Vulnerability archive: section 9, page 16

Open a report to review affected versions, available fixes and original sources. Each report covers a specific issue; its presence does not establish whether your website is affected.

• SKT Skill Bar <= 2.5 - Authenticated (Contributor+) Stored Cross-Site Scripting
• WordPress Core 1.5 - 2.3.1 - Authorization Bypass
• VR-Frases (collect & share quotes) <= 3.0.1 - Reflected Cross-Site Scripting
• Hide My WP <= 6.2.12 - Reflected Cross-Site Scripting
• Super Store Finder <= 6.9.3 - Unauthenticated Email Creation/Sending
• Export All Posts, Products, Orders, Refunds & Users <= 2.9.3 - Information Disclosure Through Unprotected Directory
• Heateor Social Login WordPress <= 1.1.31 - Authenticated (Contributor+) Stored Cross-Site Scripting
• Disable Admin Notices – Hide Dashboard Notifications <= 1.4.2 - Cross-Site Request Forgery to Plugin Settings Update
• Disable Auto Updates <= 1.4 - Cross-Site Request Forgery to Auto-update Disable
• Post Carousel & Slider <= 1.0.3 - Authenticated (Contributor+) Stored Cross-Site Scripting
• Sales Countdown Timer for WooCommerce and WordPress <= 1.1.8.1 - Authenticated (Contributor+) Local File Inclusion
• Dollie Hub – Build Your Own WordPress Cloud Platform <= 6.2.0 - Authenticated (Contributor+) Post Disclosure
• Simple Org Chart <= 2.3.4 - Cross-Site Request Forgery
• Easy Pixels by JEVNET <= 2.13 - Unauthenticated Stored Cross-Site Scripting
• OwnerRez <= 1.2.0 - Cross-Site Request Forgery
• Instant Images <= 6.1.0 - Authenticated (Author+) Arbitrary Options Update
• WP Shortcodes Plugin — Shortcodes Ultimate <= 7.4.2 - Authenticated (Contributor+) Stored Cross-Site Scripting via Plugin Shortcodes
• Optimole – Optimize Images | Convert WebP & AVIF | CDN & Lazy Load | Image Optimization <= 4.2.7 - Unauthenticated Stored Cross-Site Scripting
• Block Bad Bots and Stop Bad Bots Crawlers and Spiders and Anti Spam Protection < 6.6.7 - Reflected Cross-Site Scripting
• WP Database Backup <= 5.1.1 - Cross-Site Scripting
• Share to Google Classroom <= 1.0 - Authenticated (Contributor+) Stored Cross-Site Scripting via share_to_google Shortcode
• Carousel Slider <= 1.10.2 - Cross-Site Request Forgery
• MapMap <= 1.1 - Cross-Site Request Forgery to Settings Update and Stored Cross-Site Scripting
• Mobile Kiosk <= 1.3.0 - Authenticated (Contributor+) Stored Cross-Site Scripting
• JobBoardWP – Job Board Listings and Submissions <= 1.3.0 - Reflected Cross-Site Scripting
• WP JobSearch <= 2.6.7 - Authenticated (Subscriber+) Arbitrary File Upload
• Element Pack Addons for Elementor <= 8.0.0 - Authenticated (Contributor+) DOM-Based Stored Cross-Site Scripting via data-caption Attribute
• Custom Header Images <= 1.2.1 - Cross-Site Request Forgery
• Persian WooCommerce SMS <= 7.0.2 - Reflected Cross-Site Scripting
• Download Manager <= 3.2.70 - Insufficient Authorization to Information Disclosure
• WordPress Infinite Scroll – Ajax Load More <= 5.5.3 - Cross-Site Request Forgery to PHAR Deserialization
• Anderson <= 1.4.2 - Unauthenticated Local File Inclusion
• WordPress Core < 5.5.2 - Reflected Cross-Site Scripting via Global Variables
• Post Comments as bbPress Topics <= 2.2.3 - Authenticated (Author+) Stored Cross-Site Scripting
• WordPress Core < 2.1 - Denial of Service
• Quantity Dynamic Pricing & Bulk Discounts for WooCommerce <= 4.0.3 - Authenticated (Contributor+) Stored Cross-Site Scripting
• Essential Blocks for Gutenberg <= 4.4.9 - Missing Authorization
• Product Addons and Product Options With Custom Fields – WowAddons <= 1.6.14 - Unauthenticated Stored Cross-Site Scripting
• iCal Feeds <= 1.5.3 - Reflected Cross-Site Scripting
• Cooked – Recipe Management <= 1.8.0 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode
• Layouts for WPBakery <= 1.1.3 - Missing Authorization to Unauthenticated Template Cache Manipulation via 'handle_sync' AJAX Action
• AtomChat <= 1.1.5 - Authenticated (Contributor+) Stored Cross-Site Scripting via atomchat Shortcode
• WPtouch <= 4.3.42 - Reflected Cross-Site Scripting
• WordPress Online Booking and Scheduling Plugin – Bookly <= 14.5 - Cross-Site Scripting
• BMI BMR Calculator <= 1.3 - Reflected Cross-Site Scripting
• Impreza <= 8.17.4 - Reflected Cross-Site Scripting
• Porto Theme - Functionality <= 3.1.0 - Authenticated (Contributor+) Local File Inclusion via Shortcode
• Replyable – Subscribe to Comments and Reply by Email < 1.4.6 - Cross-Site Scripting
• Stock in & out <= 1.0.4 - SQL Injection
• Social Share Buttons by Supsystic <= 2.2.3 - Missing Authorization
• Print Invoice & Delivery Notes for WooCommerce <= 4.7.2 - Cross-Site Request Forgery via ts_reset_tracking_setting
• DataMentor <= 1.7 - Authenticated (Contributor+) Stored Cross-Site Scripting
• PayPal Express Checkout <= 2.1.2 - Cross-Site Request Forgery
• MailerLite – Signup forms (official) <= 1.7.21 - Missing Authorization to Authenticated (Contributor+) Form Creation and Deletion
• AutomateWoo <= 5.7.1 - Authenticated (Shop manager+) SQL Injection
• Breaking News WP <= 1.3 - Missing Authorization to Authenticated (Subscriber+) Local File Inclusion/Read
• WP Admin Style <= 0.1.2 - Authenticated Stored Cross-Site Scripting
• Download Counter <= 1.4 - Unauthenticated Arbitrary File Read
• WebwinkelKeur <= 3.24 - Cross-Site Request Forgery
• Video XML Sitemap Generator <= 1.0.0 - Cross-Site Request Forgery via video_sitemap_generate
• Fence URL <= 2.0.0 - Cross-Site Request Forgery to Cross-Site Scripting
• Ultimate Addons for Beaver Builder <= 1.35.13 - Authenticated(Contributor+) Directory Traversal to Arbitrary File Download
• CSS3 Accordions for WordPress <= 3.0 - Missing Authorization
• Loan Comparison <= 1.5.1 - Reflected Cross-Site Scripting
• WP User Frontend <= 3.5.25 - SQL Injection & Reflected Cross-Site Scripting
• WPCS <= 1.2.0.3 - Unauthenticated Arbitrary Shortcode Execution
• Social Media Share Buttons & Social Sharing Icons < 3.0.1 - Reflected Cross-Site Scripting
• Toast Mobile Menu <= 1.0.8 - Unauthenticated Stored Cross-Site Scripting
• WPSchoolPress <= 2.2.36 - Missing Authorization
• Rescue Shortcodes <= 2.9 - Authenticated (Contributor+) Stored Cross-Site Scripting via rescue_progressbar Shortcode
• Social Media Icons Widget <= 1.6 - Cross-Site Request Forgery
• Reviews Feed – Add Testimonials and Customer Reviews From Google Reviews, Yelp, TripAdvisor, and More <= 1.1.2 - Missing Authorization to Authenticated (Subscriber+) Limited Settings Update
• Dashboard Notepad <= 1.42 - Cross-Site Request Forgery
• Elementor Website Builder <= 2.8.3 - Cross-Site Scripting
• LTL Freight Quotes – Purolator Edition <= 2.2.3 - Unauthenticated SQL Injection
• Library Bookshelves <= 5.10 - Authenticated (Contributor+) Stored Cross-Site Scripting
• WooCommerce Dynamic Pricing and Discounts <= 2.4.1 - Stored Cross-Site Scripting
• Redirect Redirection <= 1.1.3 - Cross-Site Request Forgery via 'SaveSettings' function
• Bit Assist <= 1.5.2 - Path Traversal to Authenticated (Subscriber+) Arbitrary File Read via fileID Parameter
• Videospirecore Theme Plugin <= 1.0.6 - Authenticated (Subscriber+) Privilege Escalation via User Email Change/Account Takeover
• Mediavine Control Panel <= 2.10.10 - Missing Authorization
• AllCoach <= 1.0.1 - Privilege Escalation to Unauthenticated Account Takeover
• JCH Optimize < 6.0.1 - Authenticated (Subscriber+) Stored Cross-Site Scripting
• Template Kit – Export <= 1.0.21 - Authenticated (Administrator+) Stored Cross-Site Scripting
• Marketing Automation <= 1.2.6.8 - Reflected Cross-Site Scripting
• phpinfo() WP <= 5.0 - Unauthenticated Information Exposure
• SpendeOnline.org <= 3.0.1 - Authenticated (Contributor+) Stored Cross-Site Scripting
• WpEvently <= 5.1.1 - Cross-Site Request Forgery
• Delisho <= 1.0.6 - Authenticated (Contributor+) Stored Cross-Site Scripting
• Schedule Post Changes With PublishPress Future: Unpublish, Delete, Change Status, Trash, Change Categories <= 4.9.3 - Missing Authorization to Authenticated (Contributor+) Workflow Manipulation
• Ninja Popups <= 4.7.8 - Authenticated (Contributor+) Stored Cross-Site Scripting
• XStore <= 9.6.4 - Unauthenticated Arbitrary Shortcode Execution
• Sunshine Photo Cart <= 3.2.9 - Missing Authorization
• Holmes - Digital Agency WordPress Theme <= 1.7 - Unauthenticated Local File Inclusion
• Loco Translate <= 2.5.3 - Authenticated PHP Code Injection
• Games Catalog <= 1.2.0 - Cross-Site Request Forgery to Arbitrary Game/Post Deletion
• ApplyOnline – Application Form Builder and Manager <= 2.6.7.6 - Missing Authorization
• WPCS ( WordPress Custom Search ) <= 1.1 - Authenticated (Administrator+) Stored Cross-Site Scripting
• WN Flipbox Pro <= 2.1 - Cross-Site Request Forgery
• N7 | Golf Club Sports & Events <= 2.16.0 - Unauthenticated Local File Inclusion