Vulnerability archive: section 6, page 18

Open a report to review affected versions, available fixes and original sources. Each report covers a specific issue; its presence does not establish whether your website is affected.

• Single Property <= 2.8 - Authenticated (Subscriber+) PHP Object Injection
• Doctreat Core <= 1.7.0 - Unauthenticated Privilege Escalation
• ImageLinks Interactive Image Builder for WordPress <= 1.5.3 - Authenticated (Contributor+) Stored Cross-Site Scripting
• themesflat-addons-for-elementor <= 2.3.2 - Authenticated (Contributor+) Stored Cross-Site Scripting
• EU/UK VAT Manager for WooCommerce <= 2.12.12 - Missing Authorization
• Wishlist <= 2.1.0 - Reflected Cross-Site Scripting
• WP Promoter <= 1.3 - Missing Authorization to Unauthenticated Statistics Reset via wpp-reset_stats AJAX Action
• BadgeOS <= 3.7.1.6 - Missing Authorization in delete_badgeos_log_entries
• WPify Woo – Withdrawal, CRN/VAT, QR payments, Heureka and more for WooCommerce <= 5.4.1 - Authenticated (Contributor+) Arbitrary File Upload
• Download Button for Elementor <= 1.2.1 - Authenticated (Contributor+) Stored Cross-Site Scripting
• ACF On-The-Go <= 1.0.1 - Missing Authorization to Authenticated (Subscriber+) Arbitrary Content Update
• Multiple elFinder Plugins <= (Various Versions) - Directory Traversal to Arbitrary File Deletion
• WP User Groups <= 2.1.0 - Cross-Site Request Forgery
• Envira Gallery <= 1.12.4 - Authenticated (Author+) Stored Cross-Site Scripting via 'arrows' Parameter
• sourceplay-navermap <= 0.0.2 - Missing Authorization
• Embedded Video <= 4.1 - Cross-Site Scripting
• Grecko <= 5.17 - Unauthenticated Local File Inclusion
• Rox Appointment Booking – Appointment Booking Scheduling Solution < 1.2.0 - Payment Bypass to Unauthenticated Arbitrary Booking Price and Payment Method Bypass
• WordPress Hosting Benchmark tool <= 1.3.6 - Cross-Site Request Forgery via execute_plugin()
• Login Alert <= 0.2.1 - Cross-Site Request Forgery to Stored Cross-Site Scripting
• TutorStarter <= 4.0.3 - Unauthenticated Unauthorized User Account Creation
• Widgets for Google Reviews < 9.8 - Authenticated (Contributor+) Stored XSS
• Custom Links On Admin Dashboard Toolbar <= 3.3 - Cross-Site Request Forgery to Stored Cross-Site Scripting
• NewStatPress <= 0.9.8 - Authenticated Cross-Site Scripting
• Employee Directory – Staff Listing & Team Directory Plugin for WordPress <= 4.5.5 - Unauthenticated PHP Object Injection
• All in One SEO <= 2.1.5 - Cross-Site Scripting
• WPvivid <= 0.9.131 - Authenticated (Administrator+) SQL Injection via 'export_data' Parameter
• W3SPEEDSTER <= 7.33 - Cross-Site Request Forgery to Stored Cross-Site Scripting
• WP OAuth Server ( Login with WordPress ) <= 6.2.0 - Unauthenticated SQL Injection
• Kirki – Freeform Page Builder, Website Builder & Customizer <= 6.2.0 - Unauthenticated Blind Server-Side Request Forgery via 'kirki_data' Parameter
• Responsive Tabs with WooCommerce Product Tab Extension <= 3.5.4 - Unauthenticated Arbitrary Option Update
• Text Snippets <= 0.0.1 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'w' Shortcode Attribute
• Trinity Audio <= 5.20.2 - Reflected Cross-Site Scripting
• Ocean Modal Window <= 2.3.2 - Authenticated (Editor+) Remote Code Execution
• Media Library Assistant <= 3.27 - Authenticated (Author+) Limited File Deletion
• Milat jQuery Automatic Popup <= 1.3.1 - Cross-Site Request Forgery to Stored Cross-site Scripting
• Image Gallery – Photo Grid & Video Gallery (Modula) <= 2.13.3 - Missing Authorization to Arbitrary Directory Listing
• Kognetiks Chatbot for WordPress <= 2.1.7 - Missing Authorization to Authenticated (Subscriber+) Assistant Update
• SEO Redirection Plugin – 301 Redirect Manager <= 7.8 - Cross-Site Request Forgery
• All-in-One WP Migration <= 2.0.4 - Missing Authorization to Database Export
• Small Package Quotes – USPS Edition <= 1.3.5 - Unauthenticated SQL Injection
• Bicycleshop <= 1.5 - Authenticated (Contributor+) Stored Cross-Site Scripting
• Scrollsequence <= 1.5.4 - Authenticated (Contributor+) Stored Cross-Site Scripting
• ElementsReady Addons for Elementor <= 6.4.3 - Authenticated (Author+) Stored Cross-Site Scripting via SVG File Upload
• Caldera Forms Google Sheets Connector <= 1.3 - Cross-Site Request Forgery
• Recover WooCommerce Cart Abandonment, Newsletter, Email Marketing, Marketing Automation By FunnelKit <= 3.5.1 - Unauthenticated SQL Injection via 'automationId'
• GeoDirectory – WP Business Directory Plugin and Classified Listings Directory <= 2.8.174 - Unauthenticated SQL Injection
• Elementor Website Builder <= 3.35.5 - Authenticated (Contributor+) Stored Cross-Site Scripting
• Premium Addons for Elementor <= 4.10.30 - Authenticated (Contributor+) Stored Cross-Site Scripting
• WPBakery Visual Composer <= 7.5 - Authenticated (Contributor+) Stored Cross-Site Scripting via Post Author
• WPS Limit Login < 1.4.6.1 - Authorization Bypass via IP Spoofing
• qnotsquiz <= 1.0.0 - Authenticated (Admin+) Stored Cross-Site Scripting
• Delete Usermetas <= 1.1.2 - Cross-Site Request Forgery
• Unlimited Elements For Elementor <= 2.0.14 - Authenticated (Contributor+) Arbitrary File Download
• Wibar <= 1.1.8 - Authenticated (Author+) Stored Cross-Site Scripting
• Rede Itaú for WooCommerce — Payment PIX, Credit Card and Debit <= 5.1.2 - Unauthenticated Order Status Manipulation
• Rollback < 1.2.3 - Cross-Site Request Forgery
• WP Quick Setup <= 2.0 - Missing Authorization to Authenticated (Subscriber+) Arbitrary Plugin/Theme Installation
• TrackShip for WooCommerce <= 1.9.1 - Authenticated (Shop manager+) SQL Injection
• WP Front User Submit / Front Editor <= 4.9.3 - Authenticated (Administrator+) Stored Cross-Site Scripting
• LearnPress <= 4.4.3 - Authenticated (Instructor+) Server-Side Request Forgery
• Post Connector <= 1.0.9 - Authenticated (Administrator+) Stored Cross-Site Scripting
• Advanced Reporting & Statistics for WooCommerce – Orders, Products & Customers Reporting <= 4.1.3 - Unauthenticated SQL Injection
• Ask Me < 6.8.7 - Cross-Site Request Forgery
• FooGallery <= 2.4.15 - Authenticated (Contributor+) Stored Cross-Site Scripting via Gallery Custom URL
• User Registration, User Profiles, Login & Membership – ProfilePress (Formerly WP User Avatar) 3.0.0 - 3.1.3 - Unauthenticated Privilege Escalation
• Expose (All Versions) - Cross-Site Scripting
• Meta Box – WordPress Custom Fields Framework <= 5.9.3 - Authenticated (Contributor+) Information Exposure via Post Meta
• Hydra Booking <= 1.2.2 - Authenticated (Hydra Host+) Insecure Direct Object Reference
• Before After Image Slider WP <= 2.2 - Authenticated (Contributor+) Stored Cross-Site Scripting via shortcode
• Discount Rules for WooCommerce <= 2.2.0 - Missing Authorization
• Mang Board <= 2.4.4 - Unauthenticated Arbitrary File Upload via 'image_path' Parameter
• Inline Related Posts <= 3.7.0 - Authenticated (Admin+) Stored Cross-Site Scripting
• User Frontend: AI Powered Frontend Posting, User Directory, Profile, Membership & User Registration <= 4.2.5 - Missing Authorization
• WpEvently <= 5.0.4 - Missing Authorization
• WP Affiliate Platform < 6.5.1 - Reflected Cross-Site Scripting via Affiliate Editing
• SlideShowPro SC <= 1.0.2 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'album' Shortcode Attribute
• Comment Attachment <= 1.5.5 - Cross-Site Scripting
• Sina Extension for Elementor <= 3.5.1 - Authenticated (Contributor+) Local File Inclusion
• WP Travel Engine – Tour Booking Plugin – Tour Operator Software <= 6.6.7 - Authenticated (Subscriber+) Arbitrary File Deletion via File Renaming
• GNUCommerce <= 1.5.4 - Reflected Cross-Site Scripting
• WatuPRO < 5.5.3.7 - SQL Injection
• Forminator – Contact Form, Payment Form & Custom Form Builder <= 1.29.2 - Authenticated (Contributor+) Stored Cross-Site Scripting via forminator_form Shortcode
• Rescue Shortcodes <= 3.3 - Authenticated (Contributor+) Stored Cross-Site Scripting
• Taxonomy Switcher <= 1.0.3 - Reflected Cross-Site Scripting
• User Specific Content <= 1.0.6 - Authenticated (Contributor+) Stored Cross-Site Scripting
• Import and export users and customers <= 1.24.3 - Authenticated (Contributor+) Stored Cross-Site Scripting via shortcode
• AnWP Football Leagues <= 0.16.7 - Authenticated (Author+) Stored Cross-Site Scripting via SVG File Upload
• Qe SEO Handyman <= 1.0 - Authenticated (Administrator+) SQL Injection
• Booking and Rental Manager for Bike | Car | Resort | Appointment | Dress | Equipment <= 2.6.0 - Missing Authorization
• JoomSport <= 5.6.3 - Missing Authorization
• YOP Poll <= 5.8.0 - Reflected Cross-Site Scripting
• WP Database Backup <= 4.3.2 - Cross-Site Scripting
• Revive.so <= 2.0.6 - Missing Authorization
• async <= 2.6.3 and 3-3.2.2 - Prototype Pollution
• Publish to Schedule <= 4.5.4 - Authenticated (Administrator+) Stored Cross-Site Scripting
• Gravity Forms FreshDesk <= 1.3.5 - Unauthenticated Open Redirect
• All-in-One Addons for Elementor – WidgetKit <= 2.5.5 - Authenticated (Contributor+) Sensitive Information Exposure via Elementor Templates
• Popup Manager <= 1.6.6 - Missing Authorization to Arbitrary Popup Deletion
• The Events Calendar <= 6.16.5.0 - Missing Authorization