Vulnerability archive: section 6, page 22

Open a report to review affected versions, available fixes and original sources. Each report covers a specific issue; its presence does not establish whether your website is affected.

• WP Job Portal <= 2.1.8 - Authenticated (Subscriber+) Insecure Direct Object Reference
• Data Tables Generator by Supsystic <= 1.9.99 - Time-Based Blind SQL Injection
• Unlimited Elements For Elementor (Free Widgets, Addons, Templates) <= 1.5.109 - Authenticated (Contributor+) Blind SQL Injection via data[addonID] Parameter
• Email Templates Customizer for WordPress – Drag And Drop Email Templates Builder – YeeMail <= 2.1.4 - Authenticated (Contributor+) Stored Cross-Site Scripting
• PT Sign Ups <= 1.0.4 - Unauthenticated Stored Cross-Site Scripting
• Like Button Rating ♥ LikeBtn < 2.6.32 - Server-Side Request Forgery
• Happy Addons for Elementor <= 3.21.0 - Insecure Direct Object Reference to Authenticated (Contributor+) Stored Cross-Site Scripting via Template Conditions
• WP Shortcodes Plugin — Shortcodes Ultimate <= 7.4.9 - Authenticated (Contributor+) Stored Cross-Site Scripting via su_box Shortcode
• Creator LMS – WordPress LMS Plugin for Coaches, Cohorts & Course Creators <= 1.2.21 - Missing Authorization
• Books Gallery – Book Showcase, Library & Affiliate Plugin <= 4.8.3 - Unauthenticated SQL Injection
• Contact Form DB <= 2.8.26 - Authenticated Cross-Site Scripting
• Gallery Bank – WordPress Photo Gallery <= 3.0.101 - SQL Injection
• CTX Feed <= 6.5.6 - Authenticated (Shop Manager+) Arbitrary Options Update
• Critique <= 1.17 - Unauthenticated Local File Inclusion
• Advanced Flat rate shipping Woocommerce <= 1.6.4.4 - Cross-Site Request Forgery via enableDisable and deletePost
• Ni WooCommerce Cost Of Goods <= 3.2.8 - Authenticated (Administrator+) SQL Injection
• RandomQuotr <= 1.0.4 - Authenticated (Admin+) Stored Cross-Site Scripting
• Easy Career Openings <= 0.4 - SQL Injection
• WP Import – Ultimate CSV XML Importer for WordPress <= 7.35 - Authenticated (Contributor+) Server-Side Request Forgery via Bitly Shortlink Bypass
• IP Vault – WP Firewall <= 1.1 - IP Address Spoofing to Protection Mechanism Bypass
• WPC Grouped Product for WooCommerce <= 4.4.2 - Missing Authorization
• Community by PeepSo – Social Network, Membership, Registration, User Profiles <= 6.4.5.0 - Authenticated (Administrator+) Stored Cross-Site Scripting via content Parameter
• Table Manager <= 1.0.0 - Authenticated (Contributor+) Sensitive Information Exposure via 'table' Shortcode Attribute
• Directory Kit <= 1.5.5 - Authenticated (Subscriber+) SQL Injection
• Kicker <= 2.2.0 - Unauthenticated Local File Inclusion
• Rank Math SEO <= 1.0.279 - Authenticated (Administrator+) SQL Injection
• Awesome Twitter Feeds <= 1.0 - Reflected Cross-Site Scripting
• ReviewX – WooCommerce Product Reviews with Multi-Criteria, Reminder Emails, Google Reviews, Schema & More <= 2.2.10 - Incorrect Authorization to Unauthenticated Information Exposure and Data Manipulation
• Gallery Blocks with Lightbox. Image Gallery, (HTML5 video , YouTube, Vimeo) Video Gallery and Lightbox for native gallery <= 3.2.4.2 - Authenticated (Editor+) Stored Cross-Site Scripting
• IMDB Info Box <= 2.0 - Stored Cross-Site Scripting
• Sticky Content <= 1.0.1 - Authenticated (Contributor+) Stored Cross-Site Scripting
• MultiVendorX <= 4.2.22 - Unauthenticated Information Exposure
• Document Embedder <= 1.7.8 - Subscriber+ Arbitrary Private/Draft Post Title Disclosure
• Recipe Card Blocks for Gutenberg & Elementor < 3.4.13 - Authenticated (Contributor+) SQL Injection
• Daiquiri <= 1.2.4 - Unauthenticated Local File Inclusion
• ProfileGrid <= 5.9.5.2 - Authenticated (Subscriber+) Server-Side Request Forgery
• WordPress File Upload <= 4.24.5 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode
• Frontend Post Submission Manager Lite – Frontend Posting WordPress Plugin <= 1.2.2 - Missing Authorization to Authenticated (Subscriber+) Settings Update
• Classified Listing – AI-Powered Classified ads & Business Directory Plugin <= 5.3.8 - Authenticated (Subscriber+) Arbitrary File Download
• Kama Click Counter <= 3.4.9 - Blind SQL Injection
• Safe SVG <= 2.5.0 - Authenticated (Contributor+) Stored Cross-Site Scripting
• UserHeat Plugin <= 1.1.10 - Cross-Site Request Forgery
• Glossary <= 3.1.2 - Missing Authorization
• S3bubble Amazon S3 Media Streaming <= 3.5.4 - Cross-Site Scripting
• Schema - All In One Schema Rich Snippets <= 1.6.5 - Cross-Site Request Forgery in rich_snippet_dashboard
• SIS Handball <= 1.0.45 - Cross-Site Request Forgery
• Greenshift – animation and page builder blocks <= 4.9.9 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode
• Complianz – GDPR/CCPA Cookie Consent <= 7.4.4.2 - Authenticated (Contributor+) Stored Cross-Site Scripting via Content Filter
• Ghost <= 1.4.0 - Unauthenticated Sensitive Information Exposure
• WP Tools <= 5.18 - Cross-Site Request Forgery to Arbitrary File Renaming
• GivingPress Lite <= 1.8.6 - Authenticated (Contributor+) Stored Cross-Site Scripting
• Blogger Buzz <= 1.2.6 - Authenticated (Contributor+) Stored Cross-Site Scripting
• Top Bar <= 3.3 - Missing Authorization
• Welcome Popup <= 1.0.10 - Authenticated (Administrator+) Stored Cross-Site Scripting
• WP Ultimate CSV Importer <= 6.5.2 - Server-Side Request Forgery
• Booking Hub - AI-Powered Scheduling, Reservation and Appointment System for WordPress <= 1.3.0 - Authenticated (Subscriber+) Privilege Escalation
• User Activation Email <= 1.3.0 - Reflected Cross-Site Scripting
• Custom Content Shortcode <= 4.0.2 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode
• Wordpress Header Builder Plugin <= 1.3.8 - Cross-Site Request Forgery to Header Deletion
• Total Contest Lite <= 2.8.1 - Reflected Cross-Site Scripting
• MasterStudy LMS <= 3.7.49 - Unauthenticated (Subscriber+) Unauthorized Course Enrollment
• Seriously Simple Podcasting <= 2.16.0 - Cross-Site Request Forgery
• WP ULike < 3.2 - Cross-Site Scripting
• GPS Plotter <= 5.3.0 - Authenticated (Administrator+) Stored Cross-Site Scripting
• GD Rating System <= 2.3 - Cross-Site Scripting
• WP Shortcode by MyThemeShop <= 1.4.17 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'title' Shortcode Attribute
• Beaver Builder Addons by WPZOOM <= 1.3.5 - Authenticated (Editor+) Local File Inclusion
• Page and Post Restriction <= 1.4.1 - Unauthenticated Missing Authorization to Sensitive Information Exposure via REST API
• Ninja Tables Pro <= 5.0.17 - Authenticated (Contributor+) Stored Cross-Site Scripting
• PublishPress Revisions: Duplicate Posts, Submit, Approve and Schedule Content Changes <= 3.5.15 - Missing Authorization to Authenticated (Subscriber+) Sensitive Information Exposure
• Are you robot google recaptcha for wordpress <= 2.2 - Reflected Cross-Site Scripting
• Robo Gallery <= 3.2.12 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcodes
• BulletProof Security <= 5.1 - Sensitive Information Disclosure
• Football Pool <= 2.11.10 - Authenticated (Editor+) Stored Cross-Site Scripting
• FG Drupal to WordPress <= 3.67.0 - Cross-Site Request Forgery via ajax_importer
• WP Image Uploader <= 1.0.1 - Cross-Site Request Forgery to Arbitrary File Deletion
• Countdown & Clock <= 2.8.8 - Authenticated (Contributor+) Remote Code Execution
• 777 <= 1.3 - Unauthenticated Local File Inclusion
• Post, Registration and Profile Form Builder – FrontEnd Editor BuddyForms – Easy WordPress Forms <= 2.2.7 - SQL Injection
• Drag and Drop Multiple File Upload for Contact Form 7 < 1.3.9.9 - Unauthenticated Remote Code Execution
• Houzez Theme - Functionality <= 4.2.6 - Authenticated (Contributor+) Stored Cross-Site Scripting
• Contact Form Widget – Contact Query, Contact Page, Form Maker, Query Table <= 1.3.8 - Authenticated (Admin+) SQL Injection
• WP Review Slider Pro <= 12.7.2 - Unauthenticated SQL Injection via 'notinstring' Parameter
• SureCart <= 4.9.4 - Unauthenticated Stored Cross-Site Scripting via sc-cart-loader 'template' Attribute in Comment
• WordPress File Upload < 2.7.1 - Arbitrary File Upload
• WP-Piwik <= 1.0.27 - Authenticated (Administrator+) Stored Cross-Site Scripting via Plugin Display Name
• Order Export & Order Import for WooCommerce <= 2.6.0 - Directory Traversal to Authenticated (Administrator+) Limited Arbitrary File Deletion via admin_log_page Function
• Awesome Support <= 6.1.5 - Missing Authorization via wpas_load_reply_history
• VOD Infomaniak <= 1.5.9 - Missing Authorization
• Events Manager < 5.5.7 - Cross-Site Scripting
• WP Add Active Class To Menu Item <= 1.0 - Cross-Site Request Forgery
• WPLingo – Forum Plugin <= 1.1.2 - Missing Authorization to Authenticated (Subscriber+) Arbitrary Content Deletion
• Gum Elementor Addon <= 1.3.10 - Authenticated (Contributor+) Stored Cross-Site Scripting
• Dashboard Welcome for Beaver Builder <= 1.0.8 - Missing Authorization
• OptinMonster <= 2.6.4 - Unprotected REST-API Endpoints
• WordPress Core < 2.2.3 & WordPress MU < 1.2.5a - SQL Injection
• Jetpack <= 13.7 - Unauthenticated Arbitrary Block & Shortcode Execution
• Kento Ads Rotator <= 1.3 - Authenticated (Contributor+) Stored Cross-Site Scripting
• WP Like Button <= 1.6.0 - Missing Authorization
• WP Tools <= 5.24 - Cross-Site Request Forgery