Vulnerability archive: section 6, page 9

Open a report to review affected versions, available fixes and original sources. Each report covers a specific issue; its presence does not establish whether your website is affected.

• Email Encoder <= 2.1.8 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode
• Alt Text AI – Automatically generate image alt text for SEO and accessibility <= 1.4.9 - Authenticated (Subscriber+) SQL Injection
• Donate Extra <= 2.0.2 - Reflected Cross-Site Scripting
• YITH WooCommerce Popup <= 1.48.0 - Cross-Site Request Forgery
• Tour Master - Tour Booking, Travel, Hotel < 5.4.8 - Unauthenticated Stored Cross-Site Scripting
• Floating Tweets <= 1.0.1 - Directory Traversal
• WP Edit Username <= 1.0.5 - Authenticated (Administrator+) Stored Cross-Site Scripting
• Multi Step Form <= 1.2.5 - Reflected Cross-Site Scripting
• IDonate 2.1.5 - 2.1.9 - Missing Authorization to Authenticated (Subscriber+) Account Takeover/Privilege Escalation via idonate_donor_password Function
• Cost Calculator Builder Pro <= 3.1.72 - Authenticated (Subscriber+) Server-Side Request Forgery
• All in One Files Upload for WooCommerce 2.0.3 - 2.0.16 - Unauthenticated Stored Cross-Site Scripting via SVG Upload
• JetBooking <= 4.1.2 - Missing Authorization
• Melhor Envio <= 2.15.11 - Unauthenticated Sensitive Information Exposure via Hardcoded Hash
• Jetpack < 12.7 - Authenticated(Contributor+) Clickjacking via Iframe Injection
• Notarius - Legal Advisor WordPress Theme <= 1.9 - Unauthenticated Local File Inclusion
• Essential Blocks for Gutenberg <= 4.2.0 - Incorrect Authorization Checks
• Integration for Google Sheets and Contact Form 7, WPForms, Elementor, Ninja Forms <= 1.1.1 - Unauthenticated PHP Object Injection via verify_field_val Function
• KI Live Video Conferences <= 5.5.15 - Missing Authorization
• JSFiddle Shortcode <= 1.1.1 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode
• El mejor Cluster <= 1.1.15 - Authenticated (Contributor+) Stored Cross-Site Scripting
• Barcode Scanner with Inventory & Order Manager <= 1.6.1 - Authenticated (Subscriber+) SQL Injection
• Invelity Products Feeds <= 1.2.6 - Cross-Site Request Forgery to Arbitrary File Deletion
• Email Template Customizer for WooCommerce <= 1.2.17 - Authenticated (Shop manager+) Stored Cross-Site Scripting
• Order Delivery Date for WooCommerce <= 4.5.1 - Unauthenticated SQL Injection
• Salon booking system <= 9.6.2 - Unauthenticated Stored Cross-Site Scripting via 'sms_prefix'
• POEditor <= 0.9.8 - Authenticated (Administrator+) Stored Cross-Site Scripting
• Social Web Suite – Social Media Auto Post, Social Media Auto Publish <= 4.1.11 - Directory Traversal to Arbitrary File Download
• Pretty Simple Popup Builder <= 1.0.9 - Authenticated (Administrator+) Stored Cross-Site Scripting
• Dyslexiefont Free <= 0.0.2 - Cross-Site Scripting
• esri-map-view <= 1.2.3 - Authenticated (Contributor+) Stored Cross-Site Scripting via esri-map-view Shortcode
• Essential Real Estate <= 4.4.2 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode
• CITS Support svg, webp Media and TTF,OTF File Upload, Use Custom Fonts <= 4.2 - Cross-Site Request Forgery to Font Assignment Deletion
• DesignThemes LMS Addon <= 2.6 - Missing Authorization
• Firebase OTP Authentication <= 1.0.1 - Missing Authorization to Privilege Escalation
• Sales Report Email for WooCommerce <= 2.8.0 - Missing Authorization for Email Functionality
• Contact Form 7 + Telegram <= 0.8.5 - Missing Authorization to Authenticated (Subscriber+) Subscription Approve/Pause/Refuse
• SEO Redirection Plugin - 301 Redirect Manager <= 6.3 - Reflected Cross-Site Scripting
• Horizontal scroll image slideshow <= 10.1 - Authenticated (Contributor+) Stored Cross-Site Scripting
• Modula Image Gallery – Photo Grid & Video Gallery <= 2.14.23 - Authenticated (Subscriber+) Stored Cross-Site Scripting
• WP Testimonial Widget <= 3.1 - Authenticated (Admin+) SQL Injection
• WordPress Core <= 3.3 - Cross-Site Scripting
• Canto <= 1.9.0 - Blind Server-Side Request Forgery via detail.php
• Administrative Shortcodes <= 0.3.4 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'login' and 'logout' Shortcode Attributes
• Snap Pixel <= 1.5.8 - Cross-Site Request Forgery
• BackupBuddy < 3.0 - Authentication Bypass
• TAKETIN To WP Membership <= 2.8.12 - Authenticated (Subscriber+) PHP Object Injection
• Simple Membership <= 4.7.0 - Unauthenticated Improper Handling of Missing Values
• Quiz And Survey Master <= 7.3.10 - Missing Authorization
• Custom iFrame for Elementor <= 1.0.13 - Authenticated (Contributor+) Stored Cross-Site Scripting
• WP eMember <= 10.3.8 - Reflected Cross-Site Scripting via 'fieldId'
• WooMS <= 9.12 - Reflected Cross-Site Scripting
• Payment Gateway for Redsys & WooCommerce Lite <= 7.0.0 - Improper Verification of Cryptographic Signature to Unauthenticated Payment Status Manipulation
• GiveWP – Donation Plugin and Fundraising Platform < 4.16.6 - Missing Authorization
• Ninja Forms <= 3.14.0 - Unauthenticated Information Disclosure in nf_ajax_submit AJAX Action
• JustClick registration plugin <= 0.1 - Reflected Cross-Site Scripting via PHP_SELF
• Ebook Store <= 5.8001 - Reflected Cross-Site Scripting via 'step'
• LMS by LifterLMS <= 4.21.0 - Reflected Cross-Site Scripting
• Job Board by BestWebSoft <= 1.2.1 - Cross-Site Request Forgery to Stored Cross-Site Scripting via $_GET Array Storage
• HomeLancer <= 1.0.1 - Missing Authorization
• GoDaddy Email Marketing < 1.1.4 - Cross-Site Request Forgery
• PublishPress: Editorial Calendar, Workflow, Comments, Notifications and Statuses <= 3.5.0 - Cross-Site Scripting
• Minimum and Maximum Quantity for WooCommerce <= 2.0.0 - Missing Authorization
• RegistrationMagic <= 5.2.5.9 - Cross-Site Request Forgery
• Meta Box – WordPress Custom Fields Framework <= 5.9.10 - Missing Authorization to Information Exposure
• FormCraft Basic <= 1.2.5 - Authenticated (Admin+) Stored Cross-Site Scripting
• Printful Integration for WooCommerce <= 2.2.11 - Authenticated (Contributor+) Server-Side Request Forgery
• Unlimited <= 1.45 - Authenticated (Contributor+) Stored Cross-Site Scripting
• Booking Package <= 1.7.20 - Unauthenticated SQL Injection via 'email' Form Parameter
• CropRefine <= 1.2.1 - Reflected Cross-Site Scripting
• WP Limit Login Attempts < 2.0.1 - SQL Injection
• Contact Form By BestWebSoft<= 3.34 - Cross-Site Scripting
• Slider a SlidersPack <= 2.3 - Authenticated (Contributor+) Local File Inclusion
• GD Rating System < 2.1 - Reflected Cross-Site Scripting
• Meta Box <= 4.16.1 - Mishandling of File Upload
• App Bar <= 1.5 - Reflected Cross-Site Scripting
• Professional Contact Form <= 1.0.0 - Cross-Site Request Forgery to Test Email Sending
• WP Video Lightbox <= 1.9.4 - Reflected Cross-Site Scripting
• Enhanced Text Widget <= 1.5.8 - Missing Authorization
• WP-CRM System – Manage Clients and Projects <= 3.4.5 - Missing Authorization to Authenticated (Subscriber+) CRM Data Exposure and Task Modification
• API KEY for Google Maps <= 1.2.1 - Cross-Site Request Forgery
• JetReviews <= 3.0.0.1 - Authenticated (Subscriber+) Stored Cross-Site Scripting
• Payment Gateway Based Fees and Discounts for WooCommerce <= 2.12.1 - Cross-Site Request Forgery to Notice Dismissal
• WPJAM Basic <= 7.0.1 - Authenticated (Subscriber+) SQL Injection
• Infinite <= 1.1.2 - Authenticated (Contributor+) Stored Cross-Site Scripting via project_url Parameter
• Case Addons < 1.3.0 - Authenticated (Subscriber+) Arbitrary File Upload
• Theme My Login 2FA < 1.2 - 2FA Bypass via Brute Force
• Ultimate Addons for WPBakery <= 3.19.17 - Cross-Site Request Forgery
• WP Comment Remix < 1.4.4 - Cross-Site Request Forgery
• Community by PeepSo <= 6.0.2.0 - Cross-Site Request Forgery leading to Plugin/Subscription Deletion
• YOP Poll <= 6.5.38 - Missing Authorization
• Apptivo Business Site CRM <= 5.3 - Cross-Site Request Forgery to IP Address Block
• Doneren met Mollie <= 2.10.7 - Authenticated (Contributor+) Stored Cross-Site Scripting
• WP-Members Membership Plugin <= 3.5.4.4 - Unauthenticated Information Exposure via Unprotected Files
• Invitation Code Content Restriction Plugin from CreativeMinds <= 1.5.4 - Reflected Cross-Site Scripting
• Grey Owl Lightbox <= 1.6.1 - Authenticated (Contributor+) Stored Cross-Site Scripting
• Tag Miner (Automatic Tag Extraction) < 1.1.5 - Cross-Site Request Forgery
• LatePoint <= 5.2.7 - Authenticated (Agent+) Privilege Escalation
• Custom Post View Generator <= 0.4.6 - Reflected Cross-Site Scripting
• Hide admin notices – Admin Notification Center <= 2.3.2 - Cross-Site Request Forgery
• Soundy Background Music <= 3.1 - Reflected Cross-Site Scripting