Vulnerability archive: section 8, page 12

Open a report to review affected versions, available fixes and original sources. Each report covers a specific issue; its presence does not establish whether your website is affected.

• Sleekplan <= 0.2.0 - Reflected Cross-Site Scripting
• Ninja Forms <= 3.8.4 - Authenticated (Subscriber+) Arbitrary Shortcode Execution
• Horoscope And Tarot <= 1.3.0 - Authenticated (Contributor+) Stored Cross-Site Scripting
• Booster Plus for WooCommerce < 7.1.2 - Missing Authorization to Arbitrary Page/Post Deletion
• ANAC XML Bandi di Gara <= 7.5 - Cross-Site Request Forgery via settings.php
• Post to Social Media – WordPress to Hootsuite <= 1.5.9 - Cross-Site Request Forgery
• Amazon JS <= 0.10 - Authenticated (Contributor+) Stored Cross Site Scripting via Shortcode
• Taskbuilder <= 5.0.2 - Missing Authorization to Authenticated (Subscriber+) Arbitrary Project/Task Comment Creation
• Currency Converter Widget <= 3.0.2 - Authenticated (Contributor+) Stored Cross-Site Scripting via shortcode
• Easy Jump Links Menus <= 1.0.0 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode Attributes
• WordPress File Upload / WordPress File Upload Pro <= 4.19.1 - Authenticated (Administrator+) Path Traversal
• Scroll Triggered Box <= 2.3 - Authenticated (Editor+) Stored Cross-Site Scripting
• Post SMTP <= 3.8.0 - Missing Authorization to Authenticated (Subscriber+) Office 365 OAuth Configuration Overwrite
• ProcessingJS for WordPress <= 1.2.2 - Authenticated (Contributor+) Stored Cross-Site Scripting
• WP Debugging <= 2.10.2 - Unauthenticated Plugin Settings Update
• miniOrange 2FA <= 6.2.6 - Missing Authorization
• Passster – Password Protect Pages and Content <= 4.3.13 - Missing Authorization
• Gauge <= 6.56.4 - Missing Authorization
• Sassy Social Share <= 3.3.73 - Open Redirect
• Kanban Boards for WordPress <= 2.5.20 - Authenticated (Administrator+) Stored Cross-Site Scripting
• Payment Plugins for Stripe WooCommerce <= 4.0.7 - Missing Authorization to Unauthenticated Arbitrary Order Status Modification via Empty Webhook Secret
• FourSquare Checkins < 1.3 - Cross-Site Request Forgery to Cross-Site Scripting
• WP Video Lightbox <= 1.9.2 - Contributor+ Stored Cross-Site Scripting
• Google Doc Embedder < 2.5.17 - SQL Injection
• Gallery Plugin for WordPress – Envira Photo Gallery <= 1.11.0 - Missing Authorization to Authenticated (Contributor+) Gallery Conversion
• GoUrl Bitcoin Payment Gateway & Paid Downloads & Membership <= 1.4.13 - Arbitrary File Upload
• AMP for WP <= 0.9.97.19 - Missing Authorization
• AffiliateX 1.0.0 - 1.3.9.3 - Authenticated (Subscriber+) Missing Authorization to Stored Cross-Site Scripting via save_customization_settings
• TH Side Cart and Menu Cart for Woocommerce <= 1.1.1 - Missing Authorization
• WordPress Auction Plugin <= 3.7 - Authenticated (Editor+) SQL Injection
• WordPress Gallery Plugin – NextGEN Gallery <= 2.2.46 - Sensitive Information Disclosure
• Kiddy <= 2.0.8 - Unauthenticated Local File Inclusion
• The Events Calendar <= 6.15.17 - Authenticated (Author+) Arbitrary File Read via ajax_create_import
• Backup and Staging by WP Time Capsule <= 1.22.25 - Missing Authorization
• Google Calendar Events <= 3.2.7 - Authenticated (Contributor+) Stored Cross-Site Scripting via shortcode
• Audiomack <= 1.4.8 - Authenticated (Contributor+) Stored Cross-Site Scripting
• WP Links Page <= 4.9.5 - Missing Authorization to Authenticated (Subscriber+) Limited Image Update
• SlimStat Analytics <= 5.3.1 - Authenticated (Subscriber+) SQL Injection via `args` Parameter
• Quiz and Survey Master (QSM) <= 9.2.0 - Authenticated (Admin+) Stored Cross-Site Scripting
• Safe Editor < 1.2 - Cross-Site Scripting
• FV Flowplayer Video Player <= 6.0.3.3 - Stored Cross-Site Scripting
• Restaurant Menu – Food Ordering System – Table Reservation <= 2.3.5 - Authenticated (Contributor+) Cross-Site Scripting
• WP All Import – Drag & Drop Import for CSV, XML, Excel & Google Sheets <= 4.0.1 - Authenticated (Administrator+) SQL Injection
• User Frontend 2.5.8 - 4.3.11 - Missing Authorization
• Product Catalog Simple <= 1.8.1 - Authenticated (Contributor+) Stored Cross-Site Scripting
• Permalink Manager Lite <= 2.4.3.3 - Reflected Cross-Site Scripting
• 6Storage Rentals <= 2.28.0 - Unauthenticated Account Takeover via 'email' Parameter
• WappPress <= 5.0.3 - Unauthenticated Arbitrary File Upload
• Gutenverse <= 3.1.0 - Authenticated (Contributor+) Stored Cross-Site Scripting via Animated Text and Fun Fact Blocks
• Cookies Pro <= 1.0 - Cross-Site Request Forgery to Stored Cross-Site Scripting
• Easy Digital Downloads – eCommerce Payments and Subscriptions made easy <= 3.6.5 - Missing Authorization
• Import any XML or CSV File to WordPress <= 3.6.2 - Authenticated Stored Cross-Site Scripting
• XO Security < 1.5.3 - Cross-Site Scripting
• ContentLock <= 1.0.3 - Cross-Site Request Forgery to Settings Update
• WP Pipes <= 1.4.3 - Unauthenticated Arbitrary File Deletion
• Ninja Forms - Excel Export <= 3.3.6 - Missing Authorization to Authenticated (Subscriber+) XLS Write via Path Traversal
• Quick Interest Slider <= 3.1.5 - Authenticated (Contributor+) Stored Cross-Site Scripting
• Transposh WordPress Translation <= 1.0.7 - Reflected Cross-Site Scripting via tp_tp
• WC Vendors – WooCommerce Multivendor, WooCommerce Marketplace, Product Vendors <= 2.6.4 - Cross-Site Request Forgery to Vendor Product Deletion
• Confetti Fall Animation <= 1.3.1 - Authenticated (Contributor+) Stored Cross-Site Scripting via confetti-fall-animation Shortcode
• Private Only <= 3.5.1 - Multiple Cross-Site Request Forgery
• Alphabetical List <= 1.0.3 - Cross-Site Request Forgery to Settings Update
• Wufoo Shortcode <= 1.51 - Authenticated (Contributor+) Cross-Site Scripting via Shortcodes
• ChatBot <= 4.4.8 - Authenticated (Subscriber+) Stored Cross-Site Scripting via openai_settings_option_callback
• Simple User Capabilities <= 1.0 - Missing Authorization to Authenticated (Subscriber+) Privilege Escalation
• Interactive World Maps <= 2.4.14 - Reflected Cross-Site Scripting
• Nextend Social Login and Register <= 3.1.21 - Cross-Site Request Forgery to Unlink User Social Login
• User Meta <= 3.0 - Unauthenticated Sensitive Information Exposure
• Classified Listing – AI-Powered Classified ads & Business Directory <= 5.4.2 - Unauthenticated Stored Cross-Site Scripting
• Webriti SMTP Mail <= 1.0 - Cross-Site Request Forgery to options update
• MW WP Form <= 5.0.6 - Authenticated (Editor+) Stored Cross-Site Scripting
• WPForms Google Sheet Connector <= 3.4.5 - Reflected Cross-Site Scripting
• Metadata SEO <= 2.3 - Authenticated (Contributor+) Stored Cross-Site Scripting
• Sidebar Manager Light <= 1.18 - Cross-Site Request Forgery
• Solid Security <= 9.3.1 - IP Address Spoofing to Denial of Service
• WP Clone any post type <= 3.6 - Open Redirect
• All-in-one Floating Contact Form – My Sticky Elements <= 2.1.3 - Missing Authorization
• UltraPress <= 1.2.2 - Authenticated (Contributor+) PHP Object Injection
• White Label CMS < 1.5.1 - Cross-Site Scripting
• MainWP Child < 3.4.5 - Authentication Bypass
• AutomatorWP <= 5.8.4 - Missing Authorization to Authenticated (Subscriber+) Sensitive Information Disclosure via automatorwp_convertkit_get_forms AJAX Action
• Drag and Drop Multiple File Upload for Contact Form 7 <= 1.3.9.2 - Missing Authorization to Unauthenticated File Deletion
• Library Bookshelves <= 5.8 - Reflected Cross-Site Scripting
• 10Web Map Builder for Google Maps <= 1.0.73 - Missing Authorization to Notice Dismissal
• ReviewX <= 1.6.17 - Missing Authorization in rx_coupon_from_submit
• WP Tabs <= 2.2.6 - Authenticated (Admin+) Stored Cross-Site Scripting
• Assembly <= 1.1 - Unauthenticated Local File Inclusion
• Inline Tweets <= 2.0 - Unauthenticated Stored Cross-Site Scripting
• Change WP URL <= 1.0 - Cross-Site Request Forgery to Settings Update
• WP Scriptcase <= 2.0.0 - Authenticated (Contributor+) Stored Cross-Site Scripting via url Parameter
• ShiftCV - Blog \ Resume \ Portfolio \ WordPress Theme <= 3.0.14 - Unauthenticated PHP Object Injection
• Invisible Anti-Spam & CAPTCHA <= 5.1 - Unauthenticated Stored Cross-Site Scripting via 'action' Parameter
• WP Social Stream <= 1.1 - Cross-Site Request Forgery to Stored Cross-Site Scripting
• CITS Support svg, webp Media and TTF,OTF File Upload, Use Custom Fonts <= 4.2 - Cross-Site Request Forgery to Settings Update
• Directorist Social Login <= 2.1.1 - Unauthenticated Privilege Escalation
• WP Armour Extended <= 1.26 - Cross-Site Request Forgery
• Best WordPress Shortcode Plugin in 2025 – AIO Shortcodes <= 1.3.0 - Unauthenticated Stored Cross-Site Scripting
• Passster <= 3.5.5.8 - Missing Authentication leading to Sensitive Information Disclosure (Private Post Leakage)
• Newsletter <= 9.3.8 - Reflected Cross-Site Scripting via 'nn' Parameter
• Forminator Forms <= 1.57.2.0 - Missing Authorization to Unauthenticated Arbitrary Post Meta Injection