Vulnerability archive: section 6, page 2

Open a report to review affected versions, available fixes and original sources. Each report covers a specific issue; its presence does not establish whether your website is affected.

• All In One SEO Pack <= 3.2.6 - Stored Cross-Site Scripting
• PPOM for WooCommerce <= 33.0.8 - Authenticated (Administrator+) Stored Cross-Site Scripting
• Classified Listing <= 5.4.3 - Missing Authorization
• Ajax Search Lite <= 4.11.4 - Reflected Cross-Site Scripting
• Myflash < 1.11 - Remote File Inclusion
• Poll Maker <= 5.5.0 - Missing Authorization
• Users Ultra Membership, Users Community and Member Profiles With PayPal Integration Plugin < 1.4.36 - SQL Injection
• Tweaker5 <= 1.2 - Authenticated (Contributor+) Stored Cross-Site Scripting via Button Shortcode
• Visibility Logic for Elementor <= 2.3.4 - Missing Authorization via admin_post 'toggle_option'
• Verge3D <= 4.9.4 - Missing Authorization
• WP ERP Pro <= 1.5.1 - Unauthenticated SQL Injection via 'search_key' Parameter
• WordPress Infinite Scroll – Ajax Load More <= 7.4.0.1 - Authenticated(Contributor+) Stored Cross-Site Scripting
• Frontend Login and Registration Blocks <= 1.0.8 - Authenticated (Subscriber+) Privilege Escalation via Password Reset
• Pollcaster Shortcode Plugin <= 1.0 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode
• MasterStudy LMS WordPress Plugin – for Online Courses and Education < 3.7.46 - Authenticated (Subscriber+) Insecure Direct Object Reference
• Formidable Form Builder <= 2.0.21 - Missing Authorization Checks
• Reoon Email Verifier <= 2.0.1 - Missing Authorization
• LatePoint <= 5.0.12 - Authentication Bypass
• Element Pack Addons for Elementor – Elementor Widgets, Elementor Templates, Elementor Addons <= 8.8.6 - Authenticated (Contributor+) Stored Cross-Site Scripting
• JobCareer | Job Board Responsive WordPress Theme < 2.4 - Unauthenticated Arbitrary Password Reset
• RabbitLoader <= 2.19.13 - Missing Authorization via multiple AJAX actions
• Qi Addons For Elementor <= 1.6.4 - Authenticated (Contributor+) Stored Cross-Site Scripting
• Fitness Zone WordPress <= 5.7 - Unauthenticated Stored Cross-Site Scripting
• SK WP Settings Backup <= 1.0 - Cross-Site Request Forgery to PHP Object Injection
• Superb Social Media Share Buttons and Follow Buttons <= 1.1.3 - Missing Authorization via spbsmAjax
• Categorify <= 1.0.7.4 - Missing Authorization in categorifyAjaxAddCategory
• WholesaleX <= 1.3.2 - Unauthenticated Privilege Escalation
• Frontpage Manager <= 1.3 - Cross-Site Request Forgery via admin_page
• Paid Videochat Turnkey Site – HTML5 PPV Live Webcams <= 7.4.8 - Authenticated (Performer+) Arbitrary File Deletion
• Read and Understood < 2.2 - Cross-Site Request Forgery
• Integration with Hubspot Forms <= 1.2.2 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode Attributes
• personal-authors-category <= 0.3 - Reflected Cross-Site Scripting
• Icegram <= 3.1.21 - Missing Authorization
• OPSI Israel Domestic Shipments <= 2.9.1.2 - Missing Authorization
• Sell Downloads <= 1.0.7 - Improper Input Validation
• WP Super Minify <= 1.5.1 - Cross-Site Request Forgery via 'wpsmy_admin_options'
• Post Sync <= 1.1 - Reflected Cross-Site Scripting
• Booking Calendar and Notification <= 4.0.3 - Unauthenticated SQL Injection
• Woodpecker for WordPress <= 3.0.4 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'form_name' Shortcode Attribute
• YITH WooCommerce Ajax Product Filter <= 3.11.0 - Cross-Site Scripting
• WP Performance Pack <= 2.5.4 - Cross-Site Request Forgery
• WP Google Maps <= 6.0.26 - Reflected Cross-Site Scripting
• Asgaros Forum <= 1.15.12 - Unauthenticated SQL Injection
• WP Fast Total Search – The Power of Indexed Search <= 1.80.280 - Unauthenticated SQL Injection
• Get Cash <= 3.2.3 - Missing Authorization
• WP Travel Engine <= 1.4.2 - Authenticated (Contributor+) Stored Cross-Site Scripting
• Surbma | Recent Comments Shortcode <= 2.0 - Authenticated (Contributor+) Stored Cross-Site Scripting
• Simple Giveaways <= 2.48.1 - Authenticated (Contributor+) SQL Injection
• Inboxify Sign Up Form <= 1.0.4 - Authenticated (Administrator+) Stored Cross-Site Scripting
• Aparat Responsive <= 1.3 - Authenticated (Contributor+) Stored Cross-Site Scripting
• JS Help Desk <= 2.7.1 - Missing Authorization to Plugin Settings Update
• Mark New Posts <= 7.5.1 - Missing Authorization via save_options
• Newsletter Popup <= 1.2 - Unauthenticted Stored Cross-Site Scripting via 'nl_data'
• Extended Post Status <= 1.0.19 - Missing Authorization via wp_insert_post_data
• Post Affiliate Pro <= 1.24.9 - Authenticated (Administrator+) Stored Cross-Site Scripting
• CanvasFlow <= 1.5.5 - Reflected Cross-Site Scripting
• HTML5 chat <= 1.07 - Authenticated (Contributor+) Stored Cross-Site Scripting
• AI Engine <= 3.5.4 - Authenticated (Subscriber+) Insecure Direct Object Reference to Chatbot Discussion Disclosure
• GoodBarber <= 1.0.26 - Open Redirect
• Google Analytics Dashboard <= 2.1.1 - Reflected Cross-Site Scripting
• Shortcodes by United Themes <= 5.1.6 - Unauthenticated Arbitrary Shortcode Execution
• Nokri – Job Board WordPress Theme <= 1.6.6 - Missing Authorization
• QS Dark Mode <= 3.0 - Missing Authorization
• tagDiv Composer <= 4.8 - Authenticated (Contributor+) Local File Inclusion via Shortcode
• CLEVER <= 2.6 - Unauthenticated Arbitrary File Download
• Owl carousel responsive <= 1.9 - Authenticated (Contributor+) SQL Injection via id Parameter
• Contact Bank – Contact Form Builder for WordPress < 2.1.23 - Reflected Cross-Site Scripting
• Style Kits – Advanced Theme Styles for Elementor <= 2.5.0 - Authenticated (Contributor+) Stored Cross-Site Scripting via Kit Title
• WPSmartContracts <= 1.3.11 - Authenticated (Author+) SQL Injection
• Piotnet Addons For Elementor <= 2.4.32 - Authenticated (Contributor+) Post Disclosure
• WooCommerce <= 6.2.0 - Incorrect Authorization Checks on REST API Endpoints
• Mega Elements <= 1.2.6 - Authenticated (Contributor+) Stored Cross-Site Scripting
• Fusion <= 3.1 - Arbitrary File Upload
• Popup | Custom Popup Builder <= 1.3.1 - Missing Capabilities Check
• Auction Nudge – Your eBay on Your Site <= 7.2.0 - Authenticated (Administrator+) Stored Cross-Site Scripting
• Mailjet Email Marketing <= 5.3 - Authenticated (Admin+) Cross-Site Scripting
• Ovatheme Events Manager <= 1.8.5 - Unauthenticated Arbitrary File Upload
• ACPT (Premium) <= 2.0.63 - Authenticated (Subscriber+) PHP Object Injection
• Heateor Social Login WordPress <= 1.1.32 - Authenticated (Contributor+) Stored Cross-Site Scripting
• Ad Inserter <= 2.8.16 - Missing Authorization to Unauthenticated Header/Footer Code Disclosure via 'ai-debug-code' Parameter
• Chaty Pro <= 3.5.8 - Unauthenticated Stored Cross-Site Scripting
• The Post Grid <= 7.4.3 - Authenticated (Editor+) Stored Cross-Site Scripting
• Gutensee <= 1.0.6 - Authenticated (Contributor+) Stored Cross-Site Scripting
• Shopwarden – Automated WooCommerce monitoring & testing <= 1.0.11 - Cross-Site Request Forgery to Arbitrary Options Update
• WP Count Down Timer <= 1.0.1 - Authenticated (Contributor+) Stored Cross-Site Scripting
• wpForo Forum < 1.4.12 - Reflected Cross-Site Scripting
• Seed Fonts 2.3.1 - Authenticated(Administrator+) Stored Cross-Site Scripting
• Frontend Admin by DynamiApps <= 3.28.7 - Authenticated (Editor+) Arbitrary File Deletion
• Share This Image <= 2.01 - Authenticated (Contributor+) Stored Cross-Site Scripting via alignment Parameter
• Social Share Buttons & Analytics Plugin <= 4.5 - Authenticated (Subscriber+) Stored Cross-Site Scripting via 'response' Parameter via gs_update_with_values AJAX
• Feed Them Social – for Twitter feed, Youtube and more <= 2.9.9 - Cross-Site Request Forgery to Settings update
• EPay.bg Payments <= 0.1 - Authenticated (Contributor+) Stored Cross-Site Scripting
• Uncode <= 2.9.1.6 - Authenticated (Subscriber+) Stored Cross-Site Scripting via mle-description
• WordPress Core <= 2.5.1 - Arbitrary File Upload
• AI ChatBot <= 4.6.0 - Authenticated (Administrator+) Stored Cross-Site Scripting
• NS Maintenance Mode for WP <= 1.3.1 - Unauthenticated Information Exposure
• All in One SEO <= 4.9.7 - Authenticated (Contributor+) Sensitive Information Exposure via 'internalOptions' Localized Script Data
• Just Custom Fields <= 3.3.2 - Missing Authorization via AJAX actions
• WordPress Core < 3.6.1 - Deserialization
• WordPress Core < 4.8.2 - Cross-Site Scripting via Javascript: and Data: URLs