Vulnerability archive: section 9, page 15

Open a report to review affected versions, available fixes and original sources. Each report covers a specific issue; its presence does not establish whether your website is affected.

• Ninja Forms Contact Form – The Drag and Drop Form Builder for WordPress <= 3.3.13 - Cross-Site Scripting
• Avada (Fusion) Builder <= 3.15.1 - Authenticated (Subscriber+) Sensitive Information Exposure via Insecure Direct Object Reference
• Full Screen Menu for Elementor <= 1.0.7 - Authenticated (Contributor+) Post Disclosure
• WoodMart <= 8.2.3 - Authenticated (Contributor+) Stored Cross-Site Scripting
• Quick Restaurant Reservations <= 1.6.7 - Missing Authorization
• Document Embedder – Embed PDFs, Word, Excel, and Other Files <= 2.0.0 - Missing Authorization to Unauthenticated Document Manipulation
• Orbit Fox by ThemeIsle <= 2.10.36 - Authenticated (Author+) Stored Cross-Site Scripting via SVG File Upload
• User Registration <= 4.2.4 - Authenticated (Contributor+) Stored Cross-Site Scripting via urcr_restrict Shortcode
• Woo Hoo <= 1.25 - Unauthenticated Local File Inclusion
• Countdown & Clock <= 2.3.2 - Authenticated (Admin+) Stored Cross-Site Scripting
• Sneeit Framework <= 8.3 - Unauthenticated Remote Code Execution in sneeit_articles_pagination_callback
• Royal Elementor Addons and Templates <= 1.3.986 - Authenticated (Contributor+) Stored Cross-Site Scripting via Team Member Widget
• Aiomatic - AI Content Writer, Editor, ChatBot & AI Toolkit <= 2.5.0 - Authenticated (Subscriber+) Arbitrary File Upload
• Botiga Pro <= 1.6.4 - Missing Authorization
• Watu Quiz <= 2.6.7 - Authenticated (Admin+) SQL Injection
• StorePress <= 1.0.12 - Authenticated (Contributor+) Stored Cross-Site Scripting
• Responsive Pricing Table <= 5.1.6 - Authenticated (Contributor+) Stored Cross-Site Scripting
• Trendy Travel <= 6.7 - Reflected Cross-Site Scripting
• Amazon Affiliate <= 3.12.2 - Reflected File Download
• Cost Calculator Builder <= 4.0.1 - Unauthenticated Price Manipulation and Insecure Direct Object Reference
• Happy Baby <= 1.2.12 - Unauthenticated Local File Inclusion
• Style Kits <= 1.8.0 - Cross-Site Request Forgery Bypass
• Support for CitiLights - Real Estate WordPress Theme <= 3.7.1 - Authenticated (Subscriber+) PHP Object Injection
• Export any WordPress data to XML/CSV < 1.4.1 & WP ALL Export Pro < 1.8.6 - Cross-Site Request Forgery to PHAR Deserialization
• GS Logo Slider – Ticker, Grid, List, Table & Filter Views <= 3.3.7 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode
• Related Products for WooCommerce <= 3.3.15 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode
• Custom Post Status <= 1.1.0 - Cross-Site Request Forgery
• Simple Modal <= 0.3.3 - Reflected Cross-Site Scripting
• Smart Popup by Supsystic <= 1.11.2 - Unauthenticated Stored Cross-Site Scripting
• WP Time Slots Booking Form <= 1.2.06 - Unauthenticated Price Manipulation
• Peer Publish <= 1.0 - Cross-Site Request Forgery
• BCS BatchLine Book Importer <= 1.5.7 - Arbitrary Product Import/Update
• WowRevenue <= 2.1.3 - Missing Authorization to Authenticated (Subscriber+) Arbitrary Plugin Installation/Activation
• Uncanny Automator – Easy Automation, Integration, Webhooks & Workflow Builder Plugin <= 6.4.0.2 - Missing Authorization
• Testimonial <= 2.3 - Authenticated (Contributor+) SQL Injection
• Kallyas <= 4.21.0 - Authenticated (Contributor+) Local File Inclusion
• Security Ninja (Premium) <= 5.289 - 2-Factor Authentication Bypass
• Dokan <= 5.0.10 - Insecure Direct Object Reference to Authenticated (Vendor+) Cross-Vendor Downloadable Product Access Grant
• wpDiscuz <= 7.6.11 - Cross-Site Request Forgery
• Paytium: Mollie payment forms & donations <= 4.3.7 - Missing Authorization in 'update_profile_preference'
• Everest Forms – Contact Form, Quiz, Survey, Newsletter & Payment Form Builder for WordPress <= 3.1.1 - Unauthenticated PHP Object Injection
• Simple Tooltips <= 2.1.4 - Authenticated (Administrator+) Stored Cross-Site Scripting
• DSGVO Google Web Fonts GDPR <= 1.1 - Unauthenticated Arbitrary File Upload via 'fonturl' Parameter
• ARMember – Membership Plugin, Content Restriction, Member Levels, User Profile & User signup <= 4.0.26 - Authenticated (Contributor+) PHP Object Injection
• Easy Elementor Addons <= 2.2.8 - Authenticated (Contributor+) Local File Inclusion
• Manage Notification E-mails <= 1.8.2 - Cross-Site Request Forgery to Plugin Options Update
• Qode Essential Addons <= 1.6.3 - Authenticated (Contributor+) Local File Inclusion
• SurveyJS <= 1.12.32 - Authenticated (Contributor+) Stored Cross-Site Scripting via id Parameter
• Ahime Image Printer <= 1.0.0 - Unauthenticated Arbitrary File Download
• Extensions For CF7 <= 3.0.6 - Unauthenticated Stored Cross-Site Scripting
• Premium Addons for Elementor – AI-Ready Elementor Addons, Widgets & Templates <= 4.11.110 - Missing Authorization
• Google Plus <= 1.0.2 - Reflected Cross-Site Scripting
• Guest posting / Frontend Posting wordpress plugin – WP Front User Submit / Front Editor <= 4.4.7 - Authenticated (Admin+) Stored Cross-Site Scripting
• LTL Freight Quotes – ODFL Edition < 4.2.19 - Unauthenticated Stored Cross-Site Scripting
• WP Glossary <= 3.1.2 - Authenticated (Contributor+) Stored Cross-Site Scripting
• Goza - Nonprofit Charity WordPress Theme <= 3.2.2 - Missing Authorization to Unauthenticated Arbitrary File Upload via Plugin Installation
• Themehunk Login Registration <= 1.0.2 - Unauthenticated Privilege Escalation via 'role' Parameter
• Directory Kit <= 1.5.4 - Unauthenticated SQL Injection
• Streamit <= 4.5.0 - Unauthenticated Remote Code Execution
• Elementor Addons, Widgets and Enhancements – Stax <= 1.4.3 - Missing Authorization in toggle_widget
• wpForo Forum <= 3.0.5 - Authenticated (Subscriber+) Arbitrary File Deletion via Custom Profile Field File Path
• Better Messages – Chat Rooms, Group Chat, Private Messages & AI Chat Bots <= 2.15.22 - Unauthenticated Stored Cross-Site Scripting
• Weluka Lite <= 1.0.3 - Authenticated (Contributor+) Stored Cross-Site Scripting
• Image Slider by Ays- Responsive Slider and Carousel <= 2.7.0 - Cross-Site Request Forgery to Arbitrary Slider Deletion
• FluentSMTP – WP SMTP Plugin with Amazon SES, SendGrid, MailGun, Postmark, Google and Any SMTP Provider <= 2.2.82 - Unauthenticated PHP Object Injection
• GeoDirectory <= 2.8.186 - Unauthenticated SQL Injection via 'latitude' Parameter via Stored Pending Listing
• WP Less Compiler <= 1.3.0 - Unauthenticated Stored Cross-Site Scripting
• Travel Map <= 1.0.1 - Unauthenticated Cross-Site Scripting
• JoomSport <= 5.7.9 - Authenticated (Administrator+) SQL Injection via 'order' Parameter
• WC Fields Factory <= 4.1.10 - Missing Authorization
• Full Width Banner Slider Wp <= 1.1.7 - Reflected Cross-Site Scripting via search_term
• click5 CRM add-on to Ninja Forms <= 1.0.1 - Missing Authorization
• WPBookit <= 1.0.6 - Unauthenticated Stored Cross-Site Scripting
• Happyforms – Form Builder for WordPress: Drag & Drop Contact Forms, Surveys, Payments & Multipurpose Forms <= 1.26.15 - Unauthenticated Stored Cross-Site Scripting
• PropertyShift <= 1.0.0 - Reflected Cross-Site Scripting
• JS MultiHotel <= 2.2.1 - Reflected Cross-Site Scripting
• WPMK PDF Generator <= 1.0.1 - Cross-Site Request Forgery
• GD bbPress Tools <= 3.5.3 - Authenticated (Contributor+) Stored Cross-Site Scripting
• WPJAM Basic <= 7.0 - Unauthenticated Server-Side Request Forgery
• Perfmatters <= 2.5.9.1 - Authenticated (Subscriber+) Arbitrary File Deletion via 'delete' Parameter
• Link Library <= 5.9.12.29 - Reflected Cross-Site Scripting
• Miti < 1.5.3 - Reflected Cross-Site Scripting
• European VAT Compliance Assistant for WooCommerce <= 1.36.10 - Unauthenticated Stored Cross-Site Scripting via CF-IPCountry Header
• Easy Digital Downloads <= 3.6.2 - Unvalidated Redirect in Password Reset Flow via edd_redirect
• WIP Custom Login <= 1.2.9 - Cross-Site Request Forgery via save_option
• Cookie Notice & Consent Banner for GDPR & CCPA Compliance <= 1.7.1 - Authenticated Stored Cross-Site Scripting
• HTML5 Webcam Microphone Recorder Forms < 1.55 - Cross-Site Scripting
• rtMedia for WordPress, BuddyPress and bbPress <= 4.2 - Arbitary File Upload
• White Label CMS <= 2.7.3 - Missing Authorization to Plugin Settings Reset
• Multiple Page Generator Plugin – MPG <= 3.4.0 - Authenticated (Editor+) Remote Code Execution
• WP Query Console <= 1.0 - Unauthenticated Remote Code Execution
• Hubbub Lite <= 1.36.3 - Authenticated (Contributor+) Stored Cross-Site Scripting
• Companion Auto Update <= 3.3.5 - Authenticated (Admin+) SQL Injection
• PixelYourSite <= 11.2.1 - Unauthenticated Sensitive Information Exposure via Order-Received Endpoint Missing Key Validation
• My Calendar < 3.7.7 - Unauthenticated Denial of Service
• WPLP Cookie Consent <= 4.4.3 - Cross-Site Request Forgery
• Active Directory Integration / LDAP Integration <= 4.1.10 - LDAP Passback
• Jetpack – WP Security, Backup, Speed, & Growth <= 16.2 - Missing Authorization
• User Submitted Posts <= 20260113 - Incorrect Authorization to Unauthenticated Category Restriction Bypass via 'user-submitted-category' Parameter
• Tiare Membership <= 1.2 - Unauthenticated Privilege Escalation