Vulnerability archive: section 6, page 25

Open a report to review affected versions, available fixes and original sources. Each report covers a specific issue; its presence does not establish whether your website is affected.

• WooCommerce Customers Manager < 30.1 - Cross-Site Request Forgery to Customer Deletion via 'Delete'
• LA-Studio Element Kit for Elementor <= 1.3.8.1 - Authenticated (Contributor+) Local File Inclusion
• Spectra <= 2.7.9 - Authenticated (Contributor+) Stored Cross-Site Scripting
• Slider by 10Web – Responsive Image Slider <= 1.2.63 - Unauthenticated Stored Cross-Site Scripting
• wpDataTables (Premium) <= 6.5.1.4 - Unauthenticated Stored Cross-Site Scripting
• Feed Them Social <= 1.6.9 - Reflected Cross-Site Scripting
• WP Mail Logging <= 1.15.0 - Unauthenticated PHP Object Injection via Email Log Message Field
• Photo Gallery, Sliders, Proofing and Themes – NextGEN Gallery <= 3.59.8 - Authenticated (Admin+) Stored Cross-Site Scripting
• Drag and Drop Multiple File Upload - Contact Form 7 <= 1.3.3.2 - Arbitrary File Upload
• immonex Kickstart Team <= 1.6.9 - Authenticated (Contributor+) Local File Inclusion
• Responsive <= 5.0.3 - Authenticated (Contributor+) Stored Cross-Site Scripting
• The Post Grid <= 7.2.7 - Cross-Site Request Forgery
• Require & Limit Categories, Tags, Featured Image and taxonomies <= 1.26 - Reflected Cross-Site Scripting
• Relevanssi <= 4.24.4 (Free) and <= 2.27.5 (Premium) - Unauthenticated SQL Injection
• Bricks <= 1.8.1 - Cross-Site Request Forgery via reset_settings
• User Registration & Membership <= 5.1.4 - Missing Authorization to Authenticated (Contributor+) Content Access Rule Manipulation
• Video Embed Optimizer <= 1.0.0 - Authenticated (Contributor+) Stored Cross-Site Scripting
• List category posts <= 0.95.0 - Missing Authorization to Authenticated (Contributor+) Sensitive Information Exposure via 'post_status' Shortcode Attribute
• SendPulse Email Marketing Newsletter <= 2.2.5 - Authenticated (Contributor+) Stored Cross-Site Scripting via _sp_form_code Post Meta
• WP Stripe Checkout <= 1.2.2.37 - Sensitive Information Exposure via Debug Log
• Media Library Assistant <= 3.29 - Unauthenticated Limited File Read
• Materialis Companion <= 1.3.39 - Authenticated (Contributor+) Stored Cross-Site Scripting
• Image Slider <= 1.1.130 - Authenticated (Contributor+) Stored Cross-Site Scripting
• BJ Lazy Load <= 1.0.9 - Authenticated (Contributor+) Stored Cross-Site Scripting via Custom HTML Block
• Storyform <= 0.6.14 - Reflected Cross-Site Scripting
• Gutenberg Blocks and Page Layouts – Attire Blocks <= 1.9.2 - Missing Authorization
• Formidable Form Builder <= 5.5.4 - Cross-Site Request Forgery
• Yet Another Countdown <= 1.0.1 - Authenticated (Contributor+) Stored Cross-Site Scripting
• Click to Chat – HoliThemes <= 3.35 - Authenticated (Contributor+) Local File Inclusion
• Time Slots Booking Form <= 1.2.39 - Missing Authorization
• Small Package Quotes – Worldwide Express Edition <= 5.2.18 - Unauthenticated SQL Injection
• kk Youtube Video <= 0.2 - Authenticated (Contributor+) Stored Cross-Site Scripting
• WooCommerce Report <= 1.4.5 - Reflected Cross-Site Scripting
• Super Store Finder <= 7.6 - Reflected Cross-Site Scripting
• Social Media Share Buttons & Social Sharing Icons <= 2.9.0 - Authenticated (Admin+) Stored Cross-Site Scripting
• Max Addons Pro for Bricks <= 1.6.1 - Missing Authorization
• MapSVG <= 8.7.3 - Authenticated (Contributor+) Arbitrary File Upload
• Paid Membership Plugin, Ecommerce, User Registration Form, Login Form, User Profile & Restrict Content – ProfilePress <= 4.17.3 - Missing Authorization
• JobSearch WP Job Board <= 3.2.0 - Reflected Cross-Site Scripting
• Sitewide Notice WP <= 2.4.1 - Missing Authorization
• Simple Download Counter <= 2.0 - Authenticated (Author+) Arbitrary File Read
• WpCues Basic Quiz <= 1.6.5 - Unauthenticated SQL Injection
• Fediverse Embeds <= 1.5.7 - Unauthenticated Server-Side Request Forgery
• NEX-Forms – Ultimate Form Builder <= 8.7.8 - Authenticated (Administrator+) SQL Injection
• Awin Data Feed <= 1.7 - Unauthenticated Stored Cross-Site Scripting
• Orbit Fox Companion <= 3.0.2 - Authenticated (Author+) Stored Cross-Site Scripting via Post Taxonomy
• Rearrange Woocommerce Products <= 3.0.7 - Subscriber+ SQL Injection
• Lighthouse <= 1.2.12 - Unauthenticated Local File Inclusion
• Live Chat from ClickDesk – Live Chat – Help Desk Plugin for Websites <= 4.3 - Cross-Site Scripting
• WooCommerce Customers Manager <= 29.7 - Reflected Cross-Site Scripting
• Event Tickets <= 5.20.0 - Reflected Cross-Site Scripting
• Reviews Feed – Add Testimonials and Customer Reviews From Google Reviews, Yelp, TripAdvisor, and More <= 1.1.2 - Cross-Site Request Forgery
• Forminator Forms – Contact Form, Payment Form & Custom Form Builder <= 1.38.2 - Authenticated (Admin+) Stored Cross-Site Scripting
• Backend Localization <= 2.0 - Reflected Cross-Site Scripting
• LatePoint <= 5.6.0 - Cross-Site Request Forgery via invoices__change_status Action
• Adwised Web Push Notification <= 2.5.7 - Authenticated (Subscriber+) Stored Cross-Site Scripting
• AI ChatBot with ChatGPT and Content Generator by AYS <= 2.7.5 - Missing Authorization to Unauthenticated API Key Modification
• Mancx AskMe Widget <= 0.3 - Reflected Cross-Site Scripting
• Ultimate WP Mail <= 1.3.4 - Authenticated (Contributor+) SQL Injection
• Buttoner for Elementor <= 1.0.6 - Missing Authorization to Authenticated (Subscriber+) Settings Change
• Ultimate Affiliate Pro <= 3.9 - Authenticated Stored Cross-Site Scripting
• Google XML Sitemaps Generator < 3.2.9 - Authenticated (Admin+) PHP Code Injection
• Animated Number Counters <= 3.0 - Authenticated (Editor+) SQL Injection
• Podcast Importer SecondLine <= 1.1.4 - Server-Side Request Forgery
• Client Invoicing by Sprout Invoices – Easy Estimates and Invoices <= 20.8.1 - Missing Authorization
• LH QR Codes <= 1.06 - Authenticated (Contributor+) Stored Cross-Site Scripting
• Simple Payment Donations <= 4.2.0 - Unauthenticated Stored Cross-Site Scripting
• Rank Math SEO – AI SEO Tools to Dominate SEO Rankings < 1.0.277 - Missing Authorization
• WordPress RokBox <= 2.13 - Sensitive Data Disclosure
• Greenshift <= 10.8 - Authenticated (Contributor+) Stored Cross-Site Scripting
• ShortPixel Adaptive Images – WebP, AVIF, CDN, Image Optimization <= 3.11.3 - Authenticated (Subscriber+) Stored Cross-Site Scripting
• Academy LMS – WordPress LMS Plugin for Complete eLearning Solution <= 3.3.8 - Authenticated (Administrator+) PHP Object Injection via 'import_all_courses'
• External Database Based Actions <= 0.1 - Authenticated (Subscriber+) Authentication Bypass
• FAQs Manager <= 1.0 - SQL Injection
• WordPress Core < 4.8.2 - Stored Cross-Site Scripting via Plugin Names
• WP Bannerize Pro <= 1.6.9 - Reflected Cross-Site Scripting
• Mantenimiento web <= 0.8 - Cross-Site Request Forgery
• E2Pdf – Export To Pdf Tool for WordPress <= 1.20.27 - Missing Authorization
• MultiParcels Shipping For WooCommerce <= 1.15.3 - Reflected Cross-Site Scripting
• Ship Per Product <= 2.1.0 - Missing Authorization
• Food < 2.7.1 - Missing Authorization
• Relevanssi Premium < 1.14.6.1 - SQL Injection
• Appointment Booking Calendar < 1.3.19 - Cross-Site Scripting
• Mail Control <= 0.2.8 - Unauthenticated Stored Cross-Site Scripting via Email Subject
• Virtual Robots.txt < 1.10 - Authenticated Stored Cross-Site Scripting
• WP Cerber Security <= 9.3.2 - User Enumeration Bypass via REST API
• WP STAGING <= 3.4.3 and WP STAGING Pro <= 5.4.3 - Sensitive Information Exposure via Log File
• Cool Author Box <= 2.9.9 - Missing Authorization
• WP SMS <= 6.6.2 - Cross-Site Request Forgery
• Coupons & Add to Cart by URL Links for WooCommerce <= 1.7.7 - Authenticated (Contributor+) Stored Cross-Site Scripting
• Form Maker by 10Web – Mobile-Friendly Drag & Drop Contact Form Builder <= 1.15.46 - Unauthenticated Stored Cross-Site Scripting
• For the visually impaired <= 0.58 - Cross-Site Request Forgery to Plugin Settings Changes
• CIBELES AI <= 1.10.8 - Unauthenticated Arbitrary File Upload
• ListingPro <= 2.9.4 - Authenticated (Subscriber+) Local File Inclusion
• Perfect Survey <= 1.5.2 - Reflected Cross-Site Scripting
• WPBakery Visual Composer WHMCS Elements <= 1.0.4.1 - Authenticated (Contributor+) Stored Cross-Site Scripting
• Legacy Admin <= 9.5 - Reflected Cross-Site Scripting
• Click Mag - Viral WordPress News Magazine/Blog Theme <= 3.6.0 - Missing Authorization to Authenticated (Subscriber+) Arbitrary Options Deletion
• Import and export users and customers <= 1.14.0.2 - Cross-Site Scripting
• WP Reroute Email <= 1.4.6 - Cross-Site Request Forgery