Vulnerability archive: section 6, page 7

Open a report to review affected versions, available fixes and original sources. Each report covers a specific issue; its presence does not establish whether your website is affected.

• fyyd podcast shortcodes <= 0.3.1 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'color' Shortcode Attribute
• Download Plugin <= 2.2.8 - Authenticated (Administrator+) Arbitrary File Upload
• WP Photo Album Plus < 6.1.3 - Cross-Site Scripting
• Tutor LMS <= 3.9.12 - Missing Authorization to Authenticated (Subscriber+) Comment Creation
• Animated Buttons <= 1.0.0 - Authenticated (Contributor+) Stored Cross-Site Scripting
• Aurora Heatmap <= 1.7.2 - Unauthenticated Stored Cross-Site Scripting via 'url' Parameter
• Real Estate Manager <= 7.3 - Cross-Site Request Forgery
• SEOPress PRO <= 9.1.1 - Missing Authorization
• BeeTeam368 Extensions <= 2.3.5 - Authenticated (Subscriber+) Arbitrary File Upload
• Contact Form 7 Database Addon – CFDB7 <= 1.2.6.1 - Unauthenticated Stored Cross-Site Scripting
• WP Editor <= 1.2.8 - Reflected Cross-Site Scripting
• SureForms – Drag and Drop Form Builder for WordPress <= 1.7.3 - Unauthenticated Arbitrary File Deletion Triggered via Administrator Submission Deletion
• BuddyPress <= 7.2.1 - Missing Authorization to Private Post Activity
• Cookie Nonsense for YT <= 1.2.0 - Authenticated (Contributor+) Stored Cross-Site Scripting
• Blackhole for Bad Bots <= 3.3.1 - Arbitrary IP Address Blocking via IP Spoofing
• WordPress Real Media Library <= 4.14.1 - Authenticated (Author) Stored Cross-Site Scripting
• Any Hostname <= 1.0.6 - Authenticated (Admin+) Stored Cross-Site Scripting
• TFO Graphviz <= 1.9 - Reflected Cross-Site Scripting
• WordPress Core < 5.3.1 - Authenticated Stored Cross-Site Scripting
• Tumult Hype Animations <= 1.9.14 - Missing Authorization
• ElementInvader Addons for Elementor <= 1.2.2 - Authenticated (Contributor+) Stored Cross-Site Scripting
• Google Calendar Events <= 3.2.5 - Cross-Site Request Forgery via bulk_actions
• GS Testimonial Slider <= 3.1.4 - Authenticated (Contributor+) Stored Cross-Site Scripting
• Email Subscribers by Icegram Express – Email Marketing, Newsletters, Automation for WordPress & WooCommerce <= 5.7.34 - Authenticated (Subscriber+) Arbitrary Shortcode Execution
• Sky Addons for Elementor (Free Templates Library, Live Copy, Animations, Post Grid, Post Carousel, Particles, Sliders, Chart, Blogs) <= 2.6.2 - Missing Authorization to Authenticated (Subscriber+) Limited Arbitrary Options Update
• Frontend File Manager <= 23.6 - Unauthenticated Arbitrary File Deletion
• Advanced Dynamic Pricing for WooCommerce <= 4.1.5 - Cross-Site Request Forgery
• ElementInvader Addons for Elementor <= 1.3.5 - Authenticated (Contributor+) Stored Cross-Site Scripting
• Visualizer – Tables & Charts Manager with Built-in AI Generator < 4.0.7 - Missing Authorization
• Arielbrailovsky-Viralad <= 1.0.8 - Unauthenticated SQL Injection
• I Plant A Tree <= 1.7.3 - Cross-Site Request Forgery to Stored Cross-Site Scripting
• Review & testimonial widgets <= 1.0.9 - Authenticated (Contributor+) Stored Cross-Site Scripting
• Ultimate Maps by Supsystic < 1.5.0 - Unauthenticated PHP Object Injection
• FastDup <= 2.7 - Authenticated (Contributor+) Path Traversal via 'dir_path' REST Parameter
• CMS Commander <= 2.287 - Authorization Bypass through Use of Insufficiently Unique Cryptographic Signature
• Seraphinite Accelerator (Base, cache only) <= 2.20.31 - Cross-Site Request Forgery
• BuddyPress <= 14.3.3 - Unauthenticated Arbitrary Shortcode Execution
• Visual Form Builder <= 3.0.5 - Unauthenticated Information Disclosure
• Ultra Companion <= 1.1.9 - Authenticated (Contributor+) Stored Cross-Site Scripting
• Translation.Pro <= 1.0.0 - Reflected Cross-Site Scripting
• FunnelKit Checkout <= 3.10.3 - Unauthenticated Arbitrary Content Deletion
• WPeMatico RSS Feed Fetcher <= 2.8.25 - Authenticated (Contributor+) Stored Cross-Site Scripting
• AI Scribe – SEO AI Writer, Content Generator, Humanizer, Blog Writer, SEO Optimizer, DALLE-3, AI WordPress Plugin ChatGPT (GPT-4o 128K) <= 2.5 - Missing Authorization to Authenticated (Subscriber+) Settings Update
• Sahifa < 5.8.6 - Authenticated (Contributor+) Stored Cross-Site Scripting
• Contact Form 7 Database Addon <= 1.2.5.4 - CSV Injection
• Stylish Price List <= 7.0.17 - Missing Authorization
• Child Theme Wizard <= 1.4 - Cross-Site Request Forgery
• Goto - Tour & Travel WordPress Theme < 2.0 - Reflected Cross-Site Scripting
• Real Estate Directory <= 1.0.4 - Missing Authorization to Authenticated (Subscriber+) Arbitrary Plugin Activation
• Weather Atlas Widget <= 1.2.1 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode
• Aora <= 1.3.9 - Unauthenticated Local File Inclusion
• Hospital Doctor Directory <= 1.3.9 - Missing Authorization
• Post Meta <= 1.0.9 - Cross-Site Request Forgery to Stored Cross-Site Scripting
• Theme Test Drive <= 2.9 - Reflected Cross-Site Scripting
• Snow Effect <= 1.1.15 - Missing Authorization
• Soisy Pagamento Rateale <= 6.0.1 - Missing Authorization to Sensitive Information Exposure
• BeeTeam368 Extensions <= 1.9.4 - Unauthenticated Local File Inclusion
• CanadaHelps Embedded Donation <= 1.0.1 - Authenticated (Contributor+) Stored Cross-Site Scripting
• Posts in Page <= 1.2.4 - Authenticated Directory Traversal leading to Local File Inclusion
• To Do List Member 1.4 - 1.6 - Unauthenticated Stored Cross-Site Scripting
• Page Builder by SiteOrigin < 2.0.5 - Reflected Cross-Site Scripting
• BEAR <= 1.1.3.3 - Missing Authorization to Product Manipulation
• Måne <= 1.7 - Unauthenticated Local File Inclusion
• Cimy User Manager < 1.4.4 - Arbitrary File Read
• WPBITS Addons For Elementor Page Builder <= 1.8.1 - Authenticated (Contributor+) Stored Cross-Site Scripting
• Jobmonster - Job Board WordPress Theme <= 4.8.1 - Authentication Bypass
• Rank Math SEO – AI SEO Tools to Dominate SEO Rankings <= 1.0.274.1 - Unauthenticated Stored Cross-Site Scripting
• Custom Dashboard Widget <= 1.0.0 - Reflected Cross-Site Scripting
• FV Flowplayer Video Player <= 7.5.41.7212 - Reflected Cross-Site Scripting
• TTT Crop <= 1.0 - Reflected Cross-Site Scripting
• WP SEO Tags <= 2.2.7 - Reflected Cross-Site Scripting
• Master Addons – Elementor Addons with White Label, Free Widgets, Hover Effects, Conditions, & Animations <= 2.0.8.6 - Authenticated (Contributor+) Stored Cross-Site Scripting via fancyBox
• Allow PHP in Posts and Pages <= 3.0.4 - Authenticated (Subscriber+) Remote Code Execution via Shortcode
• Le Truffe <= 1.1.7 - Unauthenticated Local File Inclusion
• WP-Property – WordPress Powered Real Estate and Property Management < 1.38.4 - Information Disclosure
• LearnPress – WordPress LMS Plugin for Create and Sell Online Courses <= 4.3.6 - Reflected Cross-Site Scripting
• AW WooCommerce Kode Pembayaran <= 1.1.4 - Reflected Cross-Site Scripting
• WP-Banners-Lite 1.29, 1.31, 1.40 - Cross-Site Scripting
• Optimize < 2.4 - Unauthenticated Local File Inclusion
• File Manager <= 7.2.4 - Cross-Site Request Forgery to Local JS File Inclusion
• WP Social Comments <= 1.7.2 - Missing Authorization to Authenticated (Subscriber+) Settings Change
• Easy Custom Auto Excerpt < 2.4.7 - Stored Cross-Site Scripting
• Premium Addons for Elementor PRO <= 2.9.12 - Authenticated(Contributor+) Stored Cross-Site Scripting via widget link
• User Access Manager <= 2.2.16 - IP Spoofing
• Tag Groups is the Advanced Way to Display Your Taxonomy Terms <= 2.0.4 - Reflected Cross-Site Scripting
• Backup, Restore and Migrate WordPress Sites With the XCloner Plugin <= 3.1.0 - Cross-Site Request Forgery
• Royal Elementor Addons and Templates <= 1.3.87 - Cross-Site Request Forgery via remove_from_compare
• Booking calendar, Appointment Booking System <= 2.1.7 - Cross-Site Scripting
• Multiple elFinder Plugins <= 8.0.4 - Reflected Cross-Site Scripting
• WPC Smart Messages for WooCommerce <= 4.2.8 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode Attribute
• WP Mail Log <= 1.1.2 - Authenticated (Contributor+) SQL injection via key
• Pie Calendar <= 1.2.9 - Authenticated (Contributor+) Stored Cross-Site Scripting
• WP Delicious <= 1.10.2 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'steps' Block Attribute
• Enter Addons <= 2.1.9 - Authenticated (Contributor+) Stored Cross-Site Scripting
• Track Everything <= 2.0.1 - Cross-Site Request Forgery
• WP Iframe Geo Style for Amazon affiliates <= 1.1 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'adid' Shortcode Attribute
• ConeBlog – WordPress Blog Widgets <= 1.4.8 - Authenticated (Contributor+) Stored Cross-Site Scripting
• WP Forms Connector <= 1.8 - Missing Authorization to Unauthenticated Information Exposure via 'user/list' REST Endpoint
• Ultimate Addons for Elementor (Formerly Elementor Header & Footer Builder) <= 2.4.6 - Missing Authorization to Authenticated (Subscriber+) Limited Settings Update
• Event Registration < 6.00.03 - SQL Injection