Vulnerability archive: section 9, page 2

Open a report to review affected versions, available fixes and original sources. Each report covers a specific issue; its presence does not establish whether your website is affected.

• WPFunnels <= 2.7.16 - Reflected Cross-Site Scripting
• Advanced Booking Calendar <= 1.6.1 - Unauthenticated SQL Injection
• HUSKY – Products Filter for WooCommerce <= 1.3.6.3 - Reflected Cross-Site Scripting via really_curr_tax Parameter
• Student Result or Employee Database <= 1.6.3 - Authentication Bypass
• Mingle Forum <= 1.0.33.3 - Stored Cross-Site Scripting
• Funnelforms Free <= 3.7.5.1 - Authenticated (Contributor+) PHP Object Injection
• NGINX Cache Optimizer <= 1.1 - Missing Authorization to Authenticated (Subscriber+) Dynamic Caching Exclusion Update
• Nirvana <= 1.6.3 - Authenticated (Contributor+) Stored Cross-Site Scripting
• 130+ Widgets | Best Addons For Elementor – FREE <= 1.4.2 - Authenticated (Contributor+) Stored Cross-Site Scripting
• Unlimited Elements For Elementor <= 2.0.17 - Missing Authorization
• Survey Maker – Best WordPress Survey Plugin <= 3.1.3 - Unauthenticated Stored Cross-Site Scripting
• iSpring Embedder <= 1.0 - Cross-Site Request Forgery to Arbitrary File Upload
• Codestyling Localization <= 1.99.30 - Cross-Site Request Forgery to Remote Code Execution
• GIFT4U – Gift Cards All in One for Woo <= 1.0.10 - Missing Authorization
• Appointment Booking Calendar <= 1.1.7 - SQL Injection
• GB Forms DB <= 1.0.2 - Unauthenticated Remote Code Execution
• Design Comuni Italia <= 1.1.1 - Unauthenticated Stored Cross-Site Scripting
• DoLeads Integrator <= 1.2.2 - Unauthenticated Remote Code Execution
• E2Pdf <= 1.16.44 - Stored Cross-Site Scripting
• Icegram Express <= 5.6.23 - Authenticated (Administrator+) Directory Traversal to Arbitrary File Read
• Tutor LMS BunnyNet Integration <= 1.0.0 - Authenticated (Tutor instructor+) Stored Cross-Site Scripting
• Asgaros Forum <= 2.7.0 - Insufficient Authorization to Authenticated (Admin+) Arbitrary File Upload
• Import and export users and customers <= 2.5.1 - Authenticated (Admin+) Privilege Escalation
• Nikstore Core <= 1.5 - Unauthenticated SQL Injection
• WebinarPress <= 1.33.27 - Open Redirect
• WP Maps <= 4.9.8 - Authenticated (Subscriber+) Stored Cross-Site Scripting via shapes_values Parameter
• Hester Core <= 1.1.8 - Authenticated (Author+) Stored Cross-Site Scripting
• Cool Tag Cloud <= 2.29 - Authenticated (Contributor+) Stored Cross-Site Scripting
• Arigato Autoresponder and Newsletter <= 2.7 - Arbitrary File Upload
• Olive One Click Demo Import <= 1.1.2 - Unauthenticated Information Exposure
• Blog2Social: Social Media Auto Post & Scheduler <= 9.0.0 - Insecure Direct Object Reference
• Ultimate WP Mail <= 1.3.8 - Authenticated (Contributor+) Stored Cross-Site Scripting
• Addonify <= 2.0.4 - Missing Authorization
• Import Spreadsheets from Microsoft Excel <= 10.1.3 - Authenticated (Contributor+) Stored Cross-Site Scripting
• Migration, Backup, Staging – WPvivid <= 0.9.89 - Authenticated Stored Cross-Site Scripting
• Hide My WP <= 6.2.3 - SQL Injection
• Contact Form 7 – PayPal & Stripe Add-on <= 2.4.9 - Unauthenticated Payment Bypass via Insufficient Verification of Data Authenticity via PayPal IPN Handler ('invoice'/'mc_gross' Verification)
• Sina Extension for Elementor < 2.2.1 - Local File Inclusion
• WordPress Gallery Plugin – NextGEN Gallery <= 1.5.1 - Cross-Site Scripting
• ContentBot AI Writer <= 1.2.4 - Authenticated (Contributor+) Stored Cross-Site Scripting
• Picture Gallery – Frontend Image Uploads, AJAX Photo List < 1.4.3 - Cross-Site Scripting
• WP Cost Estimation & Payment Forms Builder <= 10.1.75 - Authenticated (Contributor+) SQL Injection
• WPML < 3.1.9 - Cross-Site Scripting
• Firework Shoppable Live Video <= 6.3 - Reflected Cross-Site Scripting
• NextGen Gallery <= 1.9.7 - Cross-Site Scripting
• Extra User Details <= 0.5 - Authenticated (Administrator+) Stored Cross-Site Scripting
• Slider Future <= 1.0.5 - Unauthenticated Arbitrary File Upload
• Pixelating image slideshow gallery <= 8.0 - Authenticated (Contributor+) SQL Injection
• Save as PDF plugin by Pdfcrowd <= 2.16.0 - Authenticated (Administrator+) Stored Cross-Site Scripting via admin settings
• WPForms <= 2.0.2.1 - Reflected Cross-Site Scripting via 'query_var' Smart Tag in iframe srcdoc Attribute
• The Cache Purger <= 2.3.20 - Missing Authorization to Authenticated (Subscriber+) Arbitrary Log Deletion via 'the_log_purge' Parameter
• MotoPress Appointment Booking <= 2.4.4 - Unauthenticated Insecure Direct Object Reference to 'payment_details.booking_id' Parameter
• Cookie Notice & Consent 1.6.0 - Authenticated (Administrator+) Stored Cross-Site Scripting
• Taskbuilder <= 4.0.9 - Reflected Cross-Site Scripting
• Internal Links Generator <= 3.51 - Reflected Cross-Site Scripting
• MyBookTable Bookstore <= 3.3.7 - Authenticated (Author+) Stored Cross-Site Scripting
• Premium Addons for Elementor <= 4.11.8 - Authenticated (Contributor+) Stored Cross-Site Scripting via Countdown Widget
• Sharkdropship dropshipping for Aliexpress, eBay, Amazon, etsy <= 2.1.1 - Missing Authorization
• WP Print Friendly <= 0.6 - Cross-Site Scripting
• Really Simple Security <= 9.8.0 - Unauthenticated Two-Factor Authentication Bypass
• Shipyaari Shipping Management <= 1.2 - Unauthenticated PHP Object Injection
• WP Hotel Booking <= 2.3.2 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'widget_search' Shortcode Attribute
• Kognetiks Chatbot for WordPress <= 2.1.8 - Cross-Site Request Forgery to Authenticated (Subscriber+) Assistant Modification
• Multiple Themes by gavias <= Various Versions - Reflected Cross-Site Scripting
• Product Shortlist <= 1.0.4 - Unauthenticated SQL Injection
• Eunoia (All Versions) - Cross-Site Scripting
• The Events Calendar <= 4.8.1 - Cross-Site Scripting via tribe_paged Parameter
• Master Slider – Responsive Touch Slider <= 3.10.6 - Authenticated (Contributor+) Stored Cross-Site Scripting via ms_layer Shortcode
• Rus-To-Lat <= 0.3 - Cross-Site Request Forgery to Plugins Options Changes
• SKT Page Builder <= 4.9 - Missing Authorization
• Cool Timeline (Horizontal & Vertical Timeline) <= 2.0.2 - Cross-Site Request Forgery Bypass
• WP Super Cache <= 1.4.4 - Authenticated File Deletion
• immonex Kickstart <= 1.11.6 - Authenticated (Contributor+) Local File Inclusion
• WPThumb <= 0.10 - Authenticated (Contributor+) Server-Side Request Forgery
• Event post <= 5.10.3 - Authenticated (Contributor+) Stored Cross-Site Scripting
• Magazine Blocks – Blog Designer, Magazine & Newspaper Website Builder, Page Builder with Posts Blocks, Post Grid <= 1.8.6 - Authenticated (Contributor+) Stored Cross-Site Scripting
• Product Delivery Date for WooCommerce – Lite <= 2.7.2 - Missing Authorization
• Aora - Home & Lifestyle Elementor WooCommerce Theme <= 1.3.15 - Unauthenticated Local File Inclusion
• InfiniteWP Client <= 1.13.0 - Unauthenticated Limited Directory Traversal to Arbitrary .txt File Reading
• Better Messages <= 3.0.4 - Authenticated (Subscriber+) Stored DOM-Based Cross-Site Scripting via User Display Name
• Web and WooCommerce Addons for WPBakery Builder <= 1.4.7 - Authenticated (Editor+) Stored Cross-Site Scripting
• Raygun4WP <= 1.8.2 - Cross-Site Scripting
• LearnPress <= 4.4.8 - Insecure Direct Object Reference to Unauthenticated Sensitive Information Disclosure via 'item_id' Parameter
• User Profile Builder <= 4.0.2 - Authenticated (Subscriber+) Stored Cross-Site Scripting via Avatar Field
• Extend Themes <= (Multiple Versions) - Cross-Site Request Forgery
• Product Addons – WowAddons <= 1.6.14 - Unauthenticated Stored Cross-Site Scripting
• OAuth Single Sign On – SSO (OAuth Client) <= 6.26.3 - Authentication Bypass
• Admin Notices Manager <= 1.4.0 - Missing Authorization to Authenticated (Subscriber+) User Email Retrieval
• Checkimate <= 1.0.13 - Missing Authorization to Unauthenticated License Deactivation
• Helloprint <= 2.0.7 - Unauthenticated Arbitrary File Deletion
• BRW <= 1.8.6 - Authenticated (Contributor+) Local File Inclusion
• Top 10 <= 2.9.4 - Cross-Site Request Forgery Bypass
• WpTravelly <= 1.6.0 - Cross-Site Request Forgery
• The Permalinks Cascade <= 2.2 - Missing Authorization To Authenticated (Subscriber+) Plugin Settings Update
• Fancy Product Designer <= 6.4.8 - Unauthenticated Stored Cross-Site Scripting via SVG File Upload
• Easy Digital Downloads – Simple eCommerce for Selling Digital Files <= 2.10.2 - Cross-Site Request Forgery
• Verbosa <= 1.2.3 - Authenticated (Contributor+) Stored Cross-Site Scripting
• Create <= 2.5.3 - Authenticated (Contributor+) SQL Injection
• Travel Engine <= 6.8.0 - Authenticated (Subscriber+) Arbitrary Media File Move
• Kossy - Minimalist eCommerce WordPress Theme <= 1.45 - Unauthenticated Local File Inclusion