Vulnerability archive: section 8, page 17

Open a report to review affected versions, available fixes and original sources. Each report covers a specific issue; its presence does not establish whether your website is affected.

• HBLPAY Payment Gateway for WooCommerce <= 5.0.0 - Reflected Cross-Site Scripting via 'cusdata' Parameter
• MeetingHub <= 1.23.9 - Missing Authorization
• PowerPack Elementor Addons (Free Widgets, Extensions and Templates) <= 2.9.0 - Authenticated (Contributor+) Stored Cross-Site Scripting
• Unlimited Elements For Elementor (Free Widgets, Addons, Templates) <= 1.5.140 - Authenticated (Contributor+) Stored Cross-Site Scripting via Transparent Split Hero Widget
• Piraeus Bank WooCommerce Payment Gateway 3.2.0 - Missing Authorization
• Inspiro Pro <= 7.2.2 - Authenticated (Contributor+) Stored Cross-Site Scripting
• Solar Wizard Lite <= 1.2.4 - Authenticated (Contributor+) Stored Cross-Site Scripting
• Jeg Kit for Elementor <= 3.2.19 - Missing Authorization to Authenticated (Subscriber+) Sensitive Information Exposure via 'jeg_find_author' AJAX Action
• Easy Digital Downloads – eCommerce Payments and Subscriptions made easy <= 3.7.1 - Missing Authorization
• WP Google Map Plugin <= 4.0.9 - Cross-Site Request Forgery to PHP Object Injection
• Truebooker - Appointment Booking and Scheduler Plugin <= 1.1.4 - Sensitive Information Exposure via Views Files
• Smartarget – Get 40% more sales, improve user engagement with 25+ free apps. <= 1.5.2 - Authenticated (Subscriber+) Stored Cross-Site Scripting
• Lazy Load for Videos <= 2.18.7 - Authenticated (Contributor+) Stored Cross-Site Scripting via data-video-title and href Attributes
• Simple Buttons Creator <=1.04 - Unauthenticated Stored Cross-Site Scripting via Add Button
• Sign-up Sheets <= 2.2.8 - Cross-Site Request Forgery
• CountDown Pro WP Plugin <= 2.7 - Authenticated (Contributor+) SQL Injection
• Strong Testimonials <= 3.2.16 - Unauthenticated Arbitrary Shortcode Execution
• Eupago Gateway For Woocommerce <= 4.7.1 - Missing Authorization
• Responsive Flickr Slideshow <= 2.6.0 - Authenticated (Contributor+) Stored Cross-Site Scripting
• Easy WP SMTP <= 1.3.9 - Missing Authorization to Arbitrary Options Update
• Kadence WooCommerce Email Designer <= 1.5.17 - Unauthenticated Stored Cross-Site Scripting
• Social Contact Form (FormyChat) <= 2.15.7 - Unauthenticated Information Exposure
• Soundcloud Is Gold <= 2.2 - Cross-Site Scripting
• PAFacile <= 2.6.1 - Reflected Cross-Site Scripting
• Stylish Price List <= 7.2.2 - Missing Authorization
• Store Locator Plus <= 4.5.11 - Cross-Site Scripting
• LightSync Pro <= 2.1.6 - Authenticated (Author+) Arbitrary File Upload
• Woocommerce – Recent Purchases <= 1.0.1 - Authenticated (Admin+) Local File Inclusion
• Autoptimize <= 3.1.6 - Authenticated (Admin+) Stored Cross-Site Scripting via Critical CSS Rules
• Hotspots Analytics <= 4.0.12 - Cross-Site Request Forgery to Stored Cross-Site Scripting
• Jobmonster < 4.7.5 - Unauthenticated Arbitrary File Deletion
• Burst Statistics – Privacy-Friendly Analytics for WordPress 1.4.0 to 1.4.6.1 - Unauthenticated SQL Injection
• Slideshow Gallery <= 1.6.8 - SQL Injection
• WP-Invoice – Web Invoice and Billing <= 4.1.0 - Privilege Escalation
• Strong Testimonials <= 3.2.11 - Authenticated (Author+) Stored Cross-Site Scripting via Custom Fields
• Custom Body Class <= 0.6.0 - Cross-Site Scripting
• Lead Form Data Collection to CRM <= 3.1 - Missing Authorization to Authenticated (Subscriber+) Many Actions
• Hacklog Down As PDF <= 2.3.6 - Reflected Cross-Site Scripting
• College publisher Import <= 0.1 - Arbitrary File Upload
• Webba Booking <= 5.1.20 - Missing Authorization
• SVG Case Study <= 1.0 - Authenticated (Author+) Stored Cross-Site Scripting via SVG File Upload
• Terms descriptions <= 3.4.9 - Unauthenticated Information Exposure
• Mesmerize Companion <= 1.6.148 - Authenticated (Contributor+) Stored Cross-Site Scripting via mesmerize_contact_form Shortcode
• Save & Import Image from URL <= 0.7 - Reflected Cross-Site Scripting
• Solidres <= 0.9.4 - Reflected Cross-Site Scripting
• Schema Pro <= 2.7.15 - Authenticated (Contributor+) Custom Field Access
• Appointment Hour Booking – Booking Calendar <= 1.5.60 - Authenticated (Administrator+) Stored Cross-Site Scripting via 'Min/Max Length' Field Configuration
• Starter Templates by FancyWP <= 2.0.0 - Cross-Site Request Forgery to Arbitrary Plugin Installation
• W3 Total Cache <= 2.8.1 - Authenticated (Subscriber+) Missing Authorization to Server-Side Request Forgery
• WP Social Avatar <= 1.5 - Missing Authorization
• Restrict File Access <= 1.1.2 - Cross-Site Request Forgery to Arbitrary File Deletion
• Nextend Social Login and Register <= 1.5.5 - Reflected Cross-Site Scripting
• Alink Tap <= 1.3.1 - Cross-Site Request Forgery to Stored Cross-Site Scripting
• WooCommerce Login Redirect <= 2.2.4 - Cross-Site Request Forgery
• WidgetKit <= 2.5.4 - Missing Authorization to Notice Dismissal
• WP Travel – Ultimate Travel Booking System, Tour Management Engine <= 10.0.0 - Authenticated (Subscriber+) SQL Injection
• Taskbuilder <= 5.0.9 - Authenticated (Subscriber+) SQL Injection
• Coupon Affiliates <= 5.4.5 - Reflected Cross-Site Scripting via 'page'
• Recently <= 3.0.4 - Authenticated (Admin+) Stored Cross-Site Scripting
• Elizaibots <= 1.0.2 - Authenticated (Contributor+) Stored Cross-Site Scripting
• WordPress Core < 4.8.2 - Open Redirect in Admin Dashboard
• Post Grid, Form Maker, Popup Maker, WooCommerce Blocks, Post Blocks, Post Carousel – Combo Blocks <= 2.2.80 - Authenticated (Contributor+) Stored Cross-Site Scripting
• Kenta Blocks – Responsive Blocks and block templates library <= 1.3.9 - Authenticated (Contributor+) Stored Cross-Site Scripting
• MainWP WordPress SEO Extension <= 4.0.1 - Missing Authorization to Arbitrary Plugin Activation
• Fraud Prevention For WooCommerce and EDD <= 2.3.3 - Missing Authorization to Unauthenticated Arbitrary Content Deletion
• Jupiter X Core <= 4.7.5 - Limited Unauthenticated Authentication Bypass to Account Takeover
• JobSearch <= 2.5.9 - Reflected Cross-Site Scripting
• Lexicata <= 1.0.16 - Reflected Cross-Site Scripting
• Slider Revolution 6.0.0-6.7.55 and 7.0.0-7.0.14 - Missing Authorization to Authenticated (Contributor+) Arbitrary Plugin Deactivation
• WP Recipe Maker <= 10.8.0 - Missing Authorization to Authenticated (Contributor+) Arbitrary Recipe Ownership Takeover and Unpublishing via '[wprm-recipe]' Shortcode
• WP Prayer <= 2.0.9 - Cross-Site Request Forgery to Settings Update
• DroneX <= 1.1.12 - Unauthenticated Local File Inclusion
• ApplyOnline <= 2.6.2 - Unauthenticated Application Disclosure
• Easy Form <= 2.7.8 - Missing Authorization
• The Plus Addons for Elementor <= 5.4.2 - Authenticated (Contributor+) Stored Cross-Site Scripting via Countdown Widget
• Civi Framework <= 2.2.0 - Missing Authorization
• ProLancer Element <= 1.4.8 - Authenticated (Subscriber+) SQL Injection
• Tidio – Live Chat, Chatbots & Email Integration <= 5.2.0 - Sensitive Information Disclosure
• Fetch JFT <= 1.8.3 - Authenticated (Administrator+) Stored Cross-Site Scripting
• Contact Form Submissions <= 1.7 - Authenticated SQL Injection
• weForms <= 1.6.21 - Unauthenticated Stored Cross-Site Scripting via Referer
• Ezoic <= 2.8.8 - Missing Authorization to Stored Cross-Site Scripting
• Envira Gallery <= 1.16.1 - Authenticated (Author+) Information Exposure
• BuddyForms <= 2.8.12 - Authenticated (Editor+) Stored Cross-Site Scripting
• Login-box <= 2.0.4 - Cross-Site Request Forgery to Stored Cross-Site Scripting
• Surveys <= 1.01.8 - SQL Injection
• Premmerce Wholesale Pricing for WooCommerce <= 1.1.10 - Unauthenticated Local File Inclusion
• FSM Custom Featured Image Caption <= 1.25.1 - Authenticated (Author+) Stored Cross-Site Scripting
• Shantz WordPress QOTD <= 1.2.2 - Cross-Site Request Forgery
• Go Pricing - WordPress Responsive Pricing Tables <= 3.3.19 - Missing Authorization to Limited Privilege Granting
• Chatbot with ChatGPT <= 2.4.4 - Unauthenticated SQL Injection
• Event Tickets with Ticket Scanner <= 2.5.3 - Cross-Site Request Forgery to Arbitrary Ticket Deletion
• UserPlus <= 2.0 - Missing Authorization via Multiple Functions
• Language Translate Widget for WordPress – ConveyThis <= 234 - Missing Authorization to Limited Option Update
• Automotive Listings <= 18.6 - Unauthenticated SQL Injection
• Pricing Tables For WPBakery Page Builder (formerly Visual Composer) <= 1.4 - Authenticated (Contributor+) Stored Cross-Site Scripting via wdo_pricing_tables Shortcode
• AI Copilot – Content Generator <= 1.5.6 - Unauthenticated Privilege Escalation via Custom Workflow Route
• Table Rate Shipping Method for WooCommerce by Flexible Shipping <= 4.11.8 - Reflected Cross-Site Scripting
• Custom Post Carousels with Owl <= 1.4.11 - Authenticated (Contributor+) Stored Cross-Site Scripting
• Easy Social Sharebar <= 1.0.0 - Authenticated (Contributor+) Stored Cross-Site Scripting