Vulnerability archive: section 9, page 1

Open a report to review affected versions, available fixes and original sources. Each report covers a specific issue; its presence does not establish whether your website is affected.

• leenk.me < 2.6.0 - Stored Cross-Site Scripting
• EmbedPress – Embed PDF, Google Docs, Vimeo, Wistia, Embed YouTube Videos, Audios, Maps & Embed Any Documents in Gutenberg & Elementor <= 4.0.1 - Authenticated (Contributor+) Stored Cross-Site Scripting via EmbedPress PDF Widget
• Felici (All Versions) - Arbitrary File Upload
• miniOrange 2FA – Two Factor Authentication for WordPress (OTP, SMS, Email, Google Authenticator) < 6.2.6 - Two-Factor Authentication Bypass
• WP Editor <= 1.2.6.2 - Cross-Site Scripting
• WebARX <= 1.3.0 - Firewall Bypass
• WP Booklet <= 2.1.8 - Authenticated (Subscriber+) Remote Code Execution
• Gameplan - Event and Gym Fitness WordPress Theme <= 1.6.4 - Reflected Cross-Site Scripting
• Choreo <= 1.6 - Unauthenticated Local File Inclusion
• Opal Portfolio <= 1.0.4 - Authenticated (Contributor+) Stored Cross-Site Scripting
• Out-of-the-Box <= 1.20.2 - Reflected Cross-Site Scripting
• Quiz and Survey Master (QSM) <= 10.3.1 - Authenticated (Subscriber+) SQL Injection via `is_linking` Query Parameter
• Vimeography: Vimeo Video Gallery WordPress Plugin <= 2.3.2 - Authenticated (Contributor+) PHP Object Injection
• Count per Day < 3.2.6 - Cross-Site Scripting
• Theme My Login <= 6.3.9 - Local File Inclusion
• Ads Pro Plugin - Multi-Purpose WordPress Advertising Manager <= 4.89 - Unauthenticated Local File Inclusion
• LiveSync for WordPress <= 1.0 - Cross-Site Request Forgery to Arbitrary Settings Update
• Aldo <= 1.0.10 - Unauthenticated Local File Inclusion
• EasyAzon – Amazon Associates Affiliate <= 5.1.0 - Missing Authorization on AJAX actions
• ClickWhale <= 2.4.6 - Missing Authorization
• WooCommerce Booking Bundle Hours <= 0.7.4 - Cross-Site Request Forgery
• Shortlinks by Pretty Links <= 3.6.2 - Reflected Cross-Site Scripting via post_status
• GetGenie <= 4.4.3 - Unauthenticated Stored Cross-Site Scripting
• Favicon Rotator <= 1.2.10 - Reflected Cross-Site Scripting
• CopyRightPro <= 2.1 - Cross-Site Request Forgery
• Mission <= 1.22 - Unauthenticated Local File Inclusion
• The Countdown <= 2.0.1 - Authenticated (Contributor+) Stored Cross-Site Scripting via clientId Parameter
• Media Library Assistant <= 3.35 - Authenticated (Contributor+) Stored Cross-Site Scripting via mla_link_attributes Parameter
• Premium Addons for Elementor <= 4.10.36 - Authenticated (Contributor+) Stored Cross-Site Scripting via Countdown Widget
• Photo Gallery by 10Web <= 1.5.24 - Authenticated Local File Inclusion
• Avada (Fusion) Builder <= 3.16.1 - Unauthenticated Arbitrary WordPress Action Invocation via '{action_hook}' Dynamic-Data Token in Form Field
• Events Manager – Calendar, Bookings, Tickets, and more! <= 7.4.2 - Unauthenticated Stored Cross-Site Scripting
• WooCommerce TBC Credit Card Payment Gateway (Free) <= 2.0.0 - Reflected Cross-Site Scripting
• Cozy Blocks – Website Builder for WordPress Block Editor | Gutenberg Blocks, Patterns & Templates <= 2.2.23 - Unauthenticated Insecure Direct Object Reference
• FULL – Cliente <= 3.1.22 - Reflected Cross-Site Scripting
• Responsive Lightbox <= 2.4.8 - Authenticated (Author+) Stored Cross-Site Scripting
• Avatar <= 0.1.4 - Authenticated (Subscriber+) Insecure Direct Object Reference
• eCommerce Product Catalog Plugin for WordPress <= 3.3.32 - Reflected Cross-Site Scripting
• Off-Canvas Sidebars & Menus (Slidebars) <= 0.5.8.5 - Cross-Site Request Forgery
• Attractive Donations System - Easy Stripe & Paypal donations <= 1.25 - Cross-Site Request Forgery
• Terms descriptions <= 3.4.6 - Reflected Cross-Site Scripting
• GeoDirectory <= 2.2.23 - Authenticated (Admin+) SQL Injection
• 2kb Amazon Affiliates Store <= 2.1.5 - Authenticated (Administrator+) Stored Cross-Site Scripting
• Civic Cookie Control <= 1.53 - Missing Authorization
• Payflex Payment Gateway <= 2.6.1 - Open Redirect
• MStore API <= 2.1.5 - Authentication Bypass
• Phlox <= 2.17.7 - Authenticated (Contributor+) Stored Cross-Site Scripting via `data-caption` HTML Attribute
• Thai Lottery Widget <= 2.5 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode Attributes
• ProfileGrid – User Profiles, Memberships, Groups and Communities <= 4.7.4 - Stored Cross-Site Scripting via Profile
• AI Hub - Startup & Technology WordPress Theme <= 1.3.7 - Unauthenticated Arbitrary File Upload
• ConFix <= 1.013 - Unauthenticated Local File Inclusion
• Feedify – Web Push Notifications <= 2.1.8 Reflected Cross-Site Scripting
• Bitcoin / Altcoin Faucet <= 1.6.0 - Cross-Site Request Forgery to Stored Cross-Site Scripting
• Beaver Builder – WordPress Page Builder <= 2.9.4 - Missing Authorization to Authenticated (Contributor+) Global Preset Modification
• WordPress Social Comments Plugin for Vkontakte Comments and Disqus Comments <= 1.6.1 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode
• Ultimate Classified Listings <= 1.7 - Authenticated (Subscriber+) Stored Cross-Site Scripting
• Enable Media Replace <= 4.0.1 - Authenticated (Author+) Arbitrary File Upload
• Hide My WP <= 4.53 - Cross-Site Scripting
• Simple Membership <= 4.5.5 - Exposure of Private Personal Information to an Unauthorized Actor
• Paytium: Mollie payment forms & donations <= 4.3.7 - Missing Authorization in 'paytium_sw_save_api_keys'
• All In Menu <= 1.1.5 - Authenticated (Subscriber+) SQL Injection
• JetEngine <= 3.8.10 - Unauthenticated Stored Cross-Site Scripting
• Events Made Easy <= 3.1.1 - Unauthenticated Payment Bypass
• WSMS (formerly WP SMS) – SMS & MMS Notifications with OTP and 2FA for WooCommerce <= 7.1 - Authenticated (Administrator+) Stored Cross-Site Scripting
• GD Mail Queue <= 4.3 - Reflected Cross-Site Scripting
• WP-reCAPTCHA <= 2.9.8.2 - Multiple Cross-Site Request Forgery
• Time Slot <= 1.3.6 - Authenticated (Contributor+) Stored Cross-Site Scripting
• Post Custom Templates Lite <= 1.14 - Authenticated (Contributor+) Stored Cross-Site Scripting
• Multilanguage by BestWebSoft <= 1.5.2 - Missing Authorization
• WP-Optimize <= 4.1.1 - Authenticated (Admin+) SQL Injection
• Betheme <= 28.1.3 - Authenticated (Contributor+) Stored Cross-Site Scripting
• ALD Login Page <= 1.1 - Cross-Site Request Forgery to Stored Cross-Site Scripting
• Last Updated Shortcode <= 1.0.1 - Authenticated (Contributor+) Stored Cross-Site Scripting
• SearchIQ <= 4.4 - Missing Authorization via getSIQPluginSettings
• Universal Star Rating <= 2.1.0 - Cross-Site Request Forgery
• WP Rocket <= 2.10.3 - Local File Inclusion
• Kirki <= 6.0.11 - Missing Authorization
• AdPlugg WordPress Ad Plugin < 1.1.34 - Cross-Site Scripting
• Recipes Writer <= 1.0.4 - Cross-Site Scripting
• WP Job Openings <= 3.4.2 - Information Exposure
• Page Restriction WordPress (WP) – Protect WP Pages/Post <= 1.3.4 - Protection Mechanism Bypass
• WPGraphQL <= 0.2.3 - Information Exposure
• Pie Register <= 3.8.2.2 - Open Redirect
• Visual Form Builder <= 3.0.7 - Cross-Site Request Forgery to Data Modification
• Share Buttons – Social Media <= 1.0.2 - Authenticated (Contributor+) SQL Injection
• AMP for WP – Accelerated Mobile Pages <= 1.0.77.31 - Authenticated (Admin+) Stored Cross-Site Scripting
• Mang Board <= 2.4.3 - Authenticated (Custom+) Stored Cross-Site Scripting via 'content' Parameter
• AffiliateImporterEb <= 1.0.6 - Reflected Cross-Site Scripting via 'ebdn_min_price'
• iPages Flipbook <= 1.4.6 - Authenticated Contributor+ Stored Cross-Site Scripting via Shortcode
• Photo Album Plus <= 9.2.07.1 - Unauthenticated Export ZIP File Deletion
• MDJM Event Management <= 1.7.5.6 - Reflected Cross-Site Scripting
• SKT Templates – Elementor & Gutenberg templates <= 6.14 - Reflected Cross-Site Scripting
• Emplibot – AI Content Writer with Keyword Research, Infographics, and Linking | SEO Optimized | Fully Automated <= 1.0.9 - Authenticated (Admin+) Server-Side Request Forgery
• Cliengo – Chatbot <= 3.0.4 - Missing Authorization
• LearnPress – WordPress LMS Plugin for Create and Sell Online Courses <= 4.4.9.1 - Missing Authorization
• Helpie FAQ <= 1.9.8 - Reflected Cross-Site Scripting
• Stock Ticker <= 3.24.4 - Authenticated (Contributor+) Stored Cross-Site Scripting via stock_ticker Shortcode
• Ads Booster by Ads Pro <= 1.12 - Unauthenticated Local File Inclusion
• Wpresidence Core <= 5.4.0 - Authenticated (Contributor+) Stored Cross-Site Scripting
• Hydra Booking <= 1.1.10 - Authenticated (Subscriber+) SQL Injection