Vulnerability archive: section 8, page 2

Open a report to review affected versions, available fixes and original sources. Each report covers a specific issue; its presence does not establish whether your website is affected.

• AI ChatBot with ChatGPT and Content Generator by AYS <= 2.6.6 - Unauthenticated Information Exposure
• Popup Builder – Create highly converting, mobile friendly marketing popups <= 4.3.1 - Missing Authorization and Nonce Exposure
• WordPress Core < 5.2.3 - Reflected Cross-Site Scripting via Shortcode Previews
• GiveWP - Donation Plugin and Fundraising Platform <= 4.13.0 - Unauthenticated Stored Cross-Site Scripting via 'name'
• User Email Verification for WooCommerce <= 3.5.0 - Authentication Bypass
• Classified Listing <= 5.0.6 - Missing Authorization
• Boost <= 2.0.4 - Unauthenticated SQL Injection
• Numinous <= 1.3.0 - Missing Authorization
• Trackserver <= 5.0.2 - Authenticated (Contributor+) Stored Cross-Site Scripting
• BMLT Tabbed Map <= 1.1.8 - Authenticated (Contributor+) Stored Cross-Site Scripting
• Goodnews – Responsive WordPress News/Magazine | News / Editorial <= 5.11.1 - Reflected Cross-Site Scripting
• CRM WordPress Plugin – RepairBuddy <= 3.8120 - Missing Authorization to Account Takeover/Privilege Escalation
• Magical Addons For Elementor <= 1.4.1 - Authenticated (Contributor+) Stored Cross-Site Scripting
• WP GDPR Compliance <= 1.4.2 - Arbitrary Options Update and Action Calling
• Web Vitals Tracking <= 5.4.2 - Unauthenticated Stored Cross-Site Scripting
• SevenHills <= 1.6.2 - Unauthenticated PHP Object Injection
• MailArchiver <= 4.4.0 - Authenticated (Administrator+) Stored Cross-Site Scripting via Settings
• WP Tabs <= 2.2.0 - Authenticated (Contributor+) Stored Cross-Site Scripting
• Avada < 7.13.2 - Cross-Site Request Forgery
• Spectra – WordPress Gutenberg Blocks <= 2.13.0 - Authenticated (Author+) Stored Cross-Site Scripting
• Payment Gateway PayPay for WooCommerce 0.5 - 0.9.3 - Unauthenticated Payment Bypass
• Contact Form 7 Connector <= 1.2.2 - Cross-Site Request Forgery to Reflected Cross-Site Scripting
• Checkout Fields Manager for WooCommerce <= 5.5.6 - Reflected Cross-Site Scripting
• Page Generator <= 1.6.5 - Cross-Site Request Forgery to Arbitrary Keywords Deletion/Duplication
• YourChannel <= 1.2.4 - Cross-Site Request Forgery to Plugin Language Translation Reset
• Church Admin <= 4.4.6 - Authenticated (Subscriber+) Arbitrary File Upload
• Fluent Forms <= 6.2.0 - Authenticated (Subscriber+) Authorization Bypass via 'table' Parameter
• Wptobe-memberships <= 3.4.2 - Authenticated (Subscriber+) Arbitrary File Deletion
• Location Click Map <= 1.0 - Authenticated (Contributor+) Stored Cross-Site Scripting
• Awesome Support <= 6.1.4 - Missing Authorization to Authenticated (Subscriber+) Arbitrary Post Modification
• Greenly <= 8.1 - Authenticated (Contributor+) Local File Inclusion
• WP Twitter Mega Fan Box Widget <= 1.0 - Authenticated (Administrator+) Stored Cross-Site Scripting
• Jannah <= 7.6.0 - Unauthenticated PHP Object Injection
• WordPress Landing Pages <= 1.8.4 - Cross-Site Scripting
• MainWP Dashboard <= 4.5.1.2 - Authenticated(Administrator+) CSS Injection
• Radio Player <= 2.0.83 - Unauthenticated Server-Side Request Forgery
• Theme Editor <= 3.1 - Cross-Site Request Forgery to CSS Modification
• Houzez <= 4.1.1 - Authenticated (Subscriber+) Insecure Direct Object Reference
• Zoho Campaigns <= 2.0.7 - Cross-Site Request Forgery via zcwc_optin_save
• Inline Related Posts <= 3.6.0 - Reflected Cross-Site Scripting
• AnyTrack Affiliate Link Manager <= 1.0.4 - Missing Authorization
• LearnPress – WordPress LMS Plugin <= 4.2.6.8.1 - Unauthenticated Bypass to User Registration
• Visitors Traffic Real Time Statistics <= 7.2 - Missing Authorization via multiple AJAX actions
• Custom WooCommerce Checkout Fields Editor <= 1.3.1 - Authenticated (Subscriber+) Stored Cross-Site Scripting
• itsukaita <= 0.1.2 - Reflected Cross-Site Scripting via 'day_from' Parameter
• Popup Builder 2.2.8 - 2.6.7.6 - PHP Object Injection
• Royal PrettyPhoto <= 1.2 - Authenticated Stored Cross-Site Scripting
• Widgets for Google Reviews <= 10.9 - Cross-Site Request Forgery to Plugin Settings Reset
• Contact Form Email < 1.0.1 - Cross-Site Scripting
• Super Page Cache <= 5.2.2 - Unauthenticated Stored Cross-Site Scripting via Activity Log
• Weblizar Pin Feeds < 1.1.2 - Cross-Site Scripting
• Sayfa Sayaç <= 2.6 - Unauthenticated PHP Object Injection
• AcyMailing SMTP Newsletter <= 8.6.2 - Reflected Cross-Site Scripting
• MC4WP: Mailchimp for WordPress <= 4.12.0 - Authenticated (Author+) Stored Cross-Site Scripting via Form Response Messages
• Rank Math SEO <= 1.0.40.2 - Redirect Creation via Unprotected REST API Endpoint
• WP Change Email Sender <= 1.0 - Authenticated (Administrator+) Stored Cross-Site Scripting
• WP Hotel Booking <= 2.2.1 - Improper Input Validation to Authenticated (Subscriber+) Rating Manipulation
• WP Shortcode by MyThemeShop <= 1.4.16 - Cross-Site Request Forgery
• Compact WP Audio Player <= 1.9.6 - Setting Change via Cross-Site Request Forgery
• MCP Server for WordPress <= 1.8.1 - Missing Authorization
• WooCommerce Coming Soon Product with Countdown <= 5.0 - Authenticated (Subscriber+) Stored Cross-Site Scripting
• Maps – Google Maps <= 1.0.6 - Authenticated (Contributor+) Stored Cross-Site Scripting
• Easy Elements Hider <= 2.0 - Authenticated (Administrator+) Stored Cross-Site Scripting
• User Registration <= 4.4.6 - Missing Authorization
• Stylish Cost Calculator – Quote Generator, Lead Gen & Price Estimator <= 8.3.9 - Missing Authorization
• Evergreen Content Poster <= 1.4.1 - Reflected Cross-Site Scripting
• NMR Strava activities <= 1.0.7 - Authenticated (Contributor+) Stored Cross-Site Scripting
• Estatik Mortgage Calculator <= 2.0.12 - Authenticated (Contributor+) Local File Inclusion
• Appointment and Event Booking Calendar - Amelia < 1.0.47 - Arbitrary File Upload
• Darna Framework <= 2.9 - Reflected Cross-Site Scripting
• AADMY – Add Auto Date Month Year Into Posts <= 2.0.1 - Unauthenticated Arbitrary Shortcode Execution
• SULly <= 4.3.0 - Cross-Site Request Forgery to Plugin Reset
• Ticket Tailor <= 1.10 - Authenticated (Contributor+) Stored Cross-Site Scripting
• Floating Chat Widget: Contact Icons, Messages, Telegram, Email, SMS, Call Button – Chaty <= 2.8.3 - Admin+ Stored Cross-Site Scripting
• Bg Bible References <= 3.8.14 - Reflected Cross-Site Scripting
• Latest Tabs <= 1.5 - Cross-Site Request Forgery to Plugin's Settings Update
• PowerPack Lite for Beaver Builder <= 1.3.0 - Authenticated(Contributor+) Stored Cross-Site Scripting via element link
• StopBadBots <= 7.31 - Authenticated (Administrator+) Stored Cross-Site Scripting
• GiveWP – Donation Plugin and Fundraising Platform <= 3.10.0 - Authenticated (Contributor+) Stored Cross-Site Scripting
• ThemeREX Addons < 2.38.5 - Unauthenticated Arbitrary File Upload
• Export WP Page to Static HTML/CSS <= 2.2.2 - Open Redirect
• Brizy – Page Builder <= 2.4.40 - Authenticated (Contributor+) Stored Cross-Site Scripting
• Configurator Theme Core <= 1.4.7 - Authenticated (Subscriber+) Privilege Escalation
• Catapult UK Cookie Consent <= 2.3.9 - Stored Cross-Site Scripting
• KiviCare – Clinic & Patient Management System (EHR) <= 3.6.16 - Missing Authorization
• Jet Footer Code <= 1.4 - Cross-Site Request Forgery to Stored Cross-Site Scripting
• SV100 Companion <= 2.0.02 - Missing Authorization to Unuathenticated Arbitrary Options Update
• Product Feed PRO for WooCommerce <= 13.5.2 - Cross-Site Request Forgery
• Responsive Addons – Starter Templates, Advanced Features and Customizer Settings for Responsive Theme. <= 3.0.5 - Authenticated (Author+) Stored Cross-Site Scripting
• Automatic Ban IP <= 1.0.7 - Reflected Cross-Site Scripting
• Export WP Page to Static HTML/CSS <= 2.1.9 - Missing Authorization via Multiple AJAX Actions
• Tags to Keywords <= 1.0.1 - Cross-Site Request Forgery to Stored Cross-site Scripting
• Posten <= 0.0.1 - Authenticated (Contributor+) Stored Cross-Site Scripting
• Jetpack CRM <= 5.4.4 - Authenticated (Administrator+) Stored Cross-Site Scripting
• Graphina – Charts and Graphs For Elementor <= 3.1.12 - Missing Authorization
• More Fields <= 2.1 - Cross-Site Request Forgery
• WP Meta and Date Remover <= 2.3.0 - Cross-Site Request Forgery via updateSettings
• GiveWP – Donation Plugin and Fundraising Platform <= 3.16.3 - Unauthenticated PHP Object Injection to Remote Code Execution
• WP Ticket <= 6.0.4 - Unauthenticated SQL Injection via WordPress Search 's' Parameter
• Linear <= 2.7.12 - Authenticated (Contributor+) Stored Cross-Site Scripting