Vulnerability archive: section 8, page 13

Open a report to review affected versions, available fixes and original sources. Each report covers a specific issue; its presence does not establish whether your website is affected.

• Gwolle Guestbook <= 2.1.0 - Stored Cross-Site Scripting
• Doofinder <= 0.5.4 - Reflected Cross-Site Scripting
• WP Users Media <= 4.2.3 - Missing Authorization via wpusme_save_settings
• The E-Commerce ERP <= 2.1.1.3 - Missing Authorization
• Flexi <= 4.28 - Authenticated (Contributor+) Stored Cross-Site Scripting via flexi-form-tag Shortcode
• Modern Events Calendar Lite <= 6.3.0 - Unauthenticated SQL Injection
• Abandoned Cart Pro for WooCommerce <= 10.4.0 - Authenticated (Subscriber+) Privilege Escalation
• Opening Hours <= 2.3.0 - Authenticated (Admin+) Stored Cross-Site Scripting
• WP Pipes <= 1.4.1 - Reflected Cross-Site Scripting via x1 Parameter
• Booktics <= 1.0.16 - Missing Authorization
• Widget Options – The #1 WordPress Widget & Block Control Plugin <= 4.0.7 - Authenticated (Contributor+) Remote Code Execution
• Tainacan <= 1.3.0 - Authenticated (Subscriber+) Path Traversal to Arbitrary File Read via 'guid' Parameter
• MP3 Audio Player for Music, Radio & Podcast by Sonaar <= 5.5 - Authenticated (Contributor+) Stored Cross-Site Scripting via sonaar_audioplayer Shortcode
• Unyson <= 2.7.29 - Cross-Site Request Forgery
• payOS <= 1.0.61 - Cross-Site Request Forgery
• EmpowerWP <= 1.0.21 - Cross-Site Request Forgery to Notice Dismissal
• HEL Online Classroom: AI-powered Online Classrooms <= 1.0.3 - Unauthenticated Information Exposure
• Makeaholic <= 1.8.5 - Missing Authorization
• Print Labels with Barcodes. Create price tags, product labels, order labels for WooCommerce <= 3.4.6 - Improper Authorization
• MC4WP: Mailchimp Top Bar <= 1.6.0 - Reflected Cross-Site Scripting
• Ask Me Anything (Anonymously) <= 1.6 - Authenticated (Contributor+) Stored Cross-Site Scripting
• Sertifier Certificate & Badge Maker <= 1.21 - Missing Authorization
• Easy Pie Coming Soon < 1.0.1 - Cross-Site Scripting
• LOGIN AND REGISTRATION ATTEMPTS LIMIT<= 2.1 - IP Address Spoofing to Protection Mechanism Bypass
• User Frontend: AI Powered Frontend Posting, User Directory, Profile, Membership & User Registration <= 4.3.1 - Missing Authorization
• Church Admin <= 3.7.5 - Reflected Cross-Site Scripting
• WP-TopBar <= 4.02 - Cross-Site Request Forgery to Stored Cross-Site Scripting
• Responsive Gallery Grid <= 2.3.10 - Authenticated (Administrator+) Stored Cross-Site Scripting
• The Mounty | Hiking Campground & Children Camping WordPress Theme <= 1.1 - Unauthenticated Local File Inclusion
• SEO Search <= 1.1 - Cross-Site Request Forgery
• WP Time Slots Booking Form <= 1.1.76 - Cross-Site Request Forgery to Feedback Submission
• Rox Appointment Booking – Appointment Booking Scheduling Solution < 1.2.0 - Missing Authorization
• Authorize.net Payment Gateway For WooCommerce <= 8.0 - Insufficient Verification of Data Authenticity to Unauthenticated Payment Bypass
• Multiple Page Generator Plugin – MPG <= 4.0.1 - Missing Authorization
• CubeWP Framework <= 1.1.23 - Authenticated (Contributor+) Stored Cross-Site Scripting
• Arigato Autoresponder and Newsletter <= 2.5.1.8 - Reflected Cross-Site Scripting
• uListing <= 1.6.6 - Missing Authorization
• Gmedia Photo Gallery < 0.9.4 - Reflected Cross-Site Scripting
• RokNewsPager <= 1.17 - Cross-Site Scripting
• WP Contact Slider <= 2.4.7 - Authenticated (Administrator+) Stored Cross-Site Scripting
• SALESmanago <= 3.8.1 - Missing Authorization
• Front End Users <= 3.2.28 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode
• Forminator <= 1.38.2 - Reflected Cross-Site Scripting via Title Parameter
• AcyMailing – An Ultimate Newsletter Plugin and Marketing Automation Solution for WordPress <= 11.0.4 - Unauthenticated Arbitrary File Read via 'user[name]' Parameter
• Uji Popup <= 1.4.3 - Authenticated (Contributor+) Stored Cross-Site Scripting via uji_popup_code shortcode
• Advanced Order Export for WooCommerce <= 3.1.3 - Cross-Site Scripting
• NextGEN Smooth Gallery <= 1.2 - Cross-Site Scripting
• WP2LEADS | WordPress und KlickTipp einfach verbinden – WooCommerce und KlickTipp einfach verbinden <= 3.5.7 - Missing Authorization
• All-in-One WP Migration <= 2.0.2 - Authorization Bypass to Arbitrary File Upload
• Schedule <= 1.0.0 - Unauthenticated SQL Injection
• Catch Themes Demo Import <= 3.3 - Missing Authorization to Authenticated (Subscriber+) Single Plugin Installation via 'activate_plugin' Parameter
• Fix Media Library <= 2.0 - Unauthenticated Information Exposure
• Block Slider <= 2.2.3 - Missing Authorization
• Diza <= 1.3.8 - Unauthenticated Local File Inclusion
• WP Courses LMS <= 3.2.3 - Missing Authorization to Authenticated (Subscriber+) Arbitrary Options Update
• Stock Locations for WooCommerce <= 2.5.9 - Authenticated (Administrator+) Stored Cross-Site Scripting via settings
• File Manager <= 6.3 - Authenticated (Admin+) Arbitrary OS File Access via Path Traversal
• WordPress Social Login <= 2.1.5 - Cross-Site Scripting
• MyBookProgress by Stormhill Media <= 1.0.8 - Missing Authorization
• Dataverse Integration 2.77 - 2.81 - Missing Authorization to Authenticated (Subscriber+) Privilege Escalation via reset_password_link REST Route
• Url Rewrite Analyzer <= 1.3.3 - Missing Authorization
• Drag and Drop Multiple File Upload for WooCommerce <= 1.1.6 - Unauthenticated Arbitrary File Upload via upload Function
• LTL Freight Quotes – XPO Edition <= 4.3.7 - Unauthenticated SQL Injection
• Wise Chat <= 2.8.3 - CSV Injection
• URL Media Uploader <= 1.0.1 - Missing Authorization to Authenticated (Contributor+) Safe File Upload
• WPBakery Page Builder Addons by Livemesh <= 3.9.4 - Authenticated (Contributor+) Stored Cross-Site Scripting
• HashThemes Demo Importer <= 1.4.3 - Authenticated (Author+) Stored Cross-Site Scripting
• Share This Image <= 2.02 - Authenticated (Contributor+) Stored Cross-Site Scripting via STI Buttons Shortcode
• Quttera Web Malware Scanner <= 3.4.1.48 - Sensitive Data Exposure
• Comments Import & Export 2.1.11 - 2.5.3 - Authenticated (Author+) Information Exposure
• Ultimate Auction <= 4.2.5 - Cross-Site Request Forgery
• WPGlobus Translate Options <= 2.1.0 - Reflected Cross-Site Scripting via page
• Inventory Presser <= 15.2.6 - Authenticated (Administrator+) Stored Cross-Site Scripting
• Accordion Slider PRO <= 1.2 - Reflected Cross-Site Scripting
• TK Google Fonts GDPR Compliant <= 2.2.7 - Authorization Bypass
• Themify Shortcodes <= 2.0.8 - Authenticated (Contributor+) Stored Cross-Site Scripting
• Easy Digital Downloads (Various Versions) - Cross-Site Scripting
• Swatchly – WooCommerce Variation Swatches for Products (product attributes: Image swatch, Color swatches, Label swatches) 1.2.8 - 1.4.0 - Missing Authorization to Authenticated (Subscriber+) Limited Options Update
• Super Edit <= 2.5.4 - Reflected Cross-Site Scripting
• Keep Backup Daily <= 2.1.3 - Unauthenticated Sensitive Information Exposure
• Blue Wrench Video Widget <= 2.1.0 - Reflected Cross-Site Scripting
• WPFunnels <= 3.0.6 - Authenticated (Administrator+) Stored Cross-Site Scripting
• Poll Maker by AYS <= 6.3.7 - Authenticated (Subscriber+) Sensitive Information Exposure in 'ays_poll_get_user_information' AJAX Action
• WP Ultimate CSV Importer <= 6.4.0 - Arbitrary File Upload
• Kit (formerly ConvertKit) for WooCommerce <= 2.1.5 - Unauthenticated Information Exposure
• Livemesh SiteOrigin Widgets <= 3.9.2 - Missing Authorization to Authenticated (Subscriber+) Stored Cross-Site Scripting
• Photos, Files, YouTube, Twitter, Instagram, TikTok, Ecommerce Contest Gallery – Upload, Vote, Sell via PayPal or Stripe, Social Share Buttons, OpenAI <= 26.1.0 - Unauthenticated Stored Cross-Site Scripting
• Sideblog WordPress Plugin <= 6.0 - Cross-Site Request Forgery to Settings Update and Stored Cross-Site Scripting
• Photo Gallery – Responsive Image Galleries by Supsystic <= 1.21.0 - Cross-Site Request Forgery
• Import and export users and customers <= 1.16.3.5 - CSV injection via a customer's profile
• Relogo <= 0.4.2 - Authenticated (Author+) Stored Cross-Site Scripting via SVG File Upload
• Listamester <= 2.3.5 - Authenticated (Contributor+) Stored Cross-Site Scripting
• WooCommerce Anti-Fraud <= 7.2.6 - Missing Authorization
• Rara One Click Demo Import <= 1.2.9 - Cross-Site Request Forgery to Arbitrary File Upload
• User Registration & Membership <= 5.2.2 - Missing Authorization to Unauthenticated User Deletion via Stripe Handler
• Campaign Monitor for WordPress <= 2.8.15 - Unauthenticated Full Path Disclosure
• Import Users to MailChimp <= 1.0 - Cross-Site Request Forgery to Stored Cross-Site Scripting
• Accept Stripe Payments <= 2.0.86 - Authenticated (Contributor+) Stored Cross-Site Scripting via accept_stripe_payment_ng Shortcode
• LiveChat <= 4.5.15 - Cross-Site Request Forgery
• Contact Form 7 Campaign Monitor Extension <= 0.4.67 - Missing Authorization to Unauthenticated Arbitrary File Deletion