Vulnerability archive: section 8, page 8

Open a report to review affected versions, available fixes and original sources. Each report covers a specific issue; its presence does not establish whether your website is affected.

• Conversios.io <= 7.2.13 - Missing Authorization
• Barcode Scanner with Inventory & Order Manager <= 1.5.3 - Reflected Cross-Site Scripting
• Easy Appointments <= 4.0.2.1 - Unauthenticated Stored Cross-Site Scripting
• Paymattic <= 4.6.25 - Unauthenticated Payment Bypass
• WP User Manager – Registration Form, Login Form, User Profile Builder & Member Directory <= 2.9.23 - Missing Authorization
• Advanced Woo Labels – Product Labels for WooCommerce <= 1.93 - Authenticated (Contributor+) Stored Cross-Site Scripting
• WP-BusinessDirectory <= 3.1.2 - Reflected Cross-Site Scripting
• Popup by Supsystic <= 1.10.19 - Missing Authorization to Sensitive Information Exposure
• Booster Extension <= 1.2.0 - Basic Information Exposure via booster_extension_authorbox_shortcode_display
• Contact List – Easy Business Directory, Staff Directory and Address Book Plugin <= 2.9.87 - Missing Authorization to Notice Dismissal
• Privacy Policy Generator, Terms & Conditions Generator WordPress Plugin : WPLegalPages < 1.1 - Cross-Site Scripting
• Contact Us Page – Contact People <= 3.7.4 - Authenticated (Contributor+) Stored Cross-Site Scripting via style Parameter
• Corona Virus (COVID-19) Banner & Live Data <= 1.8.0.3 - Authenticated (Administrator+) Stored Cross-Site Scripting
• WordPress Core < 3.9.2 - Cross-Site Request Forgery Protection Bypass
• Store Locator Widget <= 2025r2 - Cross-Site Request Forgery to Stored Cross-Site Scripting
• WP Simple Pay Lite Manager <= 1.4 - Authenticated (Administrator+) SQL Injection
• WP Online Users Stats <= 1.0.0 - Unauthenticated SQL Injection
• WebFacing Email Accounts for cPanel 5.3 - 5.3.6 - Unauthenticated Local File Inclusion
• Error Log Viewer <= 1.1.2 - Sensitive Information Exposure
• Remove CPT base <= 5.8 - Cross-Site Request Forgery to CPT base deletion
• Visual Form Builder <= 3.0.6 - Admin+ Cross-Site Scripting
• Daily Prayer Time < 2022.03.01 - Unauthenticated SQL Injection
• Lightview Plus <= 3.1.3 - Reflected Cross-Site Scripting
• Evaluate <= 1.0 - Authenticated (Administrator+) Stored Cross-Site Scripting
• Backup Migration <= 1.2.9 - Cross-Site Request Forgery
• Nimble Page Builder <= 3.2.1 - Reflected Cross-Site Scripting
• WP User Manager – User Profile Builder & Membership <= 2.9.11 - Missing Authorization to Authenticated (Subscriber+) User Meta Key Enumeration
• VW Writer Blog <= 1.3.8 - Missing Authorization to Authenticated (Subscriber+) Theme Settings Reset
• Dokan <= 5.0.8 - Insecure Direct Object Reference to Authenticated (Vendor+) Cross-Vendor Product Attribute Modification
• Event Tickets Manager for WooCommerce <= 1.5.5 - Missing Authorization
• All-in-One Video Gallery <= 4.7.1 - Reflected Cross-Site Scripting via 'vi' Parameter
• WP DSGVO Tools (GDPR) <= 3.1.36 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'lw_content_block' Shortcode
• Indeed Membership Pro <= 12.7 - Unauthenticated PHP Object Injection
• Adifier System <= 3.1.7 - Unauthenticated Arbitrary Password Reset
• Ocean Extra <= 2.2.2 - Cross-Site Request Forgery to Arbitrary Plugin Activation
• Image Slider by NextCode <= 1.1.2 - Cross-Site Request Forgery to Slide Deletion
• WooCommerce Shop Page Builder <= 2.27.7 - Reflected Cross-Site Scripting
• Tutor LMS <= 4.1.0 - Reflected Cross-Site Scripting via 'tab' Parameter
• Events Manager <= 6.4.5 - Reflected Cross-Site Scripting
• DOAJ Export <= 1.0.4 - Authenticated (Administrator+) Stored Cross-Site Scripting
• ElementsKit Elementor addons <= 3.4.0 - Unauthenticated Information Exposure via get_megamenu_content Function
• Elementor Website Builder <= 3.33.0 - Missing Authorization
• Gantry 4 Framework <= 4.1.3 - Remote Code Execution
• Hueman Addons <= 2.3.3 - Authenticated (Contributor+) Stored Cross Site Scripting
• Poll, Survey & Quiz Maker Plugin by Opinion Stage <= 19.12.0 - Missing Authorization
• Nasa Core < 6.4.4. - Reflected Cross-Site Scripting
• Gutenverse Companion <= 2.5.0 - Missing Authorization
• Shopping Cart & eCommerce Store <= 5.9.3 - Authenticated (Store Manager+) Privilege Escalation to ec_ajax_save_page_default_options AJAX Action
• Ninja Forms Contact Form – The Drag and Drop Form Builder for WordPress <= 3.4.27 - Validation Bypass via Email Field
• Embed Any Document – Embed PDF, Word, PowerPoint and Excel Files <= 2.7.1 - Authenticated (Author+) Stored Cross-Site Scripting via SVG files
• WP-Paginate <= 2.1.8 - Authenticated (Admin+) Stored Cross-Site Scripting
• Backup Migration <= 1.3.5 - Unauthenticated Sensitive Information Exposure
• Fontiran <= 2.1 - Cross-Site Request Forgery
• TheGem (Elementor) <= 5.10.5 - Missing Authorization
• WSP MCP <= 2.9.5 - Authenticated (Subscriber+) Sensitive Information Disclosure via Broken Access Control to 'wsp_get_posts' MCP Tool
• MultiVendorX – The Ultimate WooCommerce Multivendor Marketplace Solution <= 4.2.4 - Missing Authorization to Forged Vendor Profile Deletion Email Sending
• UsersWP – Front-end login form, User Registration, User Profile & Members Directory plugin for WordPress <= 1.2.10 - Unauthenticated SQL Injection via 'uwp_sort_by'
• Wallet System for WooCommerce – Digital Wallet, Buy Now Pay Later (BNPL), Instant Cashback, Referral program, Partial & Subscription Payments <= 2.7.6 - Missing Authorization
• EmbedPress <= 4.0.14 - Authenticated (Contributor+) Stored Cross-Site Scripting
• FAT Event Lite <= 1.1 - Unauthenticated Local File Inclusion
• Advanced Order Export For WooCommerce <= 4.0.10 - Authenticated (Shop Manager+) SQL Injection via 'sort_direction' Parameter
• Avatar <= 0.1.4 - Authenticated (Subscriber+) Arbitrary File Deletion
• Album and Image Gallery plus Lightbox <= 1.6.2 - Cross-Site Request Forgery
• HTML Shortcodes <= 1.1 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode Attributes
• Application Passwords <= 0.1.3 - Reflected Cross-Site Scripting via reject_url
• Business Directory Plugin – Easy Listing Directories for WordPress <= 6.4.22 - Authenticated (Subscriber+) Stored Cross-Site Scripting
• SVG Support <= 2.5.14 - Missing Authorization
• WP Blog and Widget <= 2.3 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode
• Royal Elementor Addons <= 1.3.59 - Reflected Cross-Site Scripting
• iPanorama 360 WordPress Virtual Tour Builder <= 1.8.3 - Missing Authorization
• Ninja Tables <= 5.2.3 - Authenticated (Administrator+) SQL Injection
• Shortcodes and extra features for Phlox theme <= 2.17.0 - Authenticated (Contributor+) Stored Cross-Site Scripting via aux_contact_box and aux_gmaps Shortcodes
• User Verification by PickPlugins <= 2.0.46 - Unauthenticated Authentication Bypass via OTP Verification REST API Endpoint
• Lightbox & Modal Popup WordPress Plugin – FooBox <= 2.7.28 - Authenticated (Contributor+) Stored DOM-Based Cross-Site Scripting via HTML Data Attributes
• Casengo Live Chat Support <= 2.1.4 - Cross-Site Request Forgery
• Gum Elementor Addon <= 1.3.6 - Authenticated (Contributor+) Stored Cross-Site Scripting
• Easy Forms for Mailchimp <= 6.8.10 - Authenticated (Admin+) Stored Cross-Site Scripting
• WPB Floating Menu or Categories – Sticky Floating Side Menu & Categories with Icons <= 1.0.8 - Authenticated (Editor+) Stored Cross-Site Scripting via 'Icon CSS Class' Category Field
• Real3D Flipbook Lite <= 5.3 - Authenticated (Author+) Stored Cross-Site Scripting
• NextGen Gallery <= 2.1.10 - Local File Inclusion
• Easy Property Listings <= 3.5.2 - Authenticated(Contributor+) SQL Injection via Shortcode
• MyOrderDesk <= 3.2.6 - Authenticated (Contributor+) Stored Cross-Site Scripting
• S3Player – WooCommerce & Elementor Integration <= 4.2.1 - Reflected Cross-Site Scripting
• Nexa Blocks <= 1.1.1 - Unauthenticated Blind Server-Side Request Forgery via 'demo_json_file' Parameter
• Formidable Forms <= 6.7 - Authenticated (Administrator+) Stored Cross-Site Scripting
• BuddyPress <= 9.0.0 - Information Disclosure via REST API
• Ninja Forms Contact Form <= 3.2.14 - Parameter Tampering
• Fastly <= 1.2.28 - Cross-Site Request Forgery
• Feeds for YouTube (YouTube video, channel, and gallery plugin) <= 2.2.1 - Authenticated (Contributor+) DOM-Based Stored Cross-Site Scripting
• Backwp <= 2.0.2 - Cross-Site Request Forgery
• FULL – Cliente 3.1.5 - 3.1.25 - Authenticated (Subscriber+) SQL Injection
• Easy Filter <= 1.10 - Reflected Cross-Site Scripting
• Lingvico <= 1.0.14 - Unauthenticated Local File Inclusion
• Video Conferencing with Zoom <= 4.4.4 - Open Redirect
• Ultimate Bootstrap Elements for Elementor <= 1.4.9 - Unauthenticated Local File Inclusion
• WordPress Brute Force Protection – Stop Brute Force Attacks <= 2.2.5 - Authenticated (Administrator+) SQL Injection via orderby
• Float menu – awesome floating side menu <= 6.0 - Cross-Site Request Forgery to Menu Deletion
• Perfect Portfolio <= 1.2.0 - Cross-Site Request Forgery to Notice Dismissal
• Vitepos <= 3.6.1 - Authenticated (Vendor+) SQL Injection via 'src_by[].val' Parameter via 'bt' Operator
• WPCafe – Online Food Ordering, Restaurant Menu, Delivery, and Reservations for WooCommerce <= 2.2.25 - Authenticated (Contributor+) File inclusion via Shortcode