Vulnerability archive: section 7, page 10

Open a report to review affected versions, available fixes and original sources. Each report covers a specific issue; its presence does not establish whether your website is affected.

• RegistrationMagic <= 5.2.4.1 - Reflected Cross-Site Scripting via section_id
• SureCart – Ecommerce Made Easy For Selling Physical Products, Digital Downloads, Subscriptions, Donations, & Payments <= 4.9.3 - Authenticated (Custom Role+) PHP Object Injection
• Database Backup for WordPress <= 2.5.1 - Cross-Site Request Forgery to Settings Update
• Paid Downloads <= 3.15 - Unauthenticated Arbitrary File Upload via 'paiddownloads_update_file' Action
• Luzuk Team <= 0.1.0 - Authenticated (Contributor+) Stored Cross-Site Scripting
• SUPER RESPONSIVE SLIDER <= 1.4 - Reflected Cross-Site Scripting
• MDirector Newsletter <= 4.5.8 - Cross-Site Request Forgery to Plugin Settings Update
• Ninja Forms <= 3.6.25 - Reflected Cross-Site Scripting via 'data'
• Database Toolset <= 1.8.4 - Unauthenticated Arbitrary File Deletion
• Lightbox & Modal Popup WordPress Plugin – FooBox (Free and Premium) <= 2.7.27 - Authenticated (Admin+) Stored Cross-Site Scripting
• WP-Eggdrop <= 0.1 - Cross-Site Request Forgery to Settings Update
• Paid Memberships Pro <= 2.12.10 - Cross-Site Request Forgery
• ShopBuilder – Elementor WooCommerce Builder Addons <= 2.1.8 - Unauthenticated Sensitive Information Exposure
• Widget Logic Visual <= 1.52 - Reflected Cross-Site Scripting
• Post Snippets – Custom WordPress Code Snippets Customizer <= 4.0.19 - Authenticated (Contributor+) Remote Code Execution
• hockeydata LOS <= 1.2.4 - Unauthenticated Local File Inclusion
• Realteo < 1.2.4 - Missing Authorization
• Tag, Category, and Taxonomy Manager – AI Autotagger with OpenAI <= 3.40.1 - Authenticated (Contributor+) SQL Injection
• Custom 404 Pro <= 3.2.8 - Reflected Cross-Site Scripting
• Wise Chat <= 3.4.1 - Authenticated (Contributor+) Stored Cross-Site Scripting
• Auto Prune Posts <= 1.8.0 - Cross-Site Request Forgery via admin_menu
• JCH Optimize <= 4.2.0 - Authenticated (Subscriber+) Directory Traversal
• Shortcodes and extra features for Phlox theme <= 2.15.7 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'title_tag'
• Contact Form & Lead Form Elementor Builder <= 1.6.3 - Unauthenticated Stored Cross-Site Scripting
• Viral Loops WP Integration <= 3.8.1 - Unauthenticated Sensitive Information Disclosure
• WP GPX Map <= 1.7.05 - Missing Authorization
• Templately <= 3.2.7 - Authenticated (Author+) Information Disclosure
• StatCounter <= 2.0.6 - Admin+ Stored Cross-Site Scripting
• Advanced Posts Listing – Show Post List Easily <= 1.0.8 - Missing Authorization
• WordPress Popular Posts <= 7.1.0 - Unauthenticated Arbitrary Shortcode Execution
• Simple Business Directory Pro < 15.6.9 - Unauthenticated Privilege Escalation
• Browse As <= 0.2 - Authenticated (Subscriber+) Authentication Bypass via Cookie
• WP Admin UI Customize <= 1.5.13 - Authenticated (Admin+) Stored Cross-Site Scripting
• «Подсказки» от DaData.ru <= 1.0.6 - Authenticated (Administrator+) Stored Cross-Site Scripting
• Rank Math SEO <= 1.0.27 - Authenticated Settings Reset via reset-cmb Parameter
• FunnelKit – Funnel Builder for WooCommerce Checkout <= 3.15.0.2 - Unauthenticated Stored Cross-Site Scripting
• Import Export Lite <= 3.9.32 - Authenticated (Admin+) Arbitrary File Upload
• Sale! Immigration law, Visa services support, Migration Agent Consulting <= 1.5.8 - Authenticated (Subscriber+) Privilege Escalation
• Booking and Rental Manager <= 2.2.8 - Missing Authorization
• Quiz And Survey Master <= 8.1.10 - Excessive Quiz Attempts
• OptimizePress < 1.6 - Arbitrary File Upload
• Banner Slider <= 2.1 - Reflected Cross-Site Scripting
• Master Slider Pro <= 3.7.12 - Authenticated (Contributor+) Stored Cross-Site Scripting
• Quiz Maker <= 6.5.0.5 - Denial of Service
• Print Barcode Labels for your WooCommerce products/orders <= 3.4.10 - Missing Authorization
• Divi 5.0 - 5.11.1 - Missing Authorization to Unauthenticated Arbitrary Registered Shortcode Execution via 'content' Parameter via Shortcode Module REST Endpoint
• Complete Google Seo Scan <= 3.5.1 - Authenticated (Administrator+) SQL Injection
• WP Mail Logging <= 1.17.0 - Authenticated (Administrator+) Sensitive Information Exposure in LIKE Wildcard in Personal Data Export Email
• SportsPress <= 2.7.1 - Cross-Site Scripting
• Frontend Admin by DynamiApps Plugin <= 3.18.3 - Unauthenticated Arbitrary File Upload
• Yada Wiki <= 3.4 - Stored Cross-Site Scripting
• Agency Toolkit <= 1.0.23 - Unauthenticated Privilege Escalation
• Advanced Shipment Tracking for WooCommerce <= 3.2.6 - Authenticated WordPress Options Change
• Legal Pages <= 1.3.7 - Missing Authorization on 'deleteLegalTemplate'
• Apollo | Night Club, DJ Event WordPress <= 1.3.1 - Unauthenticated Local File Inclusion
• Orbit Fox by ThemeIsle <= 2.10.27 - Authenticated(Contributor+) Stored Cross-site Scripting via Pricing Table Elementor Widget
• VikBooking 1.8.8 - 1.8.14 - Unauthenticated Stored Cross-Site Scripting via SVG Upload
• Jeg Elementor Kit <= 2.6.11 - Authenticated (Contributor+) Sensitive Information Exposure via Countdown and Off-Canvas
• Image Optimizer by Elementor <= 1.7.6 - Authenticated (Subscriber+) Information Exposure
• eForm <= 4.18.0 - Unauthenticated Stored Cross-Site Scripting
• JS Multi Hotel <= 2.2.1 - Cross-Site Scripting
• Order Sync with Zendesk for WooCommerce < 2.2.3 - Unauthenticated Information Exposure
• ELEX WordPress HelpDesk & Customer Ticketing System <= 3.3.1 - Unauthenticated Arbitrary File Upload
• Yuki <= 1.3.13 - Missing Authorization to Authenticated (Subscriber+) Theme Setting Reset
• Ksher <= 1.1.1 - Missing Authorization
• Dashboard Widgets Suite <= 3.4.3 - Reflected Cross-Site Scripting
• GeoDirectory <= 2.3.28 - Authenticated (Administrator+) SQL Injection via orderby
• Hotel Listing <= 1.4.2 - Missing Authorization
• WhyDonate – FREE Donate button – Crowdfunding – Fundraising <= 4.0.15 - Missing Authorization to Unauthenticated wp_wdplugin_style Rww Deletion
• WP Projects Portfolio with Client Testimonials <= 3.0 - Reflected Cross-Site Scripting
• WP-Matomo Integration (WP-Piwik) <= 1.0.28 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode
• Bold Page Builder <= 5.4.1 - Authenticated (Contributor+) Stored Cross-Site Scripting
• Contest Gallery <= 19.1.4.1 - Authenticated (Author+) SQL Injection via cg_copy_start
• iMember360 3.8.0.12 - 3.9.001 - Cross-Site Request Forgery
• ElementsKit Elementor Addons – Advanced Widgets & Templates Addons for Elementor <= 3.9.6 - Missing Authorization
• Shoutcast Icecast HTML5 Radio Player <= 2.1.7 - Authenticated (Contributor+) Stored Cross-Site Scripting
• HSS Embed Streaming Video <= 3.23 - Reflected Cross-Site Scripting
• Simple WP Events <= 1.8.17 - Unauthenticated Arbitrary File Deletion
• Simple Ticker <= 3.05 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode
• Real Estate 7 Theme <= 3.3.1 - Stored Cross-Site Scripting
• JupiterX Core <= 3.3.5 - Unauthenticated Arbitrary File Upload
• WP Fastest Cache <= 1.1.2 - Cross-Site Request Forgery via 'wpfc_toolbar_save_settings_callback'
• EventPrime < 3.2.0 - Reflected HTML Content Injection
• SUMO Memberships for WooCommerce <= 7.8.0 - Authenticated (Subscriber+) Privilege Escalation
• Library Viewer <= 2.0.6 - Open Redirect via 'redirect_to'
• Appointment Booking Plugin – LatePoint | Calendar & Scheduling for WordPress <= 5.6.9 - Authenticated (Subscriber+) Insecure Direct Object Reference to Arbitrary Customer PII Modification
• The School Management – Education & Learning Management <= 4.1 - Authenticated (Administrator+) SQL Injection
• WP Mail Log <= 1.1.1 - Unauthenticated Stored Cross-Site Scripting via Email
• Buttons Shortcode and Widget <= 1.16 - Authenticated (Contributor+) Stored Cross-Site Scripting via shortcode
• RokNewsPager <= 1.17 - Arbitrary File Upload
• Sigma Forms Pro <= 1.4.5 - Unauthenticated Arbitrary File Upload
• Media Downloader <= 0.4.7.4 - Reflected Cross-Site Scripting
• WPGYM < 67.8.0 - Unauthenticated SQL Injection
• Bookly <= 20.3 - Staff Member Stored Cross-Site Scripting
• Vimeotheque <= 2.3.4.2 - Authenticated (Contributor+) SQL Injection
• WP Frontend Admin <= 1.22.7 - Authenticated (Contributor+) Stored Cross-Site Scripting
• Integrate Google Drive <= 1.3.3 - Missing Authorization via save_settings
• WP Membership <= 1.6.2 - Unauthenticated Arbitrary File Upload
• Gift Up Gift Cards for WordPress and WooCommerce <= 2.20.1 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode
• Contact Form 7 Extension For Mailchimp <= 0.5.70 - Authenticated (Subscriber+) Server-Side Request Forgery