Vulnerability archive: section 9, page 14

Open a report to review affected versions, available fixes and original sources. Each report covers a specific issue; its presence does not establish whether your website is affected.

• DevKit Pro <= 2.3.0 - Unauthenticated Authentication Bypass to Administrator Account Takeover via 'original_user_id' Cookie in Frontend Revert Switch Flow
• Forex Calculators <= 1.3.6 - Authenticated (Subscriber+) Stored Cross-Site Scripting
• weMail <= 1.14.2 - Missing Authorization to Notice Dismissal
• Zoho CRM Lead Magnet <= 1.8.1.9 - Missing Authorization
• Digital Signature Add-on for WooCommerce <= 2.0 - Unauthenticated Information Exposure
• WPUpper Share Buttons <= 3.42 - Authenticated (Admin+) Stored Cross-Site Scripting
• WP ERP <= 1.13.4 - Missing Authorization
• Mobile Contact Line <= 2.4.0 - Missing Authorization
• Funnel Builder by CartFlows <= 2.0.1 - Authenticated (Editor+) Stored Cross-Site Scripting via settings
• Creative Mail – Easier WordPress & WooCommerce Email Marketing <= 1.6.9 - Unauthenticated SQL Injection via 'checkout_uuid' Parameter
• Charity Addon for Elementor <= 1.3.2 - Authenticated (Contributor+) Stored Cross-Site Scripting
• JobBoardWP – Job Board Listings and Submissions <= 1.1.0 - Authenticated (Admin+) Stored Cross-Site Scripting
• Ninja Forms - Excel Export <= 3.3.6 - Authenticated (Subscriber+) Stored Cross-Site Scripting via 'filter' Parameter
• Paid Membership Subscriptions – Effortless Memberships, Recurring Payments & Content Restriction <= 2.13.4 - Unauthenticated Content Restriction Bypass to Sensitive Information Exposure
• Advance Block Extend <= 1.0.4 - Authenticated (Contributor+) Stored Cross-Site Scripting via TitleColor Block Attribute
• AFI – The Easiest Integration Plugin <= 1.126.12 - Missing Authorization
• Products, Order & Customers Export for WooCommerce <= 2.0.15 - Reflected Cross-Site Scripting
• DeepL Pro API Translation <= 1.7.4 - Sensitive Information Disclosure
• CPT Shortcode Generator <= 1.0 - Authenticated (Administrator+) Stored Cross-Site Scripting via settings
• XStore Core <= 5.3.8 - Authenticated (Subscriber+) Limited Arbitrary File Upload
• Ultra Addons Lite for Elementor <= 1.1.9 - Authenticated (Contributor+) Stored Cross-Site Scripting via Animated Text Field
• kontur Admin Style <= 1.0.4 - Authenticated (Administrator+) Stored Cross-Site Scripting
• Restaurant Menu and Food Ordering <= 2.4.11 - Unauthenticated Local File Inclusion
• Photographers galleries <= 1.1.8 - Authenticated (Contributor+) Stored Cross-Site Scripting
• WP Responsive Tabs horizontal vertical and accordion Tabs <= 1.1.17 - Authenticated (Contributor+) Stored Cross-Site Scripting
• Wicked Folders <= 2.18.16 - Missing Authorization on ajax_save_sort_order
• Ambed <= 1.0.0 - Reflected Cross-Site Scripting
• Planty <= 1.14.0 - Unauthenticated Local File Inclusion
• Event Manager and Tickets Selling for WooCommerce < 3.5.8 - SQL Injection
• Buddyboss Platform <= 2.5.91 - Insecure Direct Object Reference to Authenticated (Subscriber+) Comment on Private Post
• Institute Management <= 5.5 - Authenticated (Administrator+) Stored Cross-Site Scripting via 'Enquiry Form Title' Setting
• Booking calendar, Appointment Booking System <= 3.2.1 - Unauthenticated Arbitrary File Upload
• Team Showcase <= 1.22.15 - Object Injection
• Shortcodes Bootstrap <= 1.1 - Authenticated (Contributor+) Stored Cross-Site Scripting
• OneClick Chat to Order <= 1.0.9 - Missing Authorization to Authenticated (Editor+) Plugin Settings Update
• BackWPup – WordPress Backup & Restore Plugin < 5.7.7 - Authenticated (Administrator+) Path Traversal
• INK Official <= 4.1.2 - Authenticated (Contributor+) Arbitrary File Upload
• WPFront Notification Bar <= 2.0.0 - Authenticated Stored Cross-Site Scripting
• 3D Work In Progress <= 1.0.3 - Authenticated (Subscriber+) Arbitrary File Upload
• Lazy Load for Videos <= 2.18.2 - Cross-Site Request Forgery
• Ni WooCommerce Bulk Product Editor <= 1.4.5 - Reflected Cross-Site Scripting
• WP AutoBuzz <= 1.1.1 - Cross-Site Request Forgery to Stored Cross-Site Scripting via 'googleAccount' Parameter
• Zingiri Tickets <= 3.0.3 - Sensitive Information Disclosure
• Booking Ultra Pro <= 1.1.23 - Authenticated (Subscriber+) Information Exposure
• IP Ban <= 1.2.3 - Cross-Site Request Forgery to Stored Cross-Site Scripting
• Eupago Gateway For Woocommerce <= 4.7.1 - Missing Authorization to Unauthenticated Arbitrary Refund Initiation
• Photoracer Plugin <= 1.0 - SQL Injection
• SiteOrigin CSS <= 1.6.7 - Unauthenticated Stored DOM-Based Cross-Site Scripting via Comment Anchor href via Visual Inspector
• WP-DownloadManager <= 1.68.11 - Authenticated (Admin+) Arbitrary File Upload
• Survey Maker <= 5.1.9.4 - Missing Authorization
• Templately <= 3.7.0 - Missing Authorization
• PWA for WP & AMP <= 1.7.72 - Missing Authorization
• WP Datepicker <= 2.1.0 - Missing Authorization to Authenticated (Subscriber+) Arbitrary Options Update
• Awesome Support – WordPress HelpDesk & Support Plugin <= 3.1.6 - Arbitrary Shortcode Execution
• WordPress Core < 4.8.2 - Cross-Site Scripting in oEmbed
• If-So Dynamic Content Personalization <= 1.8.0.2 - Authenticated (Contributor+) Stored Cross-Site Scripting
• User Frontend: AI Powered Frontend Posting, User Directory, Profile, Membership & User Registration <= 4.3.1 - Authenticated (Subscriber+) PHP Object Injection
• Authors Autocomplete Meta Box <= 1.2 - Reflected Cross-Site Scripting
• Clipr <= 1.2.3 - Admin+ Stored Cross-Site Scripting
• Fancy Product Designer <= 4.6.9 - Insufficient Authorization on Mulitple AJAX Actions
• Embed PDF <= 1.0.6 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode
• Shipmondo – A complete shipping solution for WooCommerce <= 5.0.3 - Missing Authorization to Authenticated (Customer+) Information Disclosure
• Spam Protect for Contact Form 7 <= 1.2.9 - Authenticated (Editor+) Arbitrary File Deletion
• JetWooBuilder <= 2.1.18 - Authenticated (Contributor+) Local File Inclusion
• WPvivid — Backup, Migration & Staging < 0.9.133 - Authenticated (Administrator+) SQL Injection
• Ultimate Addons for WPBakery Page Builder < 3.21.4 - Authenticated (Contributor+) Stored Cross-Site Scripting
• WP Client Reports <= 1.0.16 - Missing Authorization to Sensitive Information Exposure
• Hydra Booking <= 1.2.2 - Missing Authorization
• Cookie Notice & Compliance for GDPR / CCPA <= 2.5.8 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode
• Post Timeline <= 2.2.5 - Reflected Cross-Site Scripting
• Store Exporter for WooCommerce – Export Products, Export Orders, Export Subscriptions, and More <= 2.7.2.1 - Reflected Cross-Site Scripting
• WooCommerce Report <= 1.5.1 - Cross-Site Request Forgery to Arbitrary Options Update
• Crawlomatic Multipage Scraper Post Generator <= 2.7.2 - Authenticated (Author+) Remote Code Execution via 'callback_raw' Shortcode Attribute
• Indeed Membership Pro 7.3 - 8.6 - Missing Authorization Checks
• GD Rating System <= 2.3 - Directory Traversal
• Funnel Builder for WordPress by FunnelKit – Customize WooCommerce Checkout Pages, Create Sales Funnels, Order Bumps & One Click Upsells <= 3.3.1 - Authenticated (Author+) Stored Cross-Site Scripting via SVG Upload
• Trinity Backup – Backup, Migrate, Restore, Clone & Schedule Backups <= 2.0.9 - Unauthenticated Information Exposure
• WP Fountain <= 1.5.9 - Reflected Cross-Site Scripting
• Broken Link Notifier 1.3.1 - 2.0.0 - Unauthenticated Server-Side Request Forgery
• Academy LMS <= 3.5.3 - Missing Authorization
• Image Optimization by Optimole – Lazy Load, CDN, Convert WebP & AVIF <= 3.12.10 - Authenticated (Author+) Stored Cross-Site Scripting via SVG Upload
• Responsive Vertical Icon Menu <= 1.5.8 - Reflected Cross-Site Scripting via 'id'
• Edwiser Bridge <= 4.3.2 - Missing Authorization
• Docket Cache <= 24.07.04 - Missing Authorization
• Ohio Extra <= 3.6.8 - Authenticated (Subscriber+) Stored Cross-Site Scripting
• Event post <= 5.9.4 - Missing Authorization
• Rara Business <= 1.3.0 - Missing Authorization
• WordPress Simple PayPal Shopping Cart <= 4.6.1 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode
• Multiple Plugins by Crocoblock <= (Various Versions) - Missing Authorization
• Hoo Addons for Elementor <= 1.0.6 - Authenticated (Contributor+) Stored Cross-Site Scripting
• Photo Gallery by 10Web – Mobile-Friendly Image Gallery <= 1.8.23 - Authenticated (Contributor+) Stored Cross-Site Scripting via Zipped SVG
• Arena.IM – Live Blogging for real-time events <= 0.4.1 - Authenticated (Contributor+) Stored Cross-Site Scripting via arena_embed_amp Shortcode
• The7 <= 14.3.2 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode 'link' Parameter
• Academist < 1.3 - Unauthenticated Local File Inclusion
• aThemes Addons for Elementor <= 1.0.8 - Authenticated (Contributor+) Stored Cross-Site Scripting
• Timely All-in-One Events Calendar < 1.6 - Cross-Site Scripting
• Woffice CRM <= 5.4.35 - Authenticated (Subscriber+) SQL Injection
• Booking Calendar <= 10.14.14 - Insecure Direct Object Reference to Authenticated (Subscriber+) Arbitrary User Settings Modification
• Gallerio <= 1.01 - Authenticated (Subscriber+) Arbitrary File Upload
• User Access Manager <= 2.3.14 - Missing Authorization