Vulnerability archive: section 8, page 24

Open a report to review affected versions, available fixes and original sources. Each report covers a specific issue; its presence does not establish whether your website is affected.

• Popup Builder <= 4.2.7 - Authenticated(Contributor+) Stored Cross-Site Scripting via Custom JS
• Site Mailer <= 1.2.3 - Unauthenticated Stored Cross-Site Scripting
• Product Catalog Simple <= 1.5.13 - Cross-Site Request Forgery Bypass
• wpDataTables <= 2.1.49 - Authenticated (Contributor+) Stored Cross Site Scripting
• Post Snippets <= 3.1.3 - Cross-Site Request Forgery to Stored Cross-Site Scripting
• New User Approve <= 2.5.1 - Cross-Site Request Forgery via admin_notices
• Travel Booking WordPress Theme < 3.2.3 - Missing Authorization to Unauthenticated Arbitrary Content Deletion
• Category Icon <= 1.0.0 - Authenticated (Author+) Stored Cross-Site Scripting via SVG File Upload
• AlphaOmega Captcha & Anti-Spam Filter <= 3.3 - Cross-Site Request Forgery to Stored Cross-Site Scripting
• MapSVG <= 8.14.0 - Authenticated (Contributor+) SQL Injection
• WordPress Gallery Plugin – NextGEN Gallery <= 3.38 - Authenticated (Admin+) PHAR Deserialization
• FooEvents for WooCommerce <= 1.20.4 - Authenticated (Subscriber+) SQL Injection
• Optinly <= 1.0.18 - Missing Authorization to Plugin Settings Change
• XStore Core <= 5.3.8 - Unauthenticated Privilege Escalation
• CoolClock <= 4.3.4 - Authenticated Stored Cross-Site Scripting
• CM FAQ – Simplify support with an intuitive FAQ management tool <= 1.2.5 - Reflected Cross-Site Scripting
• Unlimited Elements For Elementor <= 2.0.8 - Authenticated (Contributor+) SQL Injection
• CURCY – Multi Currency for WooCommerce <= 2.2.0.1 - Authenticated (Contributor+) Stored Cross-Site Scripting
• MultiParcels Shipping For WooCommerce <= 1.30.36 - Reflected Cross-Site Scripting
• Team Members <= 5.1.0 - Authenticated (Admin+) Stored Cross-Site Scripting
• Ultimate Member <= 2.11.1 - Reflected Cross-Site Scripting via Filter Parameters
• Koji <= 2.2.1 - Missing Authorization
• Clean Login <= 1.18 - Unauthenticated Account Registration
• Tag, Category, and Taxonomy Manager – AI Autotagger with OpenAI <= 3.40.1 - Missing Authorization to Authenticated (Subscriber+) Arbitrary Taxonomy Term Manipulation
• Responsive Menu <= 4.1.7 - Missing Authorization Checks
• Organization chart <= 1.4.4 - Cross-Site Request Forgery
• Real Estate Manager <= 7.3 - Unauthenticated Remote Code Execution
• Crayon Syntax Highlighter <= 2.6.10 - Directory Traversal
• Advanced Schedule Posts <= 2.1.8 - Reflected Cross-Site Scripting
• MainWP Rocket Extension <= 4.0.3 - Missing Authorization to Plugin Settings Change
• BuildKit – Product Builder for WooCommerce – Custom PC Builder <= 1.0.28 - Authenticated (Contributor+) SQL Injection
• Question Answer <= 1.2.70 - Reflected Cross-Site Scripting
• The Fashion - Model Agency One Page Beauty Theme <= 1.4.4 - Unauthenticated PHP Object Injection
• Element Pack Elementor Addons <= 8.4.2 - Authenticated (Editor+) SQL Injection
• FAQ Builder AYS <= 1.8.2 - Unauthenticated Stored Cross-Site Scripting
• Contest Gallery <= 19.1.4.1 - Authenticated (Author+) SQL Injection via cg_option_id
• HappyFiles Pro <= 1.8.1 - Missing Authorization to Arbitrary File Deletion
• Waiting: One-click countdowns <= 0.6.2 - Cross-Site Request Forgery
• WP Customer Area <= 8.2.4 - Cross-Site Request Forgery to Event Log Deletion
• Custom 404 Pro <= 3.7.1 - Cross-Site Request Forgery
• PDF Thumbnail Generator <= 1.4 - Cross-Site Request Forgery
• Blog Designer - Post and Widget <= 2.3 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode
• Role Scoper (Obsolete – Please install PublishPress Permissions) < 1.3.67 - Reflected Cross-Site Scripting
• URL Params <= 2.4 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode
• DK <= 3.2.1 - Missing Authorization
• YITH Maintenance Mode <= 1.3.7 - Stored Cross-Site Scripting
• Majestic Support <= 1.1.2 - Missing Authorization
• WP YouTube Live <= 1.10.0 - Cross-Site Request Forgery
• Simple Link Directory <= 8.9.2 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode Attributes
• Content Mask 1.8.0 - 1.8.5.4 - Missing Authorization
• LoginPress Pro <= 6.2.3 - Unauthenticated Authentication Bypass via Unverified OAuth Email via Discord OAuth Callback
• Delisho <= 1.1.3 - Missing Authorization
• Blog2Social <= 6.8.6 - Reflected Cross-Site Scripting
• Shield Security – Smart Bot Blocking & Intrusion Prevention Security <= 20.0.5 - Reflected Cross-Site Scripting
• Good Energy <= 1.7.7 - Unauthenticated PHP Object Injection
• Gerador de Certificados – DevApps <= 1.3.6 - Authenticated (Administrator+) Arbitrary File Upload
• Social Media Flying Icons | Floating Social Media Icon <= 4.3.5 - Authenticated (Admin+) Stored Cross-Site Scripting
• VDZ Verification <= 1.3.12 - Stored Cross-Site Scripting
• MagicForm <= 0.1 - Cross-Site Scripting
• CM Registration Pro <= 3.2.0 - PHP Object Injection
• Checkout Gateway for IRIS <= 1.3 - Missing Authorization
• Link Hopper <= 1.4 - Authenticated (Administrator+) Stored Cross-Site Scripting via 'hop_name' Parameter
• Advanced Settings <= 3.1.1 - Cross-Site Request Forgery
• WP Concours <= 1.1 - Cross-Site Scripting
• WP Quick Shop <= 1.3.1 - Reflected Cross-Site Scripting
• Testimonials by BestWebSoft <= 0.1.8 - Reflected Cross-Site Scripting
• Demo Awesome <= 1.0.1 - Reflected Cross-Site Scripting
• FL3R FeelBox <= 8.1 - Cross-Site Request Forgery leading to Stored Cross-Site Scripting
• SEO Help <= 6.6.1 - Authenticated (Admin+) Server-Side Request Forgery
• WP AUDIO GALLERY <= 2.0 - Authenticated (Subscriber+) Arbitrary File Deletion via 'audio_upload' Parameter
• WP Code Highlight.js <= 0.6.3 - Cross-Site Scripting
• SEO Booster <= 3.8.9 - Cross-Site Request Forgery
• Ultimate Member <= 2.3.2 - Stored Cross-Site Scripting
• Login No Captcha reCAPTCHA <= 1.8.0 - Unauthenticated Stored Cross-Site Scripting via PHP_SELF
• User Registration & Membership <= 5.2.8 - Authenticated (Subscriber+) Arbitrary Shortcode Execution via Referer Header via 'referrer_url' Smart Tag
• Booking Hub <= 1.3.1 - Authenticated (Subscriber+) Privilege Escalation
• Featured Image <= 2.1 - Authenticated (Author+) Stored Cross-Site Scripting
• Author WIP Progress Bar <= 1.0 - Authenticated (Contributor+) Stored Cross-Site Scripting
• Wicked Folders <= 2.18.16 - Cross-Site Request Forgery via ajax_clone_folder
• WP Insightly for Contact Form 7, WPForms, Elementor, Formidable and Ninja Forms <= 1.1.5 - Missing Authorization
• The7 — Website and eCommerce Builder for WordPress <= 2.1.0 - Reflected Cross-Site Scripting
• Sidebar Manager Light <= 1.1.8 - Cross-Site Request Forgery
• Podlove Podcast Publisher <= 2.5.3 - Authenticated SQL Injection
• EthPress <= 2.3.5 - Unauthenticated Authentication Bypass
• Sign-up Sheets <= 2.3.2 - Unauthenticated PHP Object Injection
• WP Import – Ultimate CSV XML Importer for WordPress <= 7.33.1 - Authenticated (Administrator+) PHP Object Injection via CSV Import
• Comment Cleaner 6.1 - 7.1 - Missing Authorization
• Content text slider on post < 6.9 - Cross-Site Scripting
• Scripts Organizer < 3.0 - Unauthenticated Arbitrary File Upload
• Dynamic Widgets <= 1.5.1 - Cross Site Scripting
• Dokan <= 3.0.8 - Cross-Site Request Forgery Bypass
• Postie <= 1.9.40 - Post Submission Spoofing & Stored Cross-Site Scripting
• Careerfy - Job Board WordPress Theme <= 3.9.0 - Authenticated Stored Cross-Site Scripting
• Advanced Ads – Ad Manager & AdSense <= 1.52.1 - Authenticated (Admin+) PHP Object Injection
• Google Photos Gallery with Shortcodes <= 4.0.2 - Reflected Cross-Site Scripting
• ConvertKit <= 2.4.5 - Unauthenticated Sensitive Information Exposure
• Chartify <= 2.7.6 - Reflected Cross-Site Scripting
• Team Builder – Meet the Team <= 1.3 - Missing Authorization to Authenticated (Subscriber+) Settings Update
• Quiz and Survey Master (QSM) <= 10.3.5 - Authenticated (Contributor+) SQL Injection via 'merged_question' Parameter
• TechOne - Electronics Multipurpose WooCommerce Theme ( RTL Supported ) <= 3.0.3 - Reflected Cross-Site Scripting