Vulnerability archive: section 8, page 9

Open a report to review affected versions, available fixes and original sources. Each report covers a specific issue; its presence does not establish whether your website is affected.

• List Subpages <= 1.0.6 - Authenticated (Contributor+) Stored Cross-Site Scripting via title Parameter
• Download Manager <= 3.3.53 - Authenticated (Author+) Stored Cross-Site Scripting
• WP REST Cache <= 2026.1.0 - Unauthenticated Stored Cross-Site Scripting
• Redirection for Contact Form 7 <= 3.2.4 - Unauthenticated Arbitrary File Deletion
• Widget Options – Advanced Conditional Visibility for Gutenberg Blocks & Classic Widgets <= 4.1.3 - Authenticated (Contributor+) Remote Code Execution
• Coming soon and Maintenance mode <= 3.7.3 - IP Address Spoofing via get_real_ip
• Business Card <= 1.0.0 - Cross-Site Request Forgery to Card Edit
• BM Content Builder <= 3.16.2.1 - Missing Authorization to Authenticated (Subscriber+) Stored Cross-Site Scripting via ux_cb_page_options_save
• LiquidPoll – Advanced Polls for Creators and Brands <= 3.3.77 - Unauthenticated Stored Cross-Site Scripting
• Link Whisper Free <= 0.7.8 - Unauthenticated Sensitive Information Exposure
• Membership Plugin – Restrict Content <= 3.2.16 - Missing Authentication to Insecure Direct Object Reference and Sensitive Information Exposure
• Creative Contact Form <= 1.0.0 - Cross-Site Request Forgery
• Malmö <= 2.2 - Unauthenticated Local File Inclusion
• Royal Addons for Elementor <= 1.7.1049 - Authenticated (Author+) Arbitrary File Upload via main.php Upload Bypass
• Gutenberg Blocks <= 3.3.1 - Authenticated (Contributor+) Stored Cross-Site Scripting
• Allure Real Estate Theme for Placester <= 0.1.1 - Cross-Site Scripting
• Headless Single Sign On <= 1.6 - Unauthenticated PHP Object Injection
• WHIZZ < 1.0.8 - Reflected Cross-Site Scripting
• Dropshix <= 4.0.14 - Authenticated (Administrator+) Stored Cross-Site Scripting
• Starfish Review Generation & Marketing for WordPress <= 3.1.19 - Authenticated (Subscriber+) Arbitrary Options Update via srm_restore_options_defaults
• Advanced Appointment Booking & Scheduling <= 2.5 - Cross-Site Request Forgery
• Migration, Backup, Staging – WPvivid Backup & Migration <= 0.9.116 - Authenticated (Administrator+) Arbitrary File Upload
• Gallery Images Ape <= 2.0.6 - Authenticated Plugin Deactivation
• Coditor <= 1.1 - Remote Code Execution
• Photo Gallery by 10Web <= 1.2.41 - Cross-Site Request Forgery
• Liveticker (by stklcode) <= 1.2.2 - Authenticated (Contributor+) Stored Cross-Site Scripting
• Generic Elements <= 1.2.9 - Authenticated (Contributor+) Stored Cross-Site Scripting
• Email Before Download <= 6.9.7 - Cross-Site Request Forgery
• Complete Gallery Manager <= 3.3.3 - Arbitrary File Upload
• License Manager for WooCommerce <= 3.0.9 - Reflected Cross-Site Scripting
• WooCommerce Conditional Marketing Mailer <= 1.5.1 - Improper Authorization
• Aplazo Payment Gateway <= 1.4.3 - Missing Authorization to Unauthenticated Order Status Manipulation
• Activity Log Plugin < 2.0.4 - Fulle Path Disclosure
• WP Directory Kit <= 1.3.5 - Reflected Cross-Site Scripting
• Chained Quiz <= 1.3.2.4 - Cross-Site Request Forgery to Arbitrary Quiz Deletion and Copying
• FireStorm Shopping Cart eCommerce Plugin <= 2.07.02 - SQL Injection
• Bit File Manager <= 6.9.0 - Authenticated (Subscriber+) Information Exposure
• Tab My Content <= 1.0.0 - Reflected Cross-Site Scripting
• ActivityPub <= 0.17.0 - Authenticated (Subscriber+) Insecure Direct Object Reference to Sensitive Post Content Exposure
• Feed Them Social – for Twitter feed, Youtube and more <= 2.9.9 - Reflected Cross-Site Scripting
• RapidLoad Power-Up for Autoptimize <= 1.7.1 - Missing Authorization in 'queue_posts'
• Opentracker Analytics <= 1.3 - Reflected Cross-Site Scripting
• KuteShop <= 4.2.9 - Authenticated (Contributor+) Local File Inclusion
• Gift Certificate Creator <= 1.1.0 - Reflected Cross-Site Scripting via receip_address Parameter
• ansi-regex >=2.1.1 <3.0.1 >=4.0.0 <4.1.1 >=5.0.0 <5.0.1 >=6.0.0 <6.0.1 - Regular Expression Denial of Service (ReDoS)
• Sala <= 1.1.3 - Reflected Cross-Site Scripting
• Kids Heaven <= 3.2 - Authenticated (Subscriber+) PHP Object Injection
• Social Share Boost <= 4.5 - Cross-Site Request Forgery via 'syntatical_settings_content'
• Hubbub Lite <= 1.31.0 - Unauthenticated Information Exposure
• Paid Member Subscriptions <= 2.14.3 - Authenticated (Contributor+) Stored Cross-Site Scripting
• Anti Spam and list cleaner – AcyChecker <= 1.8.1 - Unauthenticated Stored Cross-Site Scripting
• Dynamic User Directory <= 2.4 - Authenticated (Subscriber+) PHP Object Injection
• WPeMatico RSS Feed Fetcher <= 2.8.3 - Missing Authorization
• Analytics <= 1.7.0 - Multiple Cross-Site Scripting
• 404 SEO Redirection <= 1.3 - Cross-Site Request Forgery
• Newsletters <= 4.13 - Unauthenticated SQL Injection via wpmlsubscriber_id Parameter
• Car Rental System <= 1.3 - Unauthenticated Stored Cross-Site Scripting
• Smart Post Show – Post Grid, Post Carousel & Slider, and List Category Posts <= 3.0.12 - Authenticated (Administrator+) PHP Object Injection
• Dropify <= 4.6.9 - Reflected Cross-Site Scripting
• Quiz Maker <= 6.3.9.4 - Content Spoofing
• Calculated Fields Form <= 1.1.150 - Authenticated (Administrator+) Stored Cross-Site Scripting
• Lobo <= 2.8.6 - Missing Authorization
• Find Slow Functions & Actions & Filters & Hooks <= 1.40 - Reflected Cross-Site Scripting
• Admin Safety Guard — Login Security & 2FA <= 1.2.9 - Missing Authorization
• Custom Simple RSS < 2.0.7 - Cross-Site Request Forgery
• Best Restaurant Menu by PriceListo <= 1.4.2 - Missing Authorization
• Multiline files upload for contact form 7 <= 2.8.1 - Missing Authorization to Authenticated (Subscriber+) Plugin Deactivation
• Widgetize Pages Light <= 3.0 - Cross-Site Request Forgery to Stored Cross-Site Scripting
• Complianz – GDPR/CCPA Cookie Consent <= 7.4.5 - Missing Authorization to Unauthenticated Private Post Content Disclosure via Consent Area REST Endpoint
• Amelia <= 1.0.46 - Cross-Site Request Forgery
• Civi - Job Board & Freelance Marketplace WordPress Theme <= 2.1.6.1 - Authentication Bypass
• a3rev Multiple Plugins <= Various Versions - Cross-Site Request Forgery to Settings Changes
• ELEX WordPress HelpDesk & Customer Ticketing System <= 3.2.9 - Authenticated (Subscriber+) Insecure Direct Object Reference via 'eh_crm_ticket_single_view_client'
• CWD – Stealth Links <= 1.3 - Unauthenticated SQL Injection
• WhatsCart - Whatsapp Abandoned Cart Recovery, Order Notifications, Chat Box, OTP for WooCommerce <= 1.1.0 - Unauthenticated SQL Injection
• Store Hours for WooCommerce <= 4.3.20 - Reflected Cross-Site Scripting
• WP Fast Total Search <= 1.79.262 - Missing Authorization
• GoQSmile <= 1.0.1 - Reflected Cross-Site Scripting
• Popup Builder <= 3.72 Missing Authorization on AJAX actions
• List Related Attachments <= 2.1.6 - Authenticated (Contributor+) Stored Cross-Site Scripting
• Woo Commerce Minimum Weight <= 3.0.1 - Cross-Site Request Forgery via Settings Update Form
• UsersWP - Social Login <= 1.5.9 - Unauthenticated Privilege Escalation
• CM Email Registration Blacklist and Whitelist <= 1.4.8 - Cross-Site Request Forgery
• HUSKY <= 1.4.4 - Unauthenticated Local File Inclusion via 'custom_tpl' Shortcode Attribute via 'woof_draw_products' AJAX
• WordPress Comments Import & Export <= 2.3.7 - Authenticated (Author+) Arbitrary File Read via Directory Traversal
• Cooked – Recipe Management <= Authenticated (Contributor+) Stored Cross-Site Scripting
• WPLegalPages <= 2.9.2 - Authenticated (Author+) Stored Cross-Site Scripting via Shortcode
• Database Addon For WPForms ( wpforms entries ) – WPFormsDB < 1.1.1 - Cross-Site Request Forgery
• WC Pickup Store <= 1.8.9 - Missing Authorization to Unauthenticated Settings Update
• Wishlist <= 1.0.44 - Authenticated (Subscriber+) SQL Injection
• Tax Exempt for WooCommerce <= 1.9.3 - Authenticated (Customer+) Path Traversal
• Zielke Design Project Gallery <= 2.5.0 - Reflected Cross-Site Scripting
• Easy Digital Downloads <= 3.6.9 - Authenticated (Admin) Arbitrary File Deletion
• Sina Extension for Elementor <= 3.6.1 - Authenticated (Administrator+) Stored Cross-Site Scripting
• Multi-column Tag Map <= 17.0.24 - Authenticated (Contributor+) Stored Cross Site Scripting
• Unnamed < 1.2.17.1 and Unnamed SE < 1.0.3 - Cross-Site Scripting
• Track Geolocation Of Users Using Contact Form 7 <= 2.0 - Authenticated (Administrator+) Stored Cross-Site Scripting
• Fusion Builder <= 3.11.1 - Reflected Cross-Site Scripting via User Register Element
• Mobile browser color select <= 1.0.1 - Cross-Site Request Forgery to Stored Cross-Site Scripting
• Careerfy - Job Board WordPress Theme <= 3.9.0 - Reflected Cross-Site Scripting