Vulnerability archive: section 6, page 3

Open a report to review affected versions, available fixes and original sources. Each report covers a specific issue; its presence does not establish whether your website is affected.

• WP Hotjar <= 0.0.3 - Authenticated (Administrator+) Stored Cross-Site Scripting
• Premium Addons for Elementor <= 4.10.23 - Authenticated (Contributor+) Stored Cross-Site Scripting
• SUMO Affiliates Pro < 11.1.0 - Unauthenticated Arbitrary File Upload
• Lead Form Data Collection to CRM <= 3.0.1 - Authenticated (Contributor+) SQL Injection
• WP Profitshare <= 1.4.9 - Authenticated (Editor+) SQL Injection
• Smoke Signal < 1.2.7 - Authenticated Stored Cross-Site Scripting
• SupportCandy – Helpdesk & Support Ticket System <= 2.0.0 - Arbitrary File Upload
• AJAX Random Posts <= 0.3.3 - Unauthenticated PHP Object Injection
• SMS Alert – SMS Notifications & OTP Login, COD Verification, Abandoned Cart Recovery <= 4.0.0 - Unauthenticated Privilege Escalation
• Beaver Builder (Lite Version) <= 2.8.3.5 - Authenticated (Contributor+) Stored Cross-Site Scripting via type Parameter
• WordPress Core < 5.7.1 - Sensitive Information Disclosure
• HTML5 Video Player with Playlist <= 2.50 - Reflected Cross-Site Scripting
• Advanced Flamingo <= 1.0 - Cross-Site Request Forgery
• Hogwords | School, University Education WordPress Theme <= 1.2.7 - Unauthenticated PHP Object Injection
• Simple Owl Shortcodes <= 2.1.1 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'num' Shortcode Attribute
• Fancy Product Designer <= 4.7.4 - Admin+ SQL Injection
• Slider by Soliloquy <= 2.7.2 - Missing Authorization
• WPML < 3.1.8 - Authorization Bypass
• WP Mail Options <= 0.2.3 - Cross-Site Request Forgery to Stored Cross-Site Scripting
• Ninja Forms <= 3.6.25 - Denial of Service via Large Form Submissions
• Contact Form 7 Datepicker <= 2.6.0 - Authenticated Stored Cross-Site Scripting
• Google Map <= 2.2.5 - SQL Injection
• Block Bad Bots and Stop Bad Bots Crawlers and Spiders and Anti Spam Protection <= 10.23 - Missing Authorization to Information Expsoure
• Advanced Classifieds & Directory Pro <= 3.0.0 - Missing Authorization to Arbitrary Attachment Deletion
• WebTotem Backups < 1.1.0 - Authenticated (Subscriber+) Arbitrary File Deletion
• Pardakht Delkhah <= 2.9.8 - Cross-Site Request Forgery to Form Setting Reset
• WebinarIgnition <= 2.14.2 - Authenticated (Admin+) Stored Cross-Site Scripting
• Include Mastodon Feed <= 1.9.4 - Authenticated (Contributor+) Stored Cross-Site Scripting
• ProfileGrid <= 5.9.9.6 - Missing Authorization
• Easy WP SMTP <= 1.5.1 - Authenticated (Admin+) Remote Code Execution
• WP Custom Fields Search <= 1.2.34 - Authenticated (Administrator+) Stored Cross-Site Scripting
• WordPress Simple HTML Sitemap <= 3.1 - Authenticated (Admin+) SQL Injection
• 3CX Live Chat <= 9.4.2 - Local File Inclusion
• WP ULike <= 4.7.3 - Authenticated (Admin+) Stored Cross-Site Scripting
• Classified Listing – Classified ads & Business Directory Plugin <= 4.0.1 - Reflected Cross-Site Scripting
• Flex QR Code Generator <= 1.2.7 - Unauthenticated Arbitrary File Upload
• Ninja Charts <= 3.3.5 - Unauthenticated Information Exposure
• Walker Core <= 1.3.17 - Authenticated (Contributor+) Stored Cross-Site Scripting
• WPide <= 2.6 - Authenticated (Administrator+) Arbitrary File Read
• Epic Review <= 1.0.2 - Reflected Cross-Site Scripting
• Redirect Redirection <= 1.1.3 - Cross-Site Request Forgery via 'statusBulkEdit' function
• Single Post Exporter <= 1.1.1 - Cross-Site Request Forgery
• Custom Order Statuses for WooCommerce <= 1.5.2 - Cross-Site Request Forgery
• Download Manager <= 3.3.30 - Unauthenticated Cron Trigger due to Hardcoded Cron Key
• WPC Smart Messages for WooCommerce <= 4.2.8 - Authenticated (Contributor+) Stored Cross-Site Scripting
• User Profile Builder – Beautiful User Registration Forms, User Profiles & User Role Editor <= 3.15.5 - Insecure Direct Object Reference to Authenticated (Subscriber+) Arbitrary Post Author Reassignment via Avatar Field
• igumbi Online Booking <= 1.40 - Authenticated (Contributor+) Stored Cross-Site Scripting
• Blog Floating Button <= 1.4.20 - Unauthenticated Stored Cross-Site Scripting
• Autoptimize <= 2.7.7 - Unsafe File Upload to Cross-Site Scripting
• PostX <= 4.1.15 - Authenticated (Contributor+) Stored Cross-Site Scripting
• Featured product by category name <= 1.1 - Authenticated (Contributor+) Stored Cross-Site Scripting
• No Spam At All <= 1.3 - Missing Authorization
• Beaver Builder Page Builder <= 2.11.0.5 - Unauthenticated Arbitrary Shortcode Execution via Sidebar Module Widget Output
• HT Mega – Absolute Addons For Elementor <= 2.4.7 - Missing Authorization to Information Exposure
• WPBot Pro Wordpress Chatbot <= 13.5.4 - Unauthenticated Arbitrary File Upload
• WP Maps – Store Locator,Google Maps,OpenStreetMap,Mapbox,Listing,Directory & Filters <= 4.9.1 - Unauthenticated SQL Injection
• wpForo < = 1.5.1 - Privilege Escalation
• Easy US Sales Taxes Add-on for iThemes Exchange < 1.1.0 - Reflected Cross-Site Scripting
• Site Reviews <= 6.5.1 - Authenticated (Contributor+) Stored Cross-Site Scripting via shortcode
• Master Slider – Responsive Touch Slider <= 3.9.10 - Authenticated (Contributor+) Stored Cross-Site Scripting via ms_layer Shortcode
• Contact Form by FormGet <= 5.5.5 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode
• AWeber <= 7.3.9 - Missing Authorization via AJAX actions
• Photo Gallery, Sliders, Proofing and Themes – NextGEN Gallery <= 4.0.4 - Authenticated (Author+) Local File Inclusion
• Elementor Pro <= 2.0.9 - Cross-Site Scripting
• Password Protect WordPress Lite <= 1.9.21 - Authenticated (Contributor+) Stored Cross-Site Scripting
• Contact Form Builder, Contact Widget <= 2.1.7 - Authentication Request Bypass
• Equestrian Centre <= 1.5 - Unauthenticated PHP Object Injection
• Admin Menu Editor <= 1.14.1 - Cross-Site Request Forgery
• ExactMetrics <= 8.1.0 - Missing Authorization
• GeoDirectory <= 2.2.19 - CSV Injection
• Logo Showcase – Logo Slider, Carousel & Sponsors Gallery <= 4.0.4 - Authenticated (Contributor+) Stored Cross-Site Scripting
• BM Content Builder < 3.17.1 - Authenticated (Subscriber+) Arbitrary File Read
• EventON <= 2.1.7 - Authenticated (Admin+) HTML Injection
• Our Team Members <= 2.2 - Missing Authorization to Authenticated (Subscriber+) Information Disclosure
• Newsletters <= 4.15 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'link' Shortcode Attribute
• Quick Page/Post Redirect <= 5.2.3 - Authenticated (Administrator+) Stored Cross-Site Scripting via settings
• Dokan Pro <= 5.0.4 - Unauthenticated Privilege Escalation
• Image Optimizer, Resizer and CDN – Sirv <= 7.2.0 - Missing Authorization
• LH OGP Meta <= 1.73 - Cross-Site Request Forgery to Stored Cross-Site Scripting
• Polls CP <= 1.0.76 - Authenticated (Admin+) Stored Cross-Site Scripting
• My Wp Brand – Hide menu & Hide Plugin <= 1.1.2 - Missing Authorization
• Wallet System for WooCommerce – Wallet, Wallet Cashback, Refunds, Partial Payment, Wallet Restriction <= 2.6.2 - Missing Authorization
• PrettyLinks <= 3.6.20 - Authenticated (Administrator+) SQL Injection via 's' Parameter
• PhotoMe < 5.7.2 - Unauthenticated Server-Side Request Forgery
• Content Audit Exporter <= 1.1 - Unauthenticated Sensitive Information Exposure
• Series <= 2.0.1 - Authenticated (Contributor+) Stored Cross-Site Scripting
• UsersWP <= 1.2.63 - Insecure Direct Object Reference to Authenticated (Editor+) Arbitrary User Avatar/Banner Reset via 'user_id' Parameter
• Customify <= 0.4.11 - Cross-Site Request Forgery
• WP-chgFontSize <= 1.8 - Cross-Site Request Forgery to Settings Update and Stored Cross-Site Scripting
• Fluent Forms <= 6.2.1 - Authenticated (Administrator+) Arbitrary File Read via Path Traversal in Email Attachment
• ElementsKit Pro <= 3.6.6 - Authenticated (Contributor+) Sensitive Information Exposure
• BuddyPress <= 14.1.0 - Authenticated (Subscriber+) Directory Traversal
• Custom Admin Page by BestWebSoft <= 0.1.1 - Reflected Cross-Site Scripting
• Analytify – Google Analytics Dashboard For WordPress (GA4 analytics made easy) <= 5.2.3 - Cross-Site Request Forgery
• Advanced Category Template <= 0.1 - Stored Cross-Site Scripting via Cross-Site Request Forgery in _form.php
• Simply Schedule Appointments <= 1.6.12.23 - Cross-Site Request Forgery
• DASHBOARD BUILDER <= 1.5.7 - Cross-Site Request Forgery to SQL Injection
• Logo Manager For Enamad <= 0.7.0 - Cross-Site Request Forgery to Stored Cross-Site Scripting
• Make Section & Column Clickable For Elementor <= 2.4 - Authenticated (Editor+) Stored Cross-Site Scripting
• WC Price History for Omnibus <= 2.1.3 - Missing Authorization