Vulnerability archive: section 8, page 6

Open a report to review affected versions, available fixes and original sources. Each report covers a specific issue; its presence does not establish whether your website is affected.

• GamiPress – Button <= 1.0.4 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode
• Workeera – AI Job Board with Applicant Tracking System (ATS) < 1.0.6 - Authenticated (Subscriber+) Arbitrary File Read
• MultiOffice <= 1.2 - Unauthenticated Local File Inclusion
• MailCWP <= 1.100 - Arbitrary File Upload
• Google Maps for WordPress <= 1.0.3 - Authenticated (Contributor+) Stored Cross-Site Scripting
• WP Video Gallery <= 1.7.1 - SQL Injection
• Page Builder Gutenberg Blocks – CoBlocks <= 3.1.11 - Authenticated (Contributor+) Server-Side Request Forgery
• WP-Chatbot for Messenger <= 4.7 - Missing Authorization
• Grand Restaurant WordPress <= 7.0 - Cross-Site Request Forgery
• Email Tracker <= 5.2.6 - Cross-Site Request Forgery
• MM-email2image <= 0.2.5 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode
• Create Block Theme <= 1.2.1 - Unauthenticated Arbitrary File Upload
• Cookie Params <= 0.2 - Reflected Cross-Site Scripting and Cross-Site Request Forgery
• AA Cash Calculator <= 1.0 - Reflected Cross-Site Scripting via invoice
• Advanced File Manager <= 5.4.12 - Reflected Cross-Site Scripting via postMessage 'soundFile' Parameter
• Activity Log <= 5.5.4 - Authenticated (Contributor+) Stored Cross-Site Scripting
• Essential Addons for Elementor – Best Elementor Templates, Widgets, Kits & WooCommerce Builders <= 5.9.4 - Authenticated (Contributor+) Stored Cross-Site Scripting via Image URl
• Image Optimizer, Resizer and CDN – Sirv <= 7.2.0 - Authenticated (Subscriber+) Server-Side Request Forgery
• Contempo Real Estate Custom Posts <= 3.2.6 - Unauthorized File Upload
• Jobs for WordPress <= 2.7.5 - Reflected Cross-Site Scripting via job-search
• Directory Pro <= 2.5.6 - Missing Authorization
• RokIntroScroller <= 1.8 - Cross-Site Scripting
• Product Feed Manager <= 7.3.15 - Authenticated (Admin+) Directory Traversal
• PDF Resume Parser <= 1.0 - Unauthenticated Sensitive Information Disclosure in SMTP Credentials
• Product Carousel Slider for Elementor <= 2.1.3 - Missing Authorization
• Scoutnet Kalender <= 1.1.0 - Cross-Site Scripting
• Coupon Affiliates <= 5.4.3 - Unauthenticated Stored Cross-Site Scripting
• Advanced iFrame <= 2024.3 - Authenticated (Contributor+) Stored Cross-Site Scripting
• AdRotate < 5.8.4 - Authenticated SQL Injection
• CRM Perks Forms <= 1.1.1 - Authenticated (Admin+) Stored Cross-Site Scripting
• Themify Builder <= 5.3.1 - Reflected Cross-Site Scripting
• Quick Paypal Payments < 3.1 - Cross-Site Scripting
• Element Pack Elementor Addons (Header Footer, Template Library, Dynamic Grid & Carousel, Remote Arrows) <= 5.6.3 - Form Submission Admin Email Bypass
• KKProgressbar2 Free <= 1.1.4.2 - Cross-Site Request Forgery to Progress Bar Deletion
• VideoZen <= 1.0.1 - Authenticated (Administrator+) Stored Cross-Site Scripting via 'VideoZen available subtitles languages' Field
• AdForest <= 6.0.11 - Unauthenticated Local File Inclusion
• Quiz Maker <= 6.7.0.82 - Cross-Site Request Forgery
• Webcam 2Way Videochat <= 4.41 - Cross-Site Scripting
• WP-Table <= 1.43 - Local File Inclusion
• Amelia <= 1.2.16 - Unauthenticated Insecure Direct Object Reference
• Backup and Staging by WP Time Capsule <= 1.22.23 - Reflected Cross-Site Scripting
• RSVPMarker <= 11.4.5 - Missing Authorization
• Booking and Rental Manager <= 2.5.4 - Authenticated (Contributor+) PHP Object Injection
• Lightbox slider – Responsive Lightbox Gallery <= 1.9.9 - Authenticated (Contributor+) PHP Object Injection
• MailUp Auto Subscription <= 1.1.0 - Cross-Site Request Forgery to Stored Cross-Site Scripting
• Stops Core Theme And Plugin Updates <= 8.0.4 - Insufficient Restrictions on Option Changes
• Kratz <= 1.0.12 - Unauthenticated Local File Inclusion
• GS Testimonial Slider <= 1.9.6 - Authenticated (Author+) Stored Cross-Site Scripting
• GlobalPayments WooCommerce <= 1.18.3 - Unauthenticated Server-Side Request Forgery
• OpenAI Tools for WordPress & WooCommerce <= 2.1.5 - Missing Authorization
• WP SuperBackup <= 2.3.3 - Unauthenticated Arbitrary File Upload
• LiveSmart Video Chat <= 1.2 - Authenticated (Contributor+) Stored Cross-Site Scripting
• Product Quantity Dropdown For Woocommerce <= 1.2 - Cross-Site Request Forgery
• miniOrange OTP Login, Verification and SMS Notifications <= 5.5.5 - Unauthenticated Authentication Bypass via 'mo_wp_login_intent' Parameter
• Tidio Gallery <= 1.1 - Reflected Cross-Site Scripting
• Automation Web Platform <= 4.8.6 - Unauthenticated Authentication Bypass via 'otp_transient' Token Disclosure
• Bit File Manager <= 6.9.0 - Unauthenticated File Activity Log Disclosure
• Online Booking & Scheduling Calendar for WordPress by vcita <= 4.5.1 - Authenticated (Subscriber+) Stored Cross-Site Scripting
• WordPress Gallery Plugin <= 1.4 - Cross-Site Request Forgery to Stored Cross-Site Scripting
• WP Post Author <= 3.2.3 - Privilege Escalation
• Ad Inserter < 2.7.11 - Authenticated (Admin+) Remote Code Execution
• Photography <= 7.6.1 - Unauthenticated Stored Cross-Site Scripting
• Tcard WP <= 1.8.0 - Unauthenticated SQL Injection
• Mitsol Social Post Feed <= 1.10 - Authenticated (Admin+) Stored Cross-Site Scripting
• Import all XML, CSV & TXT into WordPress < 6.4.2 - Missing Authorization
• Gallery Bank – WordPress Photo Gallery Plugin < 2.0.20 - Reflected Cross-Site Scripting
• Subscribe2 <= 10.40 - Missing Authorization
• Review Slider Pro <= 12.7.11 - Authenticated (Subscriber+) SQL Injection
• W3 Total Cache <= 2.10.6 - Unauthenticated Stored Cross-Site Scripting via Comment Content
• Base64 Encoder/Decoder <= 0.9.2 - Reflected Cross-Site Scripting
• Contact Form by Supsystic < 1.10.0 - Unauthenticated Stored Cross-Site Scripting
• KindlyCare <= 1.6.1 - Unauthenticated PHP Object Injection
• WPGraphQL < 2.11.1 - Unauthenticated SQL Injection
• Premium Portfolio Features for Phlox theme <= 2.3.4 - Authenticated (Contributor+) Stored Cross-Site Scripting
• W3 Total Cache <= 2.10.2 - Unauthenticated Path Traversal
• WordPress Popular Posts <= 5.3.2 - Authenticated Arbitrary File Upload
• Buisson <= 1.1.11 - Unauthenticated PHP Object Injection
• Analytify <= 4.2.0 - Reflected Cross-Site Scripting
• Bit Form <= 3.0.0 - Unauthenticated Arbitrary File Read
• Better Payment – Instant Payments, Donations, Fundraising with Subscriptions & More <= 2.2.0 - Unauthenticated Business Logic Flaw
• Bold Page Builder <= 4.8.0 - Authenticated (Contributor+) Stored Cross-Site Scripting via Raw Content
• Widget or Sidebar Shortcode <= 0.6.1 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode
• Activity Log < 2.3.3 - Cross-Site Scripting
• Arigato Autoresponder and Newsletter <= 2.5.1.8 - Reflected Cross-Site Scripting
• Tourfic <= 2.11.7 - Reflected Cross-Site Scripting
• E2Pdf – Export Pdf Tool for WordPress <= 1.32.17 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'id' Shortcode Attribute
• Email Subscribers & Newsletters <= 4.5.5 - Unauthenticated Email Forgery
• Wovax IDX <= 1.2.2 - Missing Authorization to Privilege Escalation
• Auto Affiliate Links <= 6.4.2.7 - Cross-Site Request Forgery
• iThemes Security <= 8.1.4 - Open Redirection via redirect_to_https
• Contact Form and Calls To Action by vcita <= 2.6.4 - Authenticated (Contributor+) Stored Cross-Site Scripting
• Telegram for WP <= 1.6.1 - Authenticated (Admin+) Stored Cross-Site Scripting
• Gutenverse Form – Contact Form Builder, Block Form & Booking Form <= 2.4.7 - Unauthenticated Stored Cross-Site Scripting
• Download Manager <= 3.2.92 - Authenticated (Author+) Stored Cross-Site Scripting via Multiple Shortcodes
• WordPress Survey & Pol <= 1.5.7.3 - Unauthenticated SQL Injection
• User Profile Builder <= 4.0.0 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'date' Shortcode Attribute
• My Login Logout Plugin <= 2.4 - Cross-Site Request Forgery to Stored Cross-Site Scripting
• Wicked Folders <= 2.18.16 - Missing Authorization on ajax_add_folder
• Nika <= 1.2.14 - Authenticated (Contributor+) Local File Inclusion
• Vitepos – Point of Sale (POS) for WooCommerce <= 3.4.2 - Authenticated (Cashier+) SQL Injection