Vulnerability archive: section 6, page 4

Open a report to review affected versions, available fixes and original sources. Each report covers a specific issue; its presence does not establish whether your website is affected.

• xili-language <= 2.21.2 - Reflected Cross-Site Scripting
• Responsive Blocks – WordPress Gutenberg Blocks <= 1.8.8 - Authenticated (Contributor+) Stored Cross-Site Scripting
• ElementsKit Elementor addons <= 3.0.5 - Authenticated (Contributor+) Stored Cross-Site Scripting via Image Accordion Widget
• weForms – Easy Drag & Drop Contact Form Builder For WordPress <= 1.6.17 - Authenticated (Admin+) Stored Cross-Site Scripting
• Polls CP < 1.0.1 - Cross-Site Scripting
• Mobile App Builder by WapPress <= 1.05 - Arbitrary File Upload
• Varnish/Nginx Proxy Caching <= 1.8.3 - Unauthenticated Information Exposure
• Geolocation IP Detection <= 5.5.0 - Authenticated (Contributor+) Stored Cross-Site Scripting
• NEX-Forms – Ultimate Form Builder – Contact forms and much more <= 8.5.6 - Missing Authorization via restore_records()
• Magic Conversation For Gravity Forms <= 3.0.97 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode Attributes
• Fluent Forms – Customizable Contact Forms, Survey, Quiz, & Conversational Form Builder < 6.2.6 - Authenticated (Contributor+) Stored Cross-Site Scripting
• Info Boxes Shortcode and Widget <= 1.15 - Cross-Site Request Forgery
• Post Grid, Form Maker, Popup Maker, WooCommerce Blocks, Post Blocks, Post Carousel <= 2.2.74 - Information Exposure
• Compact Archives <= 4.1.0 - Authenticated (Contributor+) Stored Cross-Site Scripting
• Envira Photo Gallery <= 1.8.7.3 - Cross-Site Request Forgery to Notice Dismissal
• Page Takeover <= 1.1.6 - Authenticated (Administrator+) Stored Cross-Site Scripting
• Content Manager Light <= 3.2 - Authenticated (Contributor+) Stored Cross-Site Scripting
• ConvertForce Popup Builder <= 0.0.7 - Stored Cross-Site Scripting via entrance_animation
• WPCOM Member <= 1.7.27 - Unauthenticated Authentication Bypass via 'uuid' and 'code' Parameters on Social-Login Callback
• DirectoryPress Frontend <= 2.7.9 - Cross-Site Request Forgery to Listing Status Update
• JiangQie Official Website Mini Program <= 1.8.2 - Authenticated (Administrator+) SQL Injection
• Build App Online <= 1.0.21 - Authentication Bypass via Header
• Paid Videochat Turnkey Site – HTML5 PPV Live Webcams <= 7.2.16 - Unauthenticated Arbitrary File Deletion
• Plugin LBstopattack <= 1.1.2 - Cross-Site Request Forgery
• SAML Single Sign On <= 5.4.4 - Unauthenticated Authentication Bypass via SAMLResponse Parameter
• EditorsKit <= 1.40.3 - Authenticated (Administrator+) Arbitrary File Upload
• WP Activity Log <= 5.6.3.1 - Unauthenticated PHP Object Injection
• PT Project Notebooks 1.0.0 - 1.1.3 - Missing Authorization to Unauthenticated Privilege Escalation via wpnb_pto_new_users_add Function
• Barcode Scanner (+Mobile App) <= 1.11.0 - Unauthenticated Privilege Escalation via Insecure Token Authentication
• If-So Dynamic Content – Elementor & All Page Builders Personalization <= 1.10.1 - Unauthenticated Stored Cross-Site Scripting
• JobZilla - Job Board WordPress Theme <= 2.0 - Cross-Site Request Forgery
• Bold Timeline Lite <= 1.2.7 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'title' Parameter in 'bold_timeline_group' Shortcode
• Stylish Cost Calculator < 7.9.0 - Unauthenticated Stored Cross-Site Scripting
• Do Lasso <= 358 - Authenticated (Subscriber+) SQL Injection
• WPForms Pro <= 2.0.0.2 - Unauthenticated Stored Cross-Site Scripting via Single Line Text and Paragraph Text Field Values
• Getwid <= 2.1.3 - Authenticated (Contributor+) Stored Cross-Site Scripting via Google Maps 'customStyle'
• Simple Link List Widget <= 0.3.2 - Authenticated (Administrator+) Stored Cross-Site Scripting
• Really Simple Google Tag Manager <= 1.0.6 - Cross-Site Request Forgery via plugin_activation
• Image Slider by Ays- Responsive Slider and Carousel < 2.5.0 - SQL Injection
• YaySMTP – Simple WP SMTP Mail <= 2.2 - Sensitive Information Disclosure
• Coworking <= 1.6.1 - Unauthenticated Local File Inclusion
• Slimstat Analytics <= 5.2.6 - Unauthenticated Stored Cross-Site Scripting
• Featured Image from URL (FIFU) <= 5.2.7 - Unauthenticated Information Exposure via Log File
• WPCS – WordPress Currency Switcher Professional <= 1.1.9 - Missing Authorization to Custom Drop-Down Currency Switcher Creation
• WP GeoNames <= 1.9.0.1 - Authenticated (Contributor+) Stored Cross-Site Scripting
• SimpleForm <= 3.10.0 - Unauthenticated Privilege Escalation to wp_capabilities Mass Assignment via simpleform_wp_register
• Autoship Cloud for WooCommerce Subscription Products <= 2.17.1 - Missing Authorization
• Change WP Admin Login <= 1.0.9 - Missing Authorization Checks
• WP Statistics <= 14.16.14 - Reflected Cross-Site Scripting via REQUEST_URI Query-Parameter Key
• Post and Page Builder by BoldGrid – Visual Drag and Drop Editor <= 1.26.6 - Authenticated (Contributor+) Stored Cross-Site Scripting via File Upload
• SEO For Images <= 1.0.0 - Cross-Site Request Forgery
• FV Flowplayer Video Player <= 7.5.41.7212 - Authenticated (Contributor+) Stored Cross-Site Scripting
• Backup and Restore WordPress WordPress <= 1.45 - Unauthenticated Information Exposure via Log Files
• Quiz Expert – Easy Quiz Maker, Exam and Test Manager <= 1.5.0 - Cross-Site Request Forgery
• TrueBooker <= 1.2.3 - Missing Authorization to Unauthenticated Arbitrary Password Reset via 'tbab-userid'
• Interactive SVG Image Map Builder <= 1.0 - Authenticated(Admin+) Stored Cross-Site Scripting
• Webhooks <= 3.3.8 - Authenticated (Administrator+) PHP Object Injection
• Barcode Scanner with Inventory & Order Manager <= 1.5.4 - Unauthenticated Information Exposure
• DJ Rainflow <= 1.3.13 - Unauthenticated Local File Inclusion
• Nexi XPay Build 7.0.0 - 7.6.2 - Missing Authorization
• Simple Membership <= 3.3.2 - Multiple Cross-Site Request Forgery
• Legal Pages <= 1.4.2 - Cross-Site Request Forgery
• EntreDroppers <= 1.1.2 - Reflected Cross-Site Scripting via PHP_SELF Parameter
• WP TripAdvisor Review Slider <= 11.8 - Authenticated (Admin+) Stored Cross-Site Scripting
• Business Directory Plugin – Easy Listing Directories for WordPress <= 5.11.1 - Cross-Site Request Forgery to Arbitrary Listing Export
• Shield Security <= 17.0.17 - Missing Authorization
• Herd Effects <= 5.2.2 - Authenticated (Administrator+) Stored Cross-Site Scripting
• Coming Soon, Under Construction & Maintenance Mode By Dazzler <= 2.1.2 - Maintenance Mode Bypass
• Insert or Embed Articulate Content into WordPress < 4.2999 - Arbitrary File Upload
• Bug Library <= 2.1.4 - Authenticated (Contributor+) SQL Injection
• Ps Ads Pro <= 1.0.0 - Reflected Cross-Site Scripting
• Tabs Responsive <= 2.2.7 - Editor+ Stored Cross-Site Scripting
• CRM Memberships <= 2.2 - Authenticated (Administrator+) Stored Cross-Site Scripting via plugin settings
• Private Messages For WordPress <= 2.1.10 - Cross-Site Request Forgery
• WP Job Portal – AI-Powered Recruitment System for Company or Job Board website <= 2.5.2 - Authenticated (Contributor+) SQL Injection
• New Adman <= 1.6.8 - Authenticated (Administrator+) Stored Cross-Site Scripting
• Ray Enterprise Translation <= 1.7.1 - Unauthenticated Local File Inclusion
• GiveWP – Donation Plugin and Fundraising Platform <= 3.13.0 - Missing Authorization to Limited Information Exposure
• FundEngine <= 1.8.1 - Missing Authorization to Authenticated (Subscriber+) Arbitrary Post Modification via 'campaign_post' Parameter
• Fiverr.com Official Search Box <= 1.0.8 - Authenticated (Subscriber+) Stored Cross-Site Scripting
• Elementor Website Builder <= 3.1.3 - Authenticated (Contributor+) Stored Cross-Site Scripting via header_size
• Security Hardener <= 2.4.4 - Authenticated (Subscriber+) Privilege Escalation via REST API '/wp/v2/users' permission_callback Overwrite
• WP Js External Link Info <= 1.21 - Cross-Site Scripting
• Scratch & Win – Giveaways and Contests <= 2.8.0 - Missing Authorization to Unauthenticated Coupon Creation
• WP Events <= 2.3.4 - SQL Injection
• SVG Support <= 2.5.8 - Stored Cross-Site Scripting via Vulnerability Dependency
• Online Scheduling and Appointment Booking System – Bookly <= 27.2 - Unauthenticated Stored Cross-Site Scripting via 'bookly-customer-full-name' Cookie
• Injection Guard <= 1.2.1 - Cross-Site Request Forgery to Whitelist Update
• Bring Fraktguiden for WooCommerce <= 1.11.4 - Missing Authorization
• Profile Builder <= 3.10.3 - Cross-Site Request Forgery via pms-cross-promotion.php
• Houzez <= 4.1.1 - Unauthenticated Local File Inclusion
• Floating Chat Widget: Contact Icons, Messages, Telegram, Email, SMS, Call Button - Chaty <= 2.8.2 Reflected Cross-Site Scripting
• URL Shortener by MyThemeShop <= 1.0.17 - Reflected Cross-Site Scripting via 'page'
• Hesabfa Accounting <= 2.1.2 - Reflected Cross-Site Scripting
• Schema Pro <= 2.7.8 - Authenticated(Contributor+) Missing Authorization
• Glamer <= 1.0.2 - Unauthenticated Local File Inclusion
• Language Switcher <= 3.7.13 - Reflected Cross-Site Scripting
• GamiPress <= 7.3.1 - Unauthenticated SQL Injection via orderby Parameter
• Newsletter Lite <= 4.9.2 - Authenticated (Admin+) Command Injection
• Pie Register Premium < 3.8.3.3 - Unauthenticated Arbitrary File Upload