Vulnerability archive: section 7, page 9

Open a report to review affected versions, available fixes and original sources. Each report covers a specific issue; its presence does not establish whether your website is affected.

• Rara Business <= 1.2.5 - Cross-Site Request Forgery to Notice Dismissal
• ENL Newsletter <= 1.0.1 - Cross-Site Request Forgery to Campaign Deletion
• Locatoraid Store Locator <= 3.9.18 - Authenticated (Subscriber+) Stored Cross-Site Scripting
• Team Members <= 5.0.3 - Authenticated Cross-Site Scripting
• Lenxel Core for Lenxel(LNX) LMS <= 1.2.3 - Authenticated (Author+) Stored Cross-Site Scripting via SVG File Upload
• Elementor Addons by Livemesh <= 8.3.6 - Authenticated(Contributor+) Stored Cross-Site Scripting via widget _id attribute
• Htaccess File Editor <= 1.0.18 - Missing Authorization
• Eventer <= 3.9.8 - Unauthenticated SQL Injection via eventer_get_attendees
• Quotes and Tips by BestWebSoft < 1.20 - Cross-Site Scripting
• Debug Log Manager <= 2.3.1 - Missing Authorization
• Ad Inserter <= 2.8.18 - Reflected Cross-Site Scripting via 's' Search Parameter
• Weaver Xtreme Theme Support <= 6.2.5 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode
• JetFormBuilder — Dynamic Blocks Form Builder < 3.6.5.2 - Unauthenticated Arbitrary Shortcode Execution
• Bit Form – Contact Form, Payment Forms, Multi Step Forms, Calculator & Custom Form Builder < 3.1.2 - Missing Authorization to Unauthenticated Unauthorized Form Submission
• Play.ht – Make Your Blog Posts Accessible With Text to Speech Audio <= 3.6.4 - Cross-Site Request Forgery
• WP VR <= 8.3.4 - Reflected Cross-Site Scripting
• TinyMCE Color Picker <= 1.1 - Missing Authorization
• SupportFlow <= 0.6 - Cross-Site Scripting via a ticket excerpt.
• AWP Classifieds <= 4.2.1 - Unauthenticated SQL Injection
• ZoloBlocks <= 2.3.11 - Missing Authorization
• Visualizer: Tables and Charts Manager <= 4.0.5 - Authenticated (Contributor+) Server-Side Request Forgery
• WP Compress <= 7.10.09 - Cross-Site Request Forgery to Arbitrary Options Deletion
• Everest Forms – Contact Form, Payment Form, Quiz, Survey & Custom Form Builder with AI <= 3.5.2 - Missing Authorization to Authenticated (Delegated+) Arbitrary Plugin Activation via REST API and AJAX Endpoints
• ImageRecycle pdf & image compression <= 3.1.13 - Missing Authorization to Settings Update in stopOptimizeAll
• Web Stories <= 1.24.0 - Server Side Request Forgery
• Page Visits Counter – Lite <= 1.2.3 - Unauthenticated Stored Cross-Site Scripting
• WP-Hijri <= 1.5.3 - Reflected Cross-Site Scripting
• WordPress Core < 5.0.1 - Authenticated Stored Cross-Site Scripting via Comments
• WordPress Comments Import & Export <= 2.3.1 - CSV Injection
• W3 Total Cache <= 0.9.7.3 - Server Side Request Forgery
• Au Pair Agency - Babysitting & Nanny Theme <= 1.2.2 - Unauthenticated PHP Object Injection
• Events Manager <= 5.8.1.1 - Cross-Site Scripting
• Doppler Forms <= 2.5.1 - Cross-Site Request Forgery to Stored Cross-Site Scripting
• Download Manager <= 3.2.99 - Authenticated (Contributor+) Stored Cross-Site Scripting
• WP Events Manager <= 2.2.1 - Missing Authorization
• Funnelforms Free <= 3.8 - Missing Authorization
• Wallet System for WooCommerce – Digital Wallet, Buy Now Pay Later (BNPL), Instant Cashback, Referral program, Partial & Subscription Payments < 2.8.0 - Authenticated (Subscriber+) Fraudulent Wallet Balance Manipulation
• CM Registration – Tailored tool for seamless login and invitation-based registrations <= 2.5.6 - Open Redirect
• Movie Booking <= 1.1.5 - Unauthenticated Arbitrary File Deletion
• WP Matterport Shortcode <= 2.1.9 - Cross-Site Request Forgery
• Primer MyData for Woocommerce <= 4.2.1 - Reflected Cross-Site Scripting
• Twitch Player <= 2.1.3 - Missing Authorization
• DirectoryPress – Business Directory And Classified Ad Listing <= 3.6.25 - Missing Authorization
• Diza <= 1.3.15 - Unauthenticated Local File Inclusion
• InstaWP Connect – 1-click WP Staging & Migration <= 0.1.0.38 - Missing Authorization to Unauthenticated API setup/Arbitrary Options Update/Administrative User Creation
• TH Advance Product Search <= 1.1.4 - Missing Authorization to Plugin Settings Reset
• Social Sharing Toolkit <= 2.1.1 - Cross-Site Request Forgery
• YayCurrency <= 3.3 - Missing Authorization to Unauthenticated Arbitrary Post Deletion
• Booking Calendar Contact Form <= 1.0.23 - Shortcode SQL Injection
• White Label CMS <= 2.7.12 - Authenticated (Administrator+) Stored Cross-Site Scripting via Import Settings
• Hide My WP Lite <= 1.3 - Unauthenticated Path Traversal to Arbitrary File Read via 'he_wrapper_js' Parameter
• Contact Form 7 AWeber Extension <= 0.1.42 - Missing Authorization to Authenticated (Subscriber+) Log Reset
• Whizzy <= 1.1.18 - Authenticated (Subscriber+) Insecure Direct Object Reference
• WPML <= 4.6.0 - Reflected Cross-Site Scripting via wp_lang
• ClickWhale <= 2.5.0 - Authenticated (Admin+) SQL injection
• LearnPress <= 4.4.10 - Unauthenticated PHP Object Injection via 'checkout-email' Parameter
• Cal.com <= 1.0.0 - Authenticated (Contributor+) Stored Cross-Site Scripting
• Generic Elements <= 1.2.8 - Authenticated (Contributor+) Stored Cross-Site Scripting
• MasterStudy LMS <= 3.3.0 - Unauthenticated Local File Inclusion via modal
• Tooltip CK <= 2.2.15 - Authenticated (Admin+) Stored Cross-Site Scripting
• GS Shots for Dribbble <= 1.2.0 - Authenticated (Contributor+) Stored Cross-Site Scripting
• //// WP BORN BABIES PLUGIN /// <= 1.0 - Authenticated (Contributor+) Cross-Site Scripting
• Giveaways and Contests by RafflePress <= 1.12.26 - Unauthenticated Information Exposure
• Booknetic <= 4.8.5 - Missing Authorization
• Galleria <= 1.0.3 - Cross-Site Request Forgery via showOptionsPage
• Sync Feedly <= 1.0.1 - Cross-Site Request Forgery to Sync Trigger
• W3 Total Cache <= 0.9.4.1 - Arbitrary File Upload
• Modern Footnotes <= 1.4.19 - Authenticated (Contributor+) Stored Cross-Site Scripting
• CMB2 <= 2.10.1 - Authenticated (Contributor+) PHP Object Injection
• InPost Gallery <= 2.1.4.5 - Authenticated (Subscriber+) Local File Inclusion
• Axioma Premium Responsive < 1.1.2 - Information Disclosure
• Lead capture, gated content & newsletter opt-ins <= 7.4.857 - Authenticated (Contributor+) Stored Cross-Site Scripting
• faq shortocde <= 1.0 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'color' Shortcode Attribute
• SEO Change Monitor <= 1.2 - Authenticated (Subscriber+) SQL Injection
• SG Helper <= 1.0 - Authenticated (Administrator+) Stored Cross-Site Scripting via SVG File Upload
• WordPress Backup & Migration <= 1.4.7 - Unauthenticated Sensitive Information Exposure
• Custom PC Builder Lite for WooCommerce <= 1.0.1 - Missing Authorization to Unauthenticated Settings Update
• Easy Woocommerce Customizer <= 1.0.2 - Reflected Cross-Site Scripting
• Post and Page Builder by BoldGrid – Visual Drag and Drop Editor <= 1.27.14 - Unauthenticated Stored Cross-Site Scripting
• WooCommerce <= 2.2.2 - Reflected Cross-Site Scripting
• Otter Blocks – Gutenberg Blocks, Page Builder for Gutenberg Editor & FSE <= 2.6.8 - Authenticated (Author+) Limited File Upload to Stored Cross-Site Scripting
• Blog, Posts and Category Filter for Elementor <= 1.0.3 - Authenticated (Contributor+) Stored Cross-Site Scripting via Post and Category Filter Widget
• Realtyna Organic IDX plugin + WPL Real Estate <= 5.1.0 - Unauthenticated SQL Injection
• WP Statistics <= 14.16.4 - Missing Authorization to Authenticated (Subscriber+) Sensitive Information Exposure and Privacy Audit Manipulation
• ShortPixel Image Optimizer – Optimize Images, Convert WebP & AVIF <= 6.5.5 - Authenticated (Subscriber+) PHP Object Injection
• WoodMart <= 8.3.7 - Unauthenticated Arbitrary Shortcode Execution
• Weaver Xtreme Theme Support <= 6.4 - Authenticated (Contributor+) Stored Cross-Site Scripting via div Shortcode
• Ultimate GDPR & CCPA <= 2.4 - Unauthenticated Settings Import & Export
• TI WooCommerce Wishlist / TI WooCommerce Wishlist Pro < 1.40.1 - Unauthenticated SQL Injection
• WP Full Stripe Free <= 7.0.5 - Authenticated (Administrator+) Stored Cross-Site Scripting
• Photo Gallery by 10Web – Mobile-Friendly Image Gallery <= 1.8.21 - Reflected Cross-Site Scripting via 'image_id'
• Honeypot for WP Comment <= 2.2.3 - Directory Traversal to Unauthenticated Arbitrary File Deletion
• Dynamic Pricing & Discounts Lite for WooCommerce <= 2.0.3 - Cross-Site Request Forgery
• WooCommerce PDF Invoices & Packing Slips <= 2.10.4 - Reflected Cross-Site Scripting via tab and section parameter
• Essential Real Estate <= 5.2.2 - Authenticated (ERE Customer+) Insecure Direct Object Reference
• ENL Newsletter <= 1.0.1 - Authenticated (Admin+) SQL Injection
• Video Slider WordPress <= 1.4.6 - Authenticated (Admin+) Cross-Site Scripting
• Fancy Product Designer | WooCommerce WordPress <= 6.4.8 - Unauthenticated Information Disclosure and PHAR Deserialization via 'url' Parameter
• Ninja Popups <= 4.7.7 - Open Redirect
• System Dashboard <= 2.8.7 - Missing Authorization to Information Disclosure (sd_global_value)