Vulnerability archive: section 6, page 16

Open a report to review affected versions, available fixes and original sources. Each report covers a specific issue; its presence does not establish whether your website is affected.

• Page View Count <= 2.6.0 - Authenticated (Contributor+) Stored Cross-Site Scripting
• CatalogX – Catalog Mode, Enquiry & Quotes for WooCommerce <= 6.1.5 - Unauthenticated Privilege Escalation
• Homey - Booking and Rentals WordPress Theme <= 2.4.4 - Insecure Direct Object Reference to Authenticated (Subscriber+) Arbitrary User Deletion
• ARForms Form Builder <= 1.6.1 - Missing Authorization
• Responsive Mobile-Friendly Tooltip <= 1.6.6 - Authenticated (Contributor+) Stored Cross-Site Scripting
• RDP inGroups+ <= 1.0.6 - Reflected Cross-Site Scripting
• nicen-localize-image <= 1.4.9 - Authenticated (Contributor+) SQL Injection
• Simple Basic Contact Form <= 20221201 - Reflected Cross-Site Scripting
• JobBoard Job listing <= 1.2.6 - Unauthenticated Arbitrary File Upload
• Broadstreet <= 1.53.1 - Authenticated (Admin+) Stored Cross-Site Scripting
• Page Builder by AZEXO <= 1.27.133 - Missing Authorization to Post Creation
• WP Meta SEO <= 4.5.2 - Missing Authorization in 'startProcess' to Arbitrary Redirect via 'update_link_redirect' task
• Knowledge Base – Knowledge Base Maker <= 1.1.8 - Cross-Site Request Forgery
• PeproDev Ultimate Invoice <= 2.0.6 - Authenticated (Contributor+) Stored Cross-Site Scripting
• BP Profile Shortcodes Extra <= 2.6.0 - Authenticated (Contributor+) SQL Injection via tab Parameter
• Frontend Dashboard <= 2.0.0 - Missing Authorization
• Ultimate FAQ <= 1.8.29 - Reflected Cross-Site Scripting
• DukaMarket <= 1.3.0 - Unauthenticated Arbitrary Shortcode Execution
• Activello <= 1.4.6 - Reflected Cross-Site Scripting
• Logger for Elementor <= 1.0.9 - Missing Authorization
• Authorsy <= 1.0.6 - Unauthenticated Insecure Direct Object Reference
• Easy Social Icons <= 3.2.4 - Missing Authorization via cnss_save_ajax_order
• Shipment Tracker for Woocommerce <= 1.4.23 - Reflected Cross-Site Scripting
• Mediavine Control Panel <= 2.10.4 - Authenticated (Contributor+) Stored Cross-Site Scripting
• Cost Calculator Builder <= 3.2.67 - Authenticated (Subscriber+) SQL Injection via order_ids Parameter
• Simple Testimonials Showcase <= 1.1.6 - Cross-Site Request Forgery
• Cookie Notice & Compliance for GDPR / CCPA <= 2.5.8 - Authenticated (Author+) Stored Cross-Site Scripting
• Gutenverse News <= 1.0.4 - Authenticated (Contributor+) Stored Cross-Site Scripting via elementId Parameter
• 0mk Shortener <= 0.2 - Cross-Site Request Forgery to Stored Cross-Site Scripting
• Gravityforms <= 1.9.3.5 - SQL Injection
• Gyan Elements <= 2.2.1 - Reflected Cross-Site Scripting
• Simple SEO <= 1.7.91 - Authenticated (Contributor+) Stored Cross-Site Scripting
• bbPress Notify <= 2.19.5 - Reflected Cross-Site Scripting
• Livemesh Addons by Elementor <= 9.0 - Missing Authorization to Authenticated (Subscriber+) Stored Cross-Site Scripting via Plugin Settings
• Database Backup for WordPress <= 2.2.4 - Missing Authorization
• Bard Extra <= 1.2.7 - Missing Authorization to Authenticated (Subscriber+) Demo Import
• Shortcodes Ultimate <= 5.12.6 - Authenticated (Subscriber+) Server-Side Request Forgery
• Listing, Classified Ads & Business Directory – uListing <= 2.0.5 - Privilege Escalation
• Post Meta Data Manager <= 1.2.1 - Cross-Site Request Forgery to Post, Term, and User Meta Deletion
• User Frontend <= 4.3.10 - Authenticated (Subscriber+) PHP Object Injection
• Mobile builder <= 1.4.2 - Authenticated (Subscriber+) Privilege Escalation
• Shariff for WordPress <= 1.0.11 - Authenticated (Admin+) Stored Cross-Site Scripting
• WP Mail Catcher <= 2.1.9 - Reflected Cross-Site Scripting
• Import XML and RSS Feeds <= 2.1.3 - Authenticated (Admin+) Arbitrary File Upload
• MainWP UpdraftPlus Extension <= 4.0.6 - Missing Authorization
• Ultimate Member – User Profile, Registration, Login, Member Directory, Content Restriction & Membership Plugin <= 2.13.1 - Authenticated (Subscriber+) Privilege Escalation
• SiteSkite – Secure MCP & AI WebOps. Connect ChatGPT, Claude, or Any AI Agent via MCP <= 2.1.7 - Authenticated (Contributor+) Insecure Direct Object Reference
• WPC Admin Columns 2.0.6 - 2.1.0 - Authenticated (Subscriber+) Privilege Escalation via User Meta Update
• Contact Form by WPForms <= 1.9.2.2 - Missing Authorization
• WordPress Adverts Plugin <= 1.4 - Missing Authorization
• DX Unanswered Comments <= 1.7 - Cross-Site Request Forgery via Settings Update
• Advanced Most Recent Posts Mod <= 1.6.5.2 - Authenticated (Author+) Stored Cross-Site Scripting
• Fix Rss Feeds <= 3.1 - Cross-Site Request Forgery
• Latest Post Shortcode <= 14.2.1 - Missing Authorization
• Tourfic – AI Powered Travel Booking, Hotel Booking & Car Rental WordPress Plugin <= 2.22.5 - Missing Authorization
• 아임포트 결제버튼 생성 플러그인 <= 1.1.19 - Authenticated (Contributor+) Stored Cross-Site Scripting
• Unlimited Elements For Elementor <= 2.0.19 - Authenticated (Subscriber+) PHP Object Injection
• Sweet Dessert < 1.1.13 - Unauthenticated PHP Object Injection
• User Extra Fields <= 16.8 - Unauthenticated Stored Cross-Site Scripting
• Crypto <= 2.18 - Authentication Bypass via log_in
• WP RSS Aggregator <= 4.19.1 - Admin+ Stored Cross-Site Scripting
• Super Socializer <= 7.13.53 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode
• NewsBlogger <= 0.2.5.1 - Authenticated (Subscriber+) Arbitrary File Upload
• Webling <= 3.9.0 - Authenticated (Administrator+) Stored Cross-Site Scripting
• Széchenyi 2020 Logo <= 1.1 - Unauthenticated Local File Inclusion
• AppMaps <= 1.1 - Cross-Site Request Forgery to Stored Cross-Site Scripting
• HT Easy GA4 – Google Analytics WordPress Plugin <= 1.1.5 - Missing Authorization to Unauthenticated GA4 Email Update
• Broken Link Checker by AIOSEO <= 1.2.3 - Authenticated (Contributor+) SQL Injection
• Event Organiser <= 3.12.8 - Missing Authorization
• Sparkle Demo Importer <= 1.4.7 - Missing Authorization to Authorized(Subscriber+) Post/Pages/Attachements Deletion and Demo Data Import
• Secure File Manager < 2.8.2 - Remote Code Execution
• Cart66 Lite :: WordPress Ecommerce < 1.5.1.15 - Cross-Site Request Forgery
• Spiffy Calendar <= 4.9.8 - Insufficient Authorization
• Quiz Cat – WordPress Quiz Plugin <= 3.1.1 - Authenticated (Author+) SQL Injection
• My Tickets – Accessible Event Ticketing <= 2.1.0 - Unauthenticated Information Exposure
• WP Admin UI Customize <= 1.5.12 - Authenticated (Administrator+) Cross-Site Scripting
• Team Circle Image Slider With Lightbox <= 1.0.15 - Reflected Cross-Site Scripting
• FiboSearch <= 1.17.0 - Authenticated (Admin+) Stored Cross-Site Scripting
• Flex Store Users <= 1.1.0 - Unauthenticated Privilege Escalation
• wordpress vertical image slider plugin <= 1.2.16 - Reflected Cross-Site Scripting
• Unica - Event Planning & Wedding WordPress Theme <= 1.4.1 - Unauthenticated Local File Inclusion
• WxSync <= 2.8.0 - Authenticated (Contributor+) Stored Cross-Site Scripting
• Album and Image Gallery with Lightbox – Flagallery Photo Portfolio <= 2.00 - SQL Injection
• Fortis for WooCommerce < 1.3.1 - Unauthenticated Information Exposure
• JS Help Desk <= 2.7.1 - Cross-Site Request Forgery
• Easyfonts <= 1.1.2 - Cross-Site Request Forgery
• AMP Enhancer <= 1.0.49 - Authenticated (Administrator+) Stored Cross-Site Scripting via AMP Custom CSS Setting
• BRW <= 1.8.7 - Unauthenticated Local File Inclusion
• My Sticky Bar <= 2.6.7 - Authenticated (Admin+) Stored Cross-Site Scripting
• Ultimate Bootstrap Elements for Elementor <= 1.4.6 - Authenticated (Contributor+) Sensitive Information Exposure
• WH Tweaks <= 1.0.2 - Authenticated (Administrator+) Stored Cross-Site Scripting
• BEAR – Bulk Editor for WooCommerce Professional. AI assistant on board (MCP Server) <= 1.2.2 - Missing Authorization
• Off-Canvas Sidebars & Menus (Slidebars) <= 0.5.8.1 - Authenticated (Contributor+) Stored Cross-Site Scripting
• Autocomplete Location field Contact Form 7 <= 2.0 - Authenticated (Administrator+) Stored Cross-Site Scripting
• Snapshot Backup <= 2.1.1 - Cross-Site Request Forgery to Stored Cross-Site Scripting
• Photo Gallery by 10Web <= 1.5.68 - Cross-Site Scripting
• Aqua SVG Sprite <= 3.0.14 - Authenticated (Author+) Stored Cross-Site Scripting via SVG File Upload
• PNG to JPG <= 5.8 - Cross-Site Request Forgery leading to Stored Cross-Site Scripting
• Struktur - Creative Agency WordPress Theme <= 2.5.1 - Authenticated (Contributor+) Local File Inclusion
• bunny.net <= 2.3.0 - Authenticated (Contributor+) Stored Cross-Site Scripting