Vulnerability archive: section 7, page 12

Open a report to review affected versions, available fixes and original sources. Each report covers a specific issue; its presence does not establish whether your website is affected.

• Integration for Contact Form 7 HubSpot <=1.3.1 - Cross-Site Request Forgery
• My Sticky Elements <= 2.3.3 - Missing Authorization
• Contact Form 7 reCAPTCHA <= 1.2.0 - Cross-Site Request Forgery
• Schema & Structured Data for WP & AMP <= 1.65 - Unauthenticated Insecure Direct Object Reference
• Lightbox Photo Gallery <= 1.0 - Cross-Site Request Forgery
• Enable SVG, WebP & ICO Upload <= 1.1.1 - Authenticated (Author+) Stored Cross-Site Scripting via SVG
• King Addons for Elementor <= 51.1.49 - Unauthenticated API Keys Disclosure
• WP Admin Audit <= 1.2.17 - Missing Authorization
• WordPress Mortgage Calculator Estatik <= 2.0.11 - Reflected Cross-Site Scripting
• Pricing Tables For WPBakery Page Builder (formerly Visual Composer) <= 2.0 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode
• Hide Shipping Method For WooCommerce <= 1.5.4 - Authenticated (Editor+) PHP Object Injection
• PDF for Contact Form 7 <= 6.5.0 - Authenticated (Subscriber+) PHP Object Injection
• Cars4Rent <= 1.4.2 - Unauthenticated PHP Object Injection
• Image Optimizer by wps.sk <= 1.2.0 - Cross-Site Request Forgery to Bulk Image Optimization
• ThemeREX Addons <= 2.33.0 - Authenticated (Contributor+) Local File Inclusion via Shortcode
• Ivory Search <= 5.5.18 - Reflected DOM-Based Cross-Site Scripting via 's' Parameter
• WooMail - WooCommerce Email Customizer <= 3.0.34 - Authenticated (Subscriber+) Missing Authorization to SQL Injection
• ActivityPub < 8.0.2 - Unauthenticated Information Epxosure
• FindAll Listing <= 1.0.5 - Unauthenticated Privilege Escalation
• Enable Media Replace <= 4.1.6 - Authenticated (Contributor+) Stored Cross-Site Scripting via file_modified Shortcode
• Kadence Blocks — Page Builder Toolkit for Gutenberg Editor <= 3.6.3 - Missing Authorization to Authenticated (Contributor+) Media Upload
• Tin Canny Reporting for LearnDash <= 4.3.0.7 - Reflected Cross-Site Scripting
• Community Events <= 1.5.4 - Unauthenticated SQL Injection
• Shortcode Collection <= 1.4 - Authenticated (Contributor+) Stored Cross-Site Scripting
• Coaching <= 3.9.2 - Unauthenticated Stored Cross-Site Scripting
• Forms: 3rd-Party Post Again <= 0.3 - Reflected Cross-Site Scripting
• Icon Widget <= 1.3.0 - Authenticated(Contributor+) Stored Cross-Site Scripting via shortcode
• GuardGiant Brute Force Protection <= 2.2.6 - Reflected Cross-Site Scripting
• Enzy < 1.6.4 - Reflected Cross-Site Scripting
• Blue Captcha <= 1.7.4 - Reflected Cross-Site Scripting
• Makesweat <= 0.1 - Authenticated (Administrator+) Stored Cross-Site Scripting via 'makesweat_clubid' Setting
• Client Invoicing by Sprout Invoices <= 20.8.8 - Missing Authorization
• FeedStats < 2.4 - Cross-Site Scripting
• WP Review Slider < 11.0 - SQL Injection
• Demi - One Click Demo Import, Backup & Site Migration <= 0.0.6 - Unauthenticated Sensitive Data Exposure
• Tourfic <= 2.11.20 - Cross-Site Request Forgery in Multiple Functions
• bunny.net – WordPress CDN Plugin <= 2.0.1 - Authenticated (Administrator+) Stored Cross-Site Scripting
• WC Builder <= 1.0.18 - Authenticated (Contributor+) Stored Cross-Site Scripting
• CRM Perks Forms <= 1.1.0 - Reflected Cross-Site Scripting
• Grand Photography WordPress <= 5.7.8 - Reflected Cross-Site Scripting
• WordPress Portfolio Builder – Portfolio Gallery <= 1.1.7 - Missing Authorization to Unauthenticated Portfolio Update
• Custom CSS and JavaScript <= 2.0.16 - Unauthenticated Information Exposure
• Foliopress WYSIWYG < 2.6.16 - Cross-Site Scripting
• ads.txt Guru Connect <= 1.1.1 - Cross-Site Request Forgery
• Classic Editor and Classic Widgets <= 1.2.5 - Cross-Site Request Forgery via render_settings_page
• SheetDB <= 1.3.4 - Authenticated (Contributor+) Stored Cross-Site Scripting
• Prezi Embedder <= 2.1 - Authenticated (Contributor+) Stored Cross-Site Scripting
• Category Specific RSS Feed Subscription <= 2.0 - Cross-Site Request Forgery
• My Reservation System <= 2.3 - Reflected Cross-Site Scripting
• Fish House <= 1.2.7 - Unauthenticated PHP Object Injection
• WP Reactions Lite <= 1.3.3 - Cross-Site Scripting
• Total Donations <= 3.0.8 - Unauthenticated Stored Cross-Site Scripting
• News Event <= 1.0.1 - Authenticated (Subscriber+) Arbitrary File Upload
• AutomatorWP <= 5.2.5 - Authenticated (Administrator+) SQL Injection via field_conditions
• Compare Products for WooCommerce <= 3.2.1 - Unauthenticated PHP Object Injection
• Snow Monkey Forms <= 12.0.3 - Unauthenticated Arbitrary File Deletion via Path Traversal
• NotifyVisitors <= 1.0 - Authenticated (Administrator+) Stored Cross-Site Scripting via settings
• WooCommerce Product Vendors <= 2.2.2 - Missing Authorization
• Pre-Publish Checklist <= 1.1.1 - Insecure Direct Object Reference to Arbitrary Post '_ppc_meta_key' Update
• CformsII <= 15.0.1 - Unauthenticated HTML Injection & Cross-Site Request Forgery
• HT Mega – Absolute Addons for WPBakery Page Builder <= 1.0.9 - Authenticated (Contributor+) Stored Cross-Site Scripting
• Comments – wpDiscuz <= 7.6.18 - Authenticated (Contributor+) Stored Cross-Site Scripting
• WPLMS Learning Management System for WordPress, WordPress LMS <= 1.8.4.1 - Privilege Escalation
• BestWebSoft's Like & Share <= 2.73 - Unauthenticated Password Protected Post Disclosure
• Avada Builder <= 3.15.5 - Authenticated (Contributor+) Stored Cross-Site Scripting via Module Title
• Locatoraid Store Locator <= 3.9.47 - Reflected Cross-Site Scripting
• Ni CRM Lead <= 1.3.0 - Authenticated (Subscriber+) SQL Injection
• WordPress Classifieds Plugin – Ad Directory & Listings by AWP Classifieds < 3.0 - Cross-Site Scripting
• Pie Register – User Registration, Profiles & Content Restriction <= 3.8.4.8 - Missing Authorization to Unauthenticated Registration Form Status Modification
• BookingPress <= 1.0.74 - Booking Price Manipulation via bookingpress_confirm_booking
• Payment Gateway of Stripe for WooCommerce <= 5.0.8 - Unauthenticated Improper Verification of Cryptographic Signature via woocommerce_api_wt_stripe Webhook Endpoint
• Trust Form <= 2.0.0 - Cross-Site Scripting
• Barcode Scanner with Inventory & Order Manager <= 1.5.3 - Missing Authorization
• WP Next Post Navi <= 1.8.3 - Authenticated (Administrator+) Stored Cross-Site Scripting
• GMAce <= 1.5.2 - Cross-Site Request Forgery to Arbitrary File Modification (Creation/Overwrite/Deletion)
• UpdraftPlus WordPress Backup Plugin <= 1.9.50 - Nonce Leak to Authorization Bypass
• MIPL WC Multisite Sync <= 1.1.5 - Unauthenticated Arbitrary File Download
• Nexter Extension <= 4.4.1 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode
• Piotnet Addons For Elementor <= 2.4.25 - Authenticated (Contributor+) Stored Cross-Site Scripting
• JW-Player-Plugin-For-Wordpress <= 2.1.14 - Reflected Cross-Site Scripting
• Xagio SEO <= 7.1.0.16 - Unauthenticated Stored Cross-Site Scripting via 'HTTP_REFERER'
• Online Scheduling and Appointment Booking System <= 28.1 - Insecure Direct Object Reference to Unauthenticated Sensitive Data Access and Message Injection via 'conversation_id' Parameter
• Brizy – Page Builder <= 2.4.40 - Authenticated (Contributor+) Stored Cross-Site Scripting
• Horizontal scrolling announcement <= 9.2 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode
• BadgeOS <= 3.7.0 - Unauthenticated SQL Injection
• Ultimate Member < 2.0.4 - Insecure Direct Object Reference
• Product Catalog Simple <= 1.8.2 - Authenticated (Contributor+) Stored Cross-Site Scripting
• Memberships and User Profiles for WooCommerce <= 3.4 - Missing Authorization to Authenticated (Subscriber+) ProfileGrid Plugin Installation and Activation
• Smart Forms < 2.6.71 - Missing Authorization to Sensitive Information Disclosure
• Alpha Blocks <= 1.5.0 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'alpha_block_css' Post Meta
• Content Blocks (Custom Post Widget) <= 3.3.0 - Authenticated (Contributor+) Stored Cross-Site Scripting
• Attesa Extra <= 1.3.9 - Authenticated (Contributor+) Stored Cross-Site Scripting
• WHMpress <= 6.2-revision-9 - Unauthenticated Local File Inclusion
• YaySMTP <= 2.7.7 - Authenticated (Subscriber+) Arbitrary File Upload via Attachment Filename Extension
• Nexter Blocks <= 5.0.1 - Payment Bypass to Authenticated (Contributor+) Stored CSS Injection
• WordPress Zero Spam <= 2.1.1 - SQL Injection
• Product Catalog Simple <= 1.7.11 - Authenticated (Contributor+) Stored Cross-Site Scripting via show_products Shortcode
• Smart External Link Click Monitor [Link Log] <= 5.0.2 - Authenticated (Administrator+) Stored Cross-Site Scripting
• Hippoo Mobile App for WooCommerce <= 1.7.1 - Unauthenticated Arbitrary File Read
• GutenKit <= 2.2.2 - Authenticated (Contributor+) Stored Cross-Site Scripting