting
• Safe Ai Malware Protection for WP <= 1.0.20 - Missing Authorization
• PixelYourSite <= 9.3.6 and PixelYourSite Pro <= 9.6.1 - Authenticated (Administrator+) Stored Cross-Site Scripting
• Sabre < 1.2.2 - Cross-Site Scripting
• Lead Octopus Power < 1.1.1 - SQL Injection
• Sassy Social Share <= 3.3.60 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode
• Customer Reviews for WooCommerce <= 5.122.0 - Unauthenticated Stored Cross-Site Scripting via Comment Author Name
• Simple Custom Post Order <= 2.5.7 - Missing Authorization
• WPB Show Core <= 2.6 - Reflected Cross-Site Scripting via 'file'
• Booster for WooCommerce <= 7.2.4 - Unauthenticated Stored Cross-Site Scripting
• Calculated Fields Form <= 5.2.61 - Authenticated (Admin+) Stored Cross-Site Scripting
• Envato Elements <= 2.0.10 & Template Kit <= 1.0.13 - Authenticated (Contributor+) Arbitrary File Upload
• EmbedStories <= 0.7.4 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode
• Lenxel Core <= 1.2.5 - Authenticated (Contributor+) Local File Inclusion
• Simply Schedule Appointments <= 1.6.12.10 - Unauthenticated SQL Injection
• Gerencianet Oficial <= 1.4.8 - Cross-Site Request Forgery
• Tabs Shortcode <= 2.0.2 - Authenticated (Contributor+) Cross-Site Scripting via Shortcode
• Nasa Core < 6.4.1 - Authenticated (Contributor+) Stored Cross-Site Scripting