Vulnerability archive: section 7, page 11

Open a report to review affected versions, available fixes and original sources. Each report covers a specific issue; its presence does not establish whether your website is affected.

• Booktics – Appointment Booking Calendar for Service Businesses <= 1.0.24 - Missing Authorization
• Vedrixa Forms <= 1.1.1 - Missing Authorization to Authenticated (Subscriber+) Arbitrary Form Structure Modification via wefb_save_form_structure AJAX Action
• Top Friends <= 0.3 - Cross-Site Request Forgery to Settings Update
• JobSearch WP Job Board <= 1.5.2 - Reflected Cross-Site Scripting
• Ninja Forms – The Contact Form Builder That Grows With You <= 3.8.22 - Authenticated (Subscriber+) Arbitrary Shortcode Execution
• reCAPTCHA Jetpack <= 0.2.2 - Cross-Site Request Forgery to Settings Update
• QuickCal <= 1.0.15 - Cross-Site Request Forgery to Privilege Escalation
• UserAgent-Spy <= 1.3.1 - Authenticated (Administrator+) Stored Cross-Site Scripting via plugin settings
• WordPress Ping Optimizer <= 2.35.1.3.0 - Cross-Site Request Forgery to Log Clearing
• WordPress Core < 5.2.3 - Stored Cross-Site Scripting via Comments
• Payment Plugins for PayPal WooCommerce <= 2.0.25 - Missing Authorization
• DMCA WaterMarker < 1.1 - Cross-Site Scripting
• Hotel Booking Lite <= 6.2.2 - Insecure Direct Object Reference to Authenticated (Subscriber+) Customer Data Modification
• Login-Logout <= 3.8 - Authenticated (Administrator+) Stored Cross-Site Scripting
• Radius Booking – Appointment Booking Calendar & Scheduling for Services & Events <= 1.0.19 - Unauthenticated SQL Injection
• FluentCart < 1.3.0 - Unauthenticated Stored Cross-Site Scripting
• Ajax Contact Form <= 1.4.1 - Authenticated (Contributor+) Stored Cross-Site Scripting
• Nasa Core <= 6.3.2 - Unauthenticated Local File Inclusion
• NewsBlogger <= 0.2.5.6 - 0.2.5.9 - Cross-Site Request Forgery to Arbitrary Plugin Installation
• VideoPro <= 2.3.8.1 - Unauthenticated Local File Inclusion
• Bookit <= 2.6.0.4 - Authenticated (Bookit Staff+) Information Exposure
• WORDPRESS VIDEO GALLERY <= 3.0 - Improper Access Control
• Course Booking System <= 6.0.6 - Unauthenticated SQL Injection
• Divi Form Builder <= 5.1.2 - Unauthenticated Privilege Escalation via 'role'
• Google Map Locations <= 1.0 - Reflected Cross-Site Scripting
• Animate <= 0.5 - Authenticated (Contributor+) Server-Side Request Forgery
• Tag, Category, and Taxonomy Manager – AI Autotagger with OpenAI <= 3.40.1 - Authenticated (Contributor+) SQL Injection via ORDER BY Clause
• CMSMasters Content Composer <= 2.5.8 - Missing Authorization
• Mang Board <= 2.4.1 - Unauthenticated Stored Cross-Site Scripting
• Amazon Associate Filter <= 0.4 - Cross-Site Request Forgery to Stored Cross-Site Scripting
• Headless CMS <= 2.0.3 - Missing Authorization
• Ultimate Coming Soon & Maintenance <= 1.0.9 - Missing Authorization to Unauthenticated Template Activation
• Modal Portfolio <= 1.7.4.2 - Authenticated (Administrator+) Stored Cross-Site Scripting
• Restore PayPal Standard for WooCommerce < 3.1.1 - Unauthenticated Payment Bypass
• Loco Translate <= 2.8.2 - Reflected Cross-Site Scripting via 'update_href' Parameter
• WP Construction Mode <= 1.8 - Cross-Site Scripting
• UserPro <= 5.1.1 - Cross-Site Request Forgery to Privilege Escalation
• Memberpress <= 1.11.37 - Unauthenticated Content Restriction Bypass to Sensitive Information Exposure
• Visibility Logic for Elementor <= 2.3.4 - Cross-Site Request Forgery via toggle_option
• iThemes Builder Depot Theme < 5.0.30 - Reflected Cross-Site Scripting
• WP Live Chat Support <= 7.0.06 - Cross-Site Scripting
• WP Job Portal <= 2.3.2 - Unauthenticated Insecure Direct Object Reference
• Gutenberg Essential Blocks – Page Builder for Gutenberg Blocks & Patterns <= 6.1.3 - Authenticated (Author+) Server-Side Request Forgery
• Fusion Builder <= 3.6.1 & Avada <= 7.6.1 - Unauthenticated Server-Side Request Forgery
• Tune Library < 1.5.5 - SQL Injection
• WP Maps – Google Maps,OpenStreetMap,Mapbox,Store Locator,Listing,Directory & Filters <= 4.9.9 - Authenticated (Administrator+) SQL Injection
• YaySMTP <= 2.6.6 - Authenticated (Administrator+) SQL Injection
• Perfmatters <= 2.6.4 - Unauthenticated Arbitrary File Read via 's' Parameter
• Sidebar Manager Light <= 1.18 - Unauthenticated Stored Cross-Site Scripting via 'sbm_description' Parameter
• Manager for Icomoon <= 2.1 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode
• Sunshine Photo Cart <= 3.4.11 - Authenticated (Subscriber+) Privilege Escalation
• Insert or Embed Articulate Content into WordPress <= 4.3000000023 - Authenticated (Author+) Arbitrary File Upload
• Call Now PHT Blog <= 2.4.1 - Cross-Site Request Forgery
• MDTF – Meta Data and Taxonomies Filter <= 1.3.0.1 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode
• WP Discord Post Plus - Supports Unlimited Channels <= 1.0.2 - Cross-Site Request Forgery
• RapidLoad Power-Up for Autoptimize <= 1.7.1 - Missing Authorization in 'uucss_update_rule'
• Micdrop <= 1.3.1 - Unauthenticated PHP Object Injection
• Silencesoft RSS Reader <= 0.6 - Authenticated (Administrator+) Stored Cross-Site Scripting
• Media Library Assistant <= 3.41 - Unauthenticated Stored Cross-Site Scripting
• EduBlink <= 2.0.7 - Missing Authorization
• WPBot AI ChatBot <= 8.5.1 - Authenticated (Administrator+) SQL Injection
• Paid Memberships Pro <= 2.12.3 - Authenticated (Subscriber+) Arbitrary File Upload
• Elementor Pro <= 3.11.6 - Authenticated(Subscriber+) Privilege Escalation via update_page_option
• WP-Syntax <= 1.2 - Authenticated (Author+) Regex Denial of Service
• Page Builder Gutenberg Blocks – CoBlocks <= 3.1.12 - Authenticated (Editor+) Stored Cross-Site Scripting
• GP Back To Top <= 3.0 - Cross-Site Request Forgery
• MultiVendorX – WooCommerce Multivendor Marketplace AI Powered Solutions < 5.0.11 - Missing Authorization
• WordPress Importer <= 1.0.4 - Reflected Cross-Site Scripting
• Chocolate WP – Responsive Photography Theme (All Versions) - Arbitrary File Upload
• Staff Directory – Employee Directory for WordPress <= 4.5.0 - Authenticated (Contributor+) Stored Cross-Site Scripting
• Customizable Captcha and Contact Us <= 1.0.2 - Reflected Cross-Site Scripting
• Relevant – Related, Featured, Latest, and Popular Posts by BestWebSoft < 1.2.0 - Reflected Cross-Site Scripting
• Product Filter Widget for Elementor <= 1.0.6 - Reflected Cross-Site Scripting via 'args[filterFormArray]' Parameter
• GNUCommerce <= 1.5.4 - Unauthenticated PHP Object Injection
• ClickBank Storefront WordPress Plugin <= 1.7 - Reflected Cross-Site Scripting
• Security Optimizer – The All-In-One Protection Plugin <= 1.5.0 - Missing Authorization via hide_notice()
• BEAR <= 1.1.3.3 - Missing Authorization to Product Manipulation
• Xagio SEO – AI Powered SEO <= 7.1.0.30 - Unauthenticated Privilege Escalation
• Downloable by American Osteopathic Association <= 0.1.0 - Unauthenticated Arbitrary File Download
• Everest Forms <= 2.0.3 - Unauthorized Form Submission via Disabled Forms
• Kadence Blocks <= 3.7.5 - Authenticated (Contributor+) Sensitive Information Exposure via Block Editor proData Localization
• Paragon <= 1.1 - Unauthenticated Local File Inclusion
• WP Maintenance <= 6.1.3 - IP Restriction Bypass
• Easy Digital Downloads – Sell Digital Files & Subscriptions (eCommerce Store + Payments Made Easy) <= 3.3.2 - Authenticated (Admin+) Stored Cross-Site Scripting via Agreement Text
• DirectoryPress – Business Directory And Classified Ad Listing <= 3.6.7 - Reflected Cross-Site Scripting
• WP RSS By Publishers <= 0.1 - Authenticated (Admin+) SQL Injection
• Starbox Voting <= 2.0.4 - Full Path Disclosure
• RH - Real Estate WordPress Theme <= 4.4.0 - Authenticated (Subscriber+) Privilege Escalation
• teachPress <= 9.0.11 - Authenticated (Contributor+) SQL Injection
• Bulk Block Converter <= 1.0.1 - Reflected Cross-Site Scripting
• Slideshow, Image Slider by 2J <= 1.3.54 - Reflected Cross-Site Scripting
• Goodlayers Core <= 2.0.7 - Reflected Cross-Site Scripting via 'font-family'
• WP-Polls <= 2.70 - Stored Cross-Site Scripting
• MainWP Child <= 5.3.3 - Missing Authorization to Unauthenticated Privilege Escalation
• SEOReseller Partner <= 1.3.15 - Cross-Site Request Forgery to Stored Cross-Site Scripting
• Linked Variation for WooCommerce <= 1.0.5 - Cross-Site Request Forgery
• 코드엠샵 소셜톡 <= 1.2.1 - Authenticated (Contributor+) Stored Cross-Site Scripting
• Conversios.io <= 6.5.3 - Reflected Cross-Site Scripting
• Subscribe to Download Lite <= 1.2.9 - Authenticated (Contributor+) Local File Inclusion
• Event Espresso 4 Decaf – Event Registration Event Ticketing <= 4.10.46.decaf- Authenticated (Subscriber+) Missing Authorization to Limited Plugin Settings Modification