Vulnerability archive: section 9, page 18

Open a report to review affected versions, available fixes and original sources. Each report covers a specific issue; its presence does not establish whether your website is affected.

• WordPress Contact Form, Drag and Drop Form Builder Plugin – Live Forms < 3.2.0 - SQL Injection
• Integrate Google Drive <= 1.5.2 - Cross-Site Request Forgery
• Responsive Filterable Portfolio <= 1.0.19 - Reflected Cross-Site Scripting
• GEO Plugin by Squirrly SEO <= 14.2.2 - Unauthenticated Stored Cross-Site Scripting
• 6Storage Rentals <= 2.19.4 - Missing Authorization
• Cost Calculator Builder <= 3.1.42 - Improper Authorization
• Nabz Image Gallery <= v1.00 - Unauthenticated SQL Injection
• Better Find and Replace <= 1.6.1 - Unauthenticated PHP Object Injection
• Gmedia Photo Gallery < 1.20.0 - Authenticated (Admin+) Stored Cross-Site Scripting
• Welcart e-Commerce <= 2.8.21 - Authenticated(Editor+) SQL Injection
• Animated Text Block <= 1.0.7 - Missing Authorization
• Fluent Forms <= 6.2.1 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'permission_message' Shortcode Attribute
• Ads Pro Plugin - Multi-Purpose WordPress Advertising Manager <= 4.89 - Unauthenticated Time-Based SQL Injection via ‘bsa_pro_id'
• Schema & Structured Data for WP & AMP <= 1.33 - Authenticated (Contributor+) Stored Cross-Site Scripting via url Attribute
• Post Views Stats Counter <= 1.1.7 - Unauthenticated Stored Cross-Site Scripting via User-Agent Header
• MJ Update History <= 1.0.4 - Missing Authorization
• Drag and Drop Multiple File Upload for WooCommerce <= 1.1.4 - Unauthenticated Arbitrary File Move
• Dima Take Action <= 1.0.5 - Authenticated (Administrator+) Stored Cross-Site Scripting
• iNext Woo Pincode Checker <= 2.3.1 - Cross-Site Request Forgery
• Leaflet Maps Marker (Google Maps, OpenStreetMap, Bing Maps) <= 3.12.8 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode
• Boom Fest <= 2.2.1 - Missing Authorization to Authenticated (Subscriber+) Plugin Settings Update
• Media File Organizer <= 1.0.1 - Directory Traversal
• Availability Calendar <= 1.2.6 - Cross-Site Request Forgery via add_availability_calendar_create_admin_page()
• WpBookingly <= 1.2.9 - Authenticated (Contributor+) Local File Inclusion
• Uploader <= 1.0.4 - Arbitrary File Upload
• Survey Maker <= 5.1.6.3 - Unauthenticated Authorization Bypass
• WP 2FA with Telegram <= 3.0 - Two-Factor Authentication Bypass
• Ireca <= 1.8.5 - Unauthenticated Local File Inclusion
• Product Table for WooCommerce <= 5.0.8 - Reflected Cross-Site Scripting
• GiveWP – Donation Plugin and Fundraising Platform <= 3.19.4 - Unauthenticated PHP Object Injection
• Block For Mailchimp – Easy Mailchimp Form Integration <= 1.1.12 - Unauthenticated Blind Server-Side Request Forgery
• WP Optimizer <= 2.5.0 - Authenticated (Administrator+) SQL Injection via 's' Parameter
• Enter Addons – Ultimate Template Builder for Elementor <= 2.1.9 - Authenticated (Contributor+) Post Disclosure
• Custom Permalinks <= 2.6.0 - Authenticated(Editor+) Stored Cross-Site Scripting
• bodi0’s Easy Cache <= 0.8 - Authenticated (Admin+) Stored Cross-Site Scripting
• WPC Frequently Bought Together for WooCommerce <= 7.0.3 - Missing Authorization
• Contact Form With Captcha <= 1.6.7 - Cross-Site Request Forgery
• ConvertKit <= 2.0.4 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode
• BuddyForms <= 2.8.5 - Reflected Cross-Site Scripting via page
• VW Fitness <= 4.3.4 - Missing Authorization
• Easy School Registration <= 3.9.8 - Reflected Cross-Site Scripting
• CE21 Suite <= 2.2.0 - JWT Token Disclosure
• Email Templates <= 1.3 - HTML Injection
• Solidres <= 0.9.4 - Reflected Cross-Site Scripting
• Coming soon and Maintenance mode <= 3.5.2 - Authenticated Stored Cross-Site Scripting
• SimplyRETS Real Estate IDX <= 3.2.2 - Reflected Cross-Site Scripting
• Zoho CRM Lead Magnet <= 1.6.9.1 - Reflected Cross-Site Scripting
• Thrive Apprentice < 10.8.10.2 - Unauthenticated PHP Object Injection
• Real Testimonials <= 3.1.6 - Authenticated (Contributor+) Stored Cross-Site Scripting
• Premium Addons for Elementor <= 4.11.70 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'custom_svg' Parameter
• NEX-Forms – Ultimate Form Builder <= 8.5.2 - Cross-Site Request Forgery
• WP Open Social <= 5.0 - Authenticated (Administrator+) Stored Cross-Site Scripting
• BizPrint <= 4.5.4 - Cross-Site Request Forgery to Cross-Site Scripting via process.php
• EU/UK VAT Manager for WooCommerce <= 2.12.12 - Reflected Cross-Site Scripting
• amr users <= 4.59.3 - Admin+ Stored Cross-Site Scripting
• WP Fastest Cache <= 0.8.8.5 - Cross-Site Scripting via wpFastestCachePage options, wpFastestCachePreload_number or wpFastestCacheLanguage parameter
• Customer Reviews Collector for WooCommerce <= 4.6.1 - Reflected Cross-Site Scripting
• Sign-up Sheets <= 2.3.3 - Cross-Site Request Forgery
• No Disposable Email <= 2.5.1 - Cross-Site Request Forgery to Stored Cross-Site Scripting
• Tasty Daily < 1.27 - Unauthenticated PHP Object Injection
• Redirection for Contact Form 7 <= 3.2.4 - Unauthenticated PHP Object Injection via PHAR Deserialization
• Media File Manager <= 1.4.2 - Reflected Cross-Site Scripting
• HT Mega - Absolute Addons for Elementor Page Builder <= 1.5.5 - Contributor+ Stored Cross-Site Scripting
• Donate With QRCode <= 1.4.4 - Authenticated (Subscriber+) Stored Cross-Site Scripting
• JoomSport – for Sports: Team & League, Football, Hockey & more <= 5.2.5 - Authentciated (Admin+) SQL Injection via orderby
• Slider, Gallery, and Carousel by MetaSlider <= 3.17.1 - Authenticated Stored Cross-Site Scripting
• WHA Crossword <= 1.1.10 - Authenticated (Contributor+) Stored Cross-Site Scripting
• sidebarTabs <= 3.1 - Reflected Cross-Site Scripting
• Reviews Widgets for Google, Yelp & TripAdvisor <= 2.7.3 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'page_id' Shortcode Attribute
• Dear Flipbook – PDF Flipbook, 3D Flipbook, PDF embed, PDF viewer <= 2.3.52 - Authenticated (Contributor+) Stored Cross-Site Scripting
• WebToffee Plugins <= (Various Versions) - Arbitrary User Creation
• JetWooBuilder <= 2.1.20 - Authenticated (Subscriber+) Information Exposure
• Contact Form by Supsystic <= 1.10.2 - Unauthenticated Stored Cross-Site Scripting via IP Address Header
• Devs CRM – Manage tasks, attendance and teams all together <= 1.1.8 - Missing Authorization to Unauthenticated Lead Tag Update
• VForm <= 3.0.0 - Reflected Cross-Site Scripting
• WP Travel Pro <= 10.6.0 - Missing Authorization to Unauthenticated Arbitrary User Deletion Including Administrators
• MyCSS <= 1.1 - Cross-Site Request Forgery to Settings Update
• Bulk Edit Products for WooCommerce – WP Sheet Editor <= 1.8.21 - Missing Authorization
• E-cab Taxi Booking Manager for Woocommerce < 2.0.8 - Missing Authorization
• Task Manager Pro <= 1.3.1 - Blind SQL Injection
• AI Engine <= 2.5.0 - Authenticated (Admin+) Remote Code Execution
• Brizy - Page Builder <= 2.8.18 - Insecure Direct Object Reference to Authenticated (Contributor+) Template Type Update
• External Links in New Window / New Tab <= 1.42 - Tabnabbing
• Dermatology Clinic <= 1.4.3 - Unauthenticated Local File Inclusion
• Simple Staff List <= 2.2.2 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode
• Tutor LMS <= 2.7.2 - Authenticated (Administrator+) SQL Injection
• My IDX Home Search <= 2.1.1 - Authenticated (Contributor+) Stored Cross-Site Scripting
• Print Invoice & Delivery Notes for WooCommerce <= 4.7.1 - Reflected Cross-Site Scripting
• Registrations for The Events Calendar <= 2.7.4 - Reflected Cross-Site Scripting
• WPBookit <= 1.6.0 - Unauthenticated SQL Injection
• wpForo Forum <= 2.4.9 - Authenticated (Susbscriber+) SQL Injection
• FuseWP <= 1.1.24.2 - Cross-Site Request Forgery to Sync Rule Status Toggle
• Advanced Import: One-Click Demo Import for WordPress <= 1.4.6 - Authenticated (Author+) Server-Side Request Forgery via 'demo_file' Parameter
• Graphina - Elementor Charts and Graphs <= 3.1.3 - Authenticated (Contributor+) Stored Cross-Site Scripting
• Dixon <= 1.4.2.1 - Unauthenticated Local File Inclusion
• YouTube Subscribe <= 3.0.0 - Authenticated (Admin+) Stored Cross-Site Scripting via Title and Channel ID
• ThemeREX Addons <= 2.35.1.1 - Authenticated (Contributor+) Stored Cross-Site Scripting via trx_addons_get_svg_from_file Function
• Advanced Views – Display Posts, Custom Fields, and More <= 3.7.19 - Authenticated (Author+) Remote Code Execution via SSTI
• Database for Contact Form 7, WPforms, Elementor forms <= 1.4.9 - Missing Authorization to Authenticated (Contributor+) Sensitive Information Exposure via Shortcode
• AddFunc Head & Footer Code <= 2.3 - Authenticated (Contributor+) Stored Cross-Site Scripting via Custom Fields