Vulnerability archive: section 6, page 20

Open a report to review affected versions, available fixes and original sources. Each report covers a specific issue; its presence does not establish whether your website is affected.

• MasterStudy LMS WordPress Plugin – for Online Courses and Education <= 3.7.14 - Insecure Direct Object Reference to Authenticated (Instructor+) Arbitrary Attachment Deletion
• Download Monitor <= 4.8.1 - Authenticated (Admin+) Server-Side Request Forgery
• WP YouTube Lyte <= 1.7.15 - Authenticated (Admin+) Cross-Site Scripting
• JetEngine <= 3.8.13.1 - Unauthenticated Stored Cross-Site Scripting
• Chart Expert <= 1.0 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode
• Author Box After Posts <= 1.6 - Authenticated (Contributor+) Stored Cross-Site Scripting
• EventCalendar <= 1.1.21 - Cross-Site Scripting
• Fast Custom Social Share by CodeBard <= 1.1.1 - Authenticated (Administrator+) Stored Cross-Site Scripting
• WordPress Core < 4.7.2 - Authenticated SQL Injection
• VikBooking Hotel Booking Engine & PMS <= 1.5.12 - Cross-Site Request Forgery in admin_widgets_welcome function
• Forminator Forms <= 1.57.2 - Unauthenticated Stored Cross-Site Scripting via Rich-Text Textarea Field
• TopFit - Fitness and Gym WordPress <= 1.9 - Unauthenticated Local File Inclusion
• Hotel Galaxy <= 4.4.24 - Authenticated (Contributor+) Stored Cross-Site Scripting
• Advanced scrollbar <= 1.1.8 - Authenticated (Subscriber+) Privilege Escalation
• Tribulant Gallery Voting <= 1.2.1 - Cross-Site Request Forgery to Stored Cross-Site Scripting
• Cart Weight for WooCommerce <= 1.9.11 - Missing Authorization
• Skrill Official <= 1.0.66 - Cross-Site Request Forgery
• Simple Image Popup <= 2.4.0 - Authenticated (Admin+) Stored Cross-Site Scripting
• Online Scheduling and Appointment Booking System – Bookly <= 26.7 - Reflected Cross-Site Scripting
• Media Library Folders <= 8.1.7 - Authenticated (Author+) SQL Injection
• MarketPress <= 3.2.6 - Unauthenticated PHP Object Injection
• List categories <= 0.4 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode
• Bulk Edit Post Titles <= 5.0.0 - Missing Authorization
• Strong Testimonials <= 3.0.2 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode
• Wallet for WooCommerce <= 1.5.6 - Authenticated (Subscriber+) Incorrect Conversion between Numeric Types
• Simple URLs <= 114 - Authenticated (Subscriber+) SQL Injection
• OTP Login & Register Woocommerce <= 2.7.3 - Authenticated (Administrator+) Stored Cross-Site Scripting via 'fb-config' Setting
• Esmée <= 1.4 - Unauthenticated PHP Object Injection
• SP Project & Document Manager <= 4.71 - Missing Authorization to Unauthenticated Arbitrary File Information Disclosure via view_file() Function
• WP Sliding Login/Dashboard Panel <= 2.1.1 - Cross-Site Request Forgery to Settings Update
• Ach Invoice App <= 1.0.1 - Unauthenticated Local File Inclusion
• Product Table by WBW <= 2.1.2 - Unuthenticated SQL Injection
• AnWP Football Leagues <= 0.16.17 - Authenticated (Administrator+) CSV Injection
• Fruitful < 3.8.2 - Stored Cross-Site Scripting
• Multiple Themify Themes <= Various Versions - Authenticated (Contributor+) Arbitrary File Upload
• SEO, Nutrition and Print for Recipes by Edamam <= 3.3 - Cross-Site Request Forgery to Stored Cross-Site Scripting
• Tasty Recipes Lite <= 1.1.5 - Missing Authorization
• WP Table Builder – WordPress Table Plugin <= 1.3.9 - Reflected Cross-Site Scripting
• Multiple Roles < 1.3.7 - Privilege Escalation
• Sina Extension for Elementor (Slider, Gallery, Form, Modal, Data Table, Tab, Particle, Free Elementor Widgets & Elementor Templates) <= 3.5.2 - Authenticated (Contributor+) Stored Cross-Site Scripting via Sina Fancy Text Widget
• Alliance | Intranet & Extranet BuddyPress WordPress Theme <= 3.11 - Unauthenticated PHP Object Injection
• Contact Form by Bit Form <= 2.18.3 - Authenticated (Author+) Stored Cross-Site Scripting via SVG File Upload
• Dynamic "To Top" 3.5.2 - Authenticated (Administrator+) Stored Cross-Site Scripting
• WP Discord Invite <= 2.5.3 - Authenticated (Administrator+) Stored Cross-Site Scripting
• Beautiful Cookie Consent Banner <= 4.6.1 - Reflected Cross-Site Scripting
• Grand Magazine <= 3.5.7 - Reflected Cross-Site Scripting
• EWWW Image Optimizer <= 8.7.7 - Authenticated (Contributor+) Stored Cross-Site Scripting
• WP Activity Log Premium <= 4.5.0 - Missing Authorization via ajax_switch_db
• WP Popup Builder – Popup Forms and Marketing Lead Generation <= 1.3.5 - Unauthenticated Arbitrary Shortcode Execution via wp_ajax_nopriv_shortcode_Api_Add
• Exclusive Addons for Elementor <= 2.7.9.1 - Authenticated (Contributor+) Stored Cross-Site Scripting via Countdown Timer Widget
• Simple Popup Plugin <= 4.5 - Authenticated (Contributor+) Stored Cross-Site Scripting
• Name Directory <= 1.30.0 - Missing Authorization
• DoFollow Case by Case <= 3.6.0 - Unauthenticated Stored Cross-Site Scripting via Comment Content
• MainWP Dashboard – The Private WordPress Manager for Multiple Website Maintenance Plugin <= 3.1.2 - Stored Cross-Site Scripting
• Medical Addon for Elementor <= 1.6.1 - Authenticated (Contributor+) Stored Cross-Site Scripting
• WP Job Portal <= 2.2.2 - Authenticated (Admin+) SQL Injection via getFieldsForVisibleCombobox()
• hpb seo plugin for WordPress <= 3.0.1 - Reflected Cross-Site Scripting
• Progress Bar Blocks for Gutenberg <= 1.0.0 - Authenticated (Author+) Stored Cross-Site Scripting via SVG
• Wp Ultimate Review <= 2.2.5 - Unauthenticated Review Restriction Bypass
• Advance Search for WooCommerce < 1.1 - Cross-Site Scripting
• WP QuickLaTeX <= 3.8.8 - Unauthenticated Stored Cross-Site Scripting
• AI Chatbot & Workflow Automation by AIWU <= 1.4.12 - Missing Authorization to Unauthenticated Arbitrary Modification via 'publishTasks' and 'unpublishTasks' AJAX Actions
• ELEX WordPress HelpDesk & Customer Ticketing System <= 3.2.6 - Missing Authorization to Authenticated (Subscriber+) Privilege Escalation
• Royal MCP – Secure AI Connector for Claude, ChatGPT & Gemini <= 1.4.25 - Missing Authorization
• Structured Content <= 1.6.4 - Authenticated (Contributor+) Stored Cross-Site Scripting via sc_fs_local_business Shortcode
• Simple Social Media Share Buttons <= 5.4.0 - Authenticated (Administrator+) Stored Cross-Site Scripting
• Usersnap <= 4.16 - Authenticated (Admin+) Stored Cross Site Scripting
• UiPress lite <= 3.5.09 - Missing Authorization to Authenticated (Subscriber+) Sensitive Information Exposure
• SKT Addons for Elementor <= 1.8 - Authenticated (Contributor+) Stored Cross-Site Scripting via Countdown Block
• 3dady real-time web stats <= 1.0 - Authenticated (Administrator+) Stored Cross Site Scripting
• Ninja Forms Contact Form <= 3.2.13 - Cross-Site Scripting
• Sliced Invoices – WordPress Invoice Plugin <= 3.8.2 - Authenticated (Contributor+) SQL Injection
• WP Options Editor <= 1.1 - Cross-Site Request Forgery to Privilege Escalation
• Multi Rating <= 5.0.5 - Unauthenticated Stored Cross-Site Scripting
• Essential Addons for Elementor – Best Elementor Templates, Widgets, Kits & WooCommerce Builders <= 5.8.15 - Authenticated (Contributor+) Stored Cross-Site Scripting via Lightbox and Modal Widget
• Product Feed PRO for WooCommerce by AdTribes – Product Feeds for WooCommerce 13.4.6 - 13.5.2.1 - Cross-Site Request Forgery to Multiple Administrative Actions
• Orbit Fox by ThemeIsle <= 2.10.44 - Authenticated (Contributor+) Stored Cross-Site Scripting
• Payment Forms for Paystack <= 4.0.5 - Authenticated (Subscriber+) Information Exposure
• Houzez <= 4.1.1 - Missing Authorization
• Elementor Website Builder <= 2.9.2 - Stored Cross-Site Scripting
• Geo Mashup <= 1.13.13 - Authenticated (Contributor+) Stored Cross-Site Scripting via geo_mashup_visible_posts_list Shortcode
• The Next <= 1.1.0 - Authenticated (Contributor+) PHP Object Injection
• Sidebar Adder 2 <= 2.0.0 - Reflected Cross-Site Scripting
• Custom Admin Interface <= 7.40 - Missing Authorization
• GravityForms 2.9.0.1 - 2.9.1.3 - Unauthenticated Stored Cross-Site Scripting via 'style_settings' parameter
• Booking & Appointment Plugin for WooCommerce <= 6.9.0 - Authenticated (Subscriber+) Arbitrary Option Update
• Zephyr Project Manager <= 3.3.9 - Open Redirect
• Easy Pricing Tables <= 3.1.2 - Author+ Stored Cross-Site Scripting
• PWA for WP & AMP < = 1.7.32 - Missing Authorization
• WP Show Posts <= 1.1.4 - Information Exposure
• Awesome Gallery <= 1.0 - Authenticated (Contributor+) Stored Cross-Site Scripting
• The E-Commerce ERP <= 2.1.1.3 - Unauthenticated Privilege Escalation
• Post Snippets <= 4.0.19 - Authenticated (Administrator+) Stored Cross-Site Scripting via Import
• Migration, Backup, Staging – WPvivid <= 0.9.74 - Authenticated (Admin+) PHAR Deserialization
• Multi-page Toolkit <= 2.6 - Cross-Site Request Forgery
• wpDiscuz <= 7.6.42 - Unauthenticated Insecure Direct Object Reference
• Chat Button <= 1.8.9.4 - Authenticated (Administrator+) Stored Cross-Site Scripting via plugin settings
• WP Gravity Forms Salesforce <= 1.4.7 - Open Redirect
• Responsive Blocks <= 1.9.9 - Authenticated (Contributor+) Stored Cross-Site Scripting
• Meta Box – WordPress Custom Fields Framework <= 5.9.2 - Authenticated (Contributor+) Stored Cross-Site Scripting