Vulnerability archive: section 8, page 23

Open a report to review affected versions, available fixes and original sources. Each report covers a specific issue; its presence does not establish whether your website is affected.

• CM Tooltip Glossary – Better SEO and UEX for your WP site <= 3.1.3 - Reflected Cross-Site Scripting
• WP Mobile Bottom Menu <= 1.4.0 - Missing Authorization
• MicroPayments – Fans Paysite: Paid Creator Subscriptions, Digital Assets, Wallet <= 3.2.0 - Cross-Site Request Forgery to Settings Reset
• Specific Content For Mobile <= 0.5.3 - Missing Authorization
• Social Login, Social Sharing by miniOrange <= 7.8.2 - Unauthenticated Stored Cross-Site Scripting
• 1 Click WordPress Migration Plugin – 100% FREE for a limited time <= 2.2 - Unauthenticated Sensitive Information Exposure via Database Backup in class-ocm-backup.php
• Ultimate Video Player WordPress & WooCommerce Plugin <= 10.1 - Unauthenticated Server-Side Request Forgery
• Sky Addons for Elementor <= 2.6.1 - Authenticated (Contributor+) Sensitive Information Exposure via Content Switcher Widget Elementor Template
• HyperComments <= 1.2.2 - Unauthenticated (Subscriber+) Arbitrary Options Update
• 10CentMail <= 2.1.50 - Reflected Cross-Site Scripting
• Solid Central – Site Management, Backups, Security, and Reporting <= 3.2.8 - Missing Authorization
• Smart Google Code Inserter < 3.5 - Stored Cross-Site Scripting
• Job Board Manager <= 2.1.61 - Authenticated (Contributor+) Stored Cross-Site Scripting
• MainWP (Various Extensions) - Authenticated (Subscriber+) Arbitrary Plugin Installation
• Uncanny Automator < 6.10.0 - Authenticated (Subscriber+) Information Exposure
• PDF.js < 4.2.67 - Arbitrary JavaScript Execution
• File Manager Pro – Filester <= 1.8.8 - Authenticated (Administrator+) Arbitrary File Upload
• Admin in English with Switch <= 1.1 - Cross-Site Request Forgery
• AdForest Elementor <= 3.0.11 - Unauthenticated Stored Cross-Site Scripting
• MDTF <= 1.3.3.9 - Missing Authorization
• Qubely <= 1.8.14 - Missing Authorization
• Form Maker by 10Web <= 1.15.40 - Authenticated (Administrator+) SQL Injection via 'ip_search' Parameter
• Multiple Plugins by Crocoblock <= (Various Versions) - Missing Authorization to Unauthenticated Unauthorized Action
• Parsian Bank Gateway for Woocommerce <= 1.0 - Reflected Cross-Site Scripting
• WP Job Manager - Resume Manager <= 2.1.0 - Missing Authorization
• Theasys <= 1.0.1 - Cross-Site Request Forgery to Stored Cross-Site Scripting
• Jobify <= 4.3.2 - Unauthenticated Stored Cross-Site Scripting
• BuddyPress <= 5.1.1 - Sensitive Information Disclosure
• YourMembers <= 3.0 - SQL Injection
• Slide Banners <= 1.3 - Missing Authorization
• Post Export Import with Media <= 1.13.1 - Authenticated (Administrator+) Arbitrary File Upload via Trailing-Dot Filename Bypass in ZIP Media Import
• Eventin <= 4.0.5 - Authenticated (Author+) Stored Cross-Site Scripting
• MyRewards <= 5.3.0 - Missing Authorization
• Bard <= 2.229 - Missing Authorization
• XmasB Quotes <= 1.6.1 - Reflected Cross-Site Scripting
• Dynamic Widgets <= 1.5.10 - Refletced Cross-Site Scripting
• AI Contact Us Form <= 1.0 - Authenticated (Admin+) Stored Cross-Site Scripting
• Booking Calendar 10.15 - 11.8.2 - Authenticated (Editor+) Information Exposure
• Load More Anything <= 3.3.3 - Missing Authorization to Plugin Settings Modification
• BetterDocs – Best Documentation, FAQ & Knowledge Base Plugin with AI Support & Instant Answer For Elementor & Gutenberg <= 3.4.2 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode
• king_IE <= 1.0 - Authenticated (Author+) Stored Cross-Site Scripting via SVG File Upload
• All in One SEO Pack <= 4.2.9 - Authenticated (Contributor+) Stored Cross-Site Scripting
• Comment Edit Core – Simple Comment Editing <= 3.1.0 - Unauthenticated Sensitive Information Exposure
• WC Affiliate <= 2.3 - Reflected Cross-Site Scripting
• Wappointment <= 2.6.9 - Authenticated (Contributor+) Stored Cross-Site Scripting
• Sydney Toolbox <= 1.25 - Authenticated (Contributor+) Stored Cross-Site Scripting
• Woo File Dropzone <= 1.1.7 - Authenticated (Subscriber+) Arbitrary File Deletion
• SearchIQ <= 4.7 - Authenticated (Contributor+) Stored Cross-Site Scripting
• FlatPM < 3.1.05 - Authenticated (Contributor+) Stored Cross-Site Scripting
• Badgearoo <= 1.0.14 - Authenticated (Admin+) Stored Cross-Site Scripting
• Jobica Core <= 1.4.1 - Authenticated (Subscriber+) PHP Object Injection
• Design for Contact Form 7 Style WordPress Plugin – CF7 WOW Styler <= 1.6.4 - Missing Authorization via Several AJAX Action
• BerqWP – Automated All-In-One PageSpeed Optimization Plugin for Core Web Vitals, Cache, CDN, Images, CSS, and JavaScript <= 2.1.1 - Reflected Cross-Site Scripting
• PZ Frontend Manager <= 1.0.5 - Cross-Site Request Forgery to Profile Picture Update
• Molongui <= 4.7.7 - Authenticated (Author+) Insecure Direct Object Reference
• Stripe Donation <= 1.2.5 - Authenticated (Contributor+) Stored Cross-Site Scripting
• Premmerce Wishlist for WooCommerce <= 1.1.13 - Unauthenticated Stored Cross-Site Scripting
• Admin Trim Interface <= 3.5.1 - Unauthenticated Full Path Disclosure
• CURCY – Multi Currency for WooCommerce 2.2.18 - Unauthenticated Stored Cross-Site Scripting
• Link Library <= 7.4 - Authenticated (Admin+) Stored Cross-Site Scripting
• Media Modal <= 1.0.2 - Authenticated (Contributor+) Stored Cross-Site Scripting
• Better Messages – Chat Rooms, Group Chat, Private Messages & AI Chat Bots <= 2.15.27 - Unauthenticated Stored Cross-Site Scripting
• Avada <= 3.15.3 - Authenticated (Contributor+) PHP Object Injection
• Tax Service Electronic HDM <= 1.2.0 - Unauthenticated Arbitrary SQL Injection
• BaiduXZH Submit(百度熊掌号) <= 1.4.6 - Reflected Cross-Site Scripting
• Ghost Kit – Page Builder Blocks, Motion Effects & Extensions <= 3.6.0 - Authenticated (Contributor+) Stored Cross-Site Scripting
• Jobmonster <= 4.8.0 - Unauthenticated Sensitive Information Disclosure
• addWeather <= 2.5.1 - Cross-Site Request Forgery to Stored Cross-Site Scripting
• CRM and Lead Management by vcita <= 2.7.5 - Authenticated (Contributor+) Stored Cross-Site Scripting via type Parameter
• Time Clock <= 1.2.2 & Time Clock Pro <= 1.1.4 - Unauthenticated (Limited) Remote Code Execution
• ActiveDEMAND <= 0.2.41 - Unauthenticated Arbitrary File Upload
• Contact Form by Supsystic <= 1.7.14 - Reflected Cross-Site scripting
• Gutenberg Essential Blocks – Page Builder for Gutenberg Blocks & Patterns <= 5.7.1 - Authenticated (Contributor+) Stored Cross-Site Scripting
• String Locator <= 2.6.5 - Reflected Cross-Site Scripting
• Header Image Slider <= 0.3 - Reflected Cross-Site Scripting
• Splash Header < 1.20.8 - Stored Cross-Site Scripting
• dbview <= 0.5.5 - Authenticated (Contributor+) Stored Cross-Site Scripting
• DPEPress <= 0.3 - Authenticated (Contributor+) Stored Cross-Site Scripting
• HT Mega <= 2.5.7 - Authenticated (Contributor+) JSON File Directory Traversal
• Casso – Tự động xác nhận thanh toán chuyển khoản ngân hàng <= 2.8.6 - Authenticated (Admin+) Cross-Site Scripting
• All-in-One WP Migration <= 7.62 - Unauthenticated Reflected Cross-Site Scripting
• WOLF – WordPress Posts Bulk Editor and Manager Professional <= 1.1.1 - Authenticated (Editor+) SQL Injection
• Emails Catch <= 3.5.3 - Authenticated (Subscriber+) Information Exposure to Password Reset and Privilege Escalation
• All in One SEO Pack <= 4.2.9 - Authenticated (Administrator+) Stored Cross-Site Scripting
• Motors – Car Dealer, Classifieds & Listing <= 1.4.9 - Missing Authorization
• Jeeng Push Notifications <= 2.0.3 - Authenticated (Admin+) Stored Cross-Site Scripting
• Namaste! LMS <= 2.5.9.9 - Authenticated (Administrator+) Stored Cross-Site Scripting via 'accept_other_payment_methods', 'other_payment_methods' Parameters
• Compact WP Audio Player <= 1.9.13 - Authenticated (Contributor+) Stored Cross-Site Scripting via sc_embed_player Shortcode
• WOOF - Products Filter for WooCommerce <= 1.2.6.2 - Reflected Cross-Site Scripting
• Gmedia Photo Gallery <= 1.6.4 - Denial of Service
• Zephyr Project Manager <= 3.3.97 - Authenticated (Subscriber+) Privilege Escalation via User Meta Update
• AnyWhere Elementor Pro <= 2.29 - Missing Authorization
• Church Admin <= 4.1.7 - Cross-Site Request Forgery
• Konzept (Unknown Version) - Cross-Site Scripting
• weDocs <= 2.1.4 - Missing Authorization
• Blog2Social: Social Media Auto Post & Scheduler <= 8.8.3 - Authenticated (Subscriber+) Insecure Direct Object Reference to Arbitrary Post Schedule Modification via 'b2s_id' Parameter
• WP Meta SEO <= 4.5.18 - Unauthenticated Stored Cross-Site Scripting via REQUEST_URI in 404 Logging
• RepairBuddy <= 4.1116 - Insecure Direct Object Reference to Authenticated (Subscriber+) Arbitrary Signature Upload to Orders
• Open Graph <= 1.11.2 - Unauthenticated Sensitive Information Exposure
• LiveChat Elementor <= 1.0.13 - Cross-Site Request Forgery