Vulnerability archive: section 7, page 15

Open a report to review affected versions, available fixes and original sources. Each report covers a specific issue; its presence does not establish whether your website is affected.

• Schema & Structured Data for WP & AMP <= 1.54 - Authenticated (Contributor+) Stored Cross-Site Scripting via User Custom Schema
• News & Blog Designer Pack <= 3.2 - Authenticated (Contributor+) Stored Cross-Site SQcripting via Shortcode
• Uk Cookie <= 1.1 - Cross-Site Scripting
• Throws SPAM Away <= 3.3 - Cross-Site Request Forgery to Comment Modification
• Image Photo Gallery Final Tiles Grid <= 3.6.9 - Missing Authorization to Authenticated (Contributor+) Arbitrary Gallery Management
• Online Scheduling and Appointment Booking System <= 28.2 - Insecure Direct Object Reference to Unauthenticated Arbitrary Booking Token Disclosure and Deletion via 'order_id' Parameter
• HT Mega – Absolute Addons For Elementor <= 2.9.1 - Authenticated (Author+) Sensitive Information Exposure
• Modern Events Calendar Lite <= 6.3.0 - Stored Cross-Site Scripting
• Universal Analytics Injector <= 1.0.3 - Cross-Site Request Forgery to Stored Cross-Site Scripting
• SEO Smart Links <= 3.0.1 - Authenticated (Administrator+) Stored Cross-Site Scripting
• ProfileGrid <= 5.9.5.0 - Authenticated (Subscriber+) SQL Injection
• Spider Facebook <= 1.0.15 - Reflected Cross-Site Scripting
• WPQA - Builder forms Addon For WordPress < 5.2 - Insecure Direct Object Reference to Private Message Disclosure
• Subscribe to Comments <= 2.1.2 - Local File Includion
• PhonePe Payment Solutions <= 1.0.15 - Authenticated (Subscriber+) Server-Side Request Forgery
• Click & Tweet <= 0.8.9 - Authenticated (Administrator+) Stored Cross-Site Scripting
• Frontend Admin by DynamiApps <= 3.25.1 - Unauthenticated SQL Injection
• MonsterInsights – Google Analytics Dashboard for WordPress (Website Stats Made Easy) <= 5.3.3 - Cross-Site Scripting
• Easy Chart Builder for WordPress <= 1.3 - Authenticated (Contributor+) Stored Cross-Site Scripting
• Consulting Elementor Widgets <= 1.3.0 - Authenticated (Contributor+) Local File Inclusion
• WP Last Modified <= 0.1 - Authenticated (Administrator+) Stored Cross-Site Scripting
• pagebar <= 2.65 - Cross-Site Request Forgery to Settings Update and Cross-Site Scripting
• Manage Calameo Publications by Athlon < 1.1.1 - Reflected Cross-Site Scripting
• Laybuy Payment Extension for WooCommerce <= 5.3.9 - Missing Authorization
• Flynax Bridge <= 2.2.0 - Unauthenticated Arbitrary User Deletion
• TypeSquare Webfonts for ConoHa <= 2.0.4 - Missing Authorization to Authenticated (Subscriber+) Plugin Settings Modification via 'fontThemeUseType' Parameter
• ProfilePress <= 4.5.4 - Unauthenticated Stored Cross-Site Scripting
• Just Writing Statistics <= 4.5 - Authenticated (Admin+) Stored Cross-Site Scripting
• Mail Masta <= 1.0 - SQL Injection via id parameter
• Comments Extra Fields For Post,Pages and CPT <= 5.0 - Cross-Site Request Forgery
• Image Hover Effects Ultimate <= 9.6.1 - Unauthenticated Arbitrary Options Update
• Avada <= 7.11.5 - Authenticated(Contributor+) Sensitive Information Exposure via Form Entries
• Paymob for WooCommerce <= 4.1.13 - Missing Authorization
• Material Dashboard <= 1.4.5 - Unauthenticated Local File Inclusion
• Google XML News Sitemap plugin <= 0.02 - Cross-Site Request Forgery to Stored Cross-Site Scripting
• Smart Popup by Supsystic <= 1.13.2 - Authenticated (Administrator+) SQL Injection via 'sidx' Parameter
• Anchor Episodes Index (Spotify for Podcasters) <= 2.1.7 - Authenticated (Contributor+) Stored Cross-Site Scripting
• S-DEV SEO <= 1.88 - Authenticated (Contributor+) Stored Cross-Site Scripting
• Easy Testimonials <= 3.5.2 - Stored Cross-Site Scripting
• My Tickets <= 2.1.0 - Missing Authorization
• miniOrange's Google Authenticator <= 5.5.7 - Reflected Cross-Site Scripting
• Import and export users and customers <= 1.27.12 - Unauthenticated Sensitive Information Disclosure
• Import and export users and customers <= 1.26.6.1 - Authenticated (Administrator+) Stored Cross-Site Scripting
• Honor | Shooting Club & Weapon and Gun Store Theme <= 2.3 - Unauthenticated Local File Inclusion
• WCFM – Frontend Manager for WooCommerce along with Bookings Subscription Listings Compatible <= 6.7.25 - Authenticated (Vendor+) Insecure Direct Object Reference to Arbitrary User Deletion
• Lendiz < 2.0.1 - Authenticated (Subscriber+) Arbitrary File Upload
• AMP for WP <= 1.1.16 - Unauthenticated Stored Cross-Site Scripting via Comment Content Regex Transformation
• GTranslate <= 5.0.0 - Unauthenticated Arbitrary Shortcode Execution
• Jannah < 7.5.1 - Unauthenticated Local File Inclusion
• WooCommerce Beta Tester < 2.2.4 - Authenticated (Administrator+) SQL Injection
• Gutenberg Blocks by Kadence Blocks – Page Builder Features <= 3.2.34 - Authenticated (Contributor+) Stored Cross-Site Scripting
• Kargo Takip < 0.2.4 - Missing Authorization
• HAL <= 2.1.1 Authenticated Stored Cross-Site Scripting
• Simple Download Monitor <= 3.9.8 - Multiple Cross-Site Request Forgery vulnerabilities
• Event Tickets and Registration <= 5.29.2.1 - Unauthenticated Stored Cross-Site Scripting
• Website File Changes Monitor <= 1.8.2 - Authenticated (Admin+) SQL Injection
• Weaver Show Posts <= 1.6 - Authenticated(Contributor+) Stored Cross-Site Scripting via Display Name
• Generate PDF using Contact Form 7 <= 4.1.2 - Cross-Site Request Forgery
• Download Monitor <= 3.3.5.8 - Reflected Cross-Site Scripting
• Swifty Bar, sticky bar by WPGens <= 1.2.10 - Authenticated (Administrator+) Stored Cross-Site Scripting
• LifterLMS PayPal < 1.4.0 - Reflected Cross-Site Scripting
• Quotes llama <= 3.0.1 - Authenticated (Contributor+) Stored Cross-Site Scripting
• Real 3D Flipbook <= 5.1.1 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'lightboxtext' Shortcode Attribute
• SureDash <= 1.0.3 - Authenticated (Subscriber+) Privilege Escalation
• HC Custom WP-Admin URL <= 1.4 - Cross-Site Request Forgery
• All-In-One Security (AIOS) <= 5.1.4 - Authenticated(Admin+) Directory Traversal
• Groundhogg <= 2.7.9.8 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode
• Localize Remote Images <= 1.0.9 - Cross-Site Request Forgery via admin menu
• Data Tables Generator by Supsystic <= 1.12.03 - Authenticated (Contributor+) Stored Cross-Site Scripting via Table 'id' HTML Attribute
• Easy Digital Downloads - Cross-Sell and Upsell <= 1.1.2 - Reflected Cross-Site Scripting
• Kicker - Blog Magazine Theme <= 2.2.1 - Unauthenticated PHP Object Injection
• WPSchoolPress <= 2.2.4 - Authenticated(Teacher+) SQL Injection via ClassID
• WPCafe <= 2.2.23 - Unauthenticated Blind Server-Side Request Forgery
• Pods <= 2.7.26 - Authenticated Stored Cross-Site Scripting via Menu Label field
• Count Per Day <= 3.2.3 - Path Disclosure and Denial of Service
• Easy Form Builder <= 3.8.20 - Missing Authorization
• Limit Login Attempts Plus <= 1.0.9 - Authenticated (Administrator+) Stored Cross-Site Scripting
• 3D Photo Gallery <= 1.3 - Missing Authorization to Authenticated (Subscriber+) Stored Cross-Site Scripting
• OpenCart Product Display <= 1.0 - Authenticated (Contributor+) Stored Cross-Site Scripting
• WordPress 6.9 - 6.9.1 - Missing Authorization to Authenticated (Subscriber+) Arbitrary Note Creation via REST API
• Connections Business Directory < 8.5.9 - Cross-Site Scripting
• Webico Slider Flatsome Addons <= 2.0.1 - Authenticated (Contributor+) Stored Cross-Site Scripting via wbc_image Shortcode
• Better Find and Replace – AI-Powered Suggestions <= 1.7.9 - Authenticated (Author+) Stored Cross-Site Scripting via Uploaded Image Title
• ProSolution WP Client <= 1.9.9 - Unauthenticated Arbitrary File Upload via proSol_fileUploadProcess
• WooCommerce AJAX Product Filters <= 1.3.6 - Arbitrary Settings Update
• Current Book <= 1.0.1 - Authenticated Stored Cross-Site Scripting
• s2Member <= 260804 - Authenticated (Contributor+) Stored Cross-Site Scripting
• Google XML Sitemap for Images <= 2.1.3 - Cross-Site Request Forgery via image_sitemap_generate
• Social proof testimonials and reviews by Repuso <= 5.29 - Missing Authorization
• LiteSpeed Cache <= 7.7 - Authenticated (Author+) Stored Cross-Site Scripting via img Tag Attributes
• CP Multi View Event Calendar <= 1.4.13 - Insufficient Authorization
• User Registration & Membership <= 5.2.1 - Unauthenticated PayPal Bypass to Membership Activation
• CMS Tree Page View <= 1.6.7 - Reflected Cross-Site Scripting via 'post_type'
• WPAdverts <= 2.2.2 - Authenticated (Contributor+) Local File Inclusion
• WP Timeline – Vertical and Horizontal timeline plugin <= 3.6.7 - Reflected Cross-Site Scripting
• Magic Login Mail or QR Code <= 2.05 - Unauthenticated Privilege Escalation via Insecure QR Code File Storage
• Ultimate Member <= 2.1.11 - Unauthenticated Privilege Escalation via User Meta
• Weberino Timed Quiz <= 0.6.0 - Authenticated (Contributor+) Stored Cross-Site Scripting
• Contact Form 7 Anti Spambot <= 1.0.1 - Missing Authorization
• Simple Events Calendar <= 1.4.0 - Authenticated SQL Injection