Vulnerability archive: section 9, page 21

Open a report to review affected versions, available fixes and original sources. Each report covers a specific issue; its presence does not establish whether your website is affected.

• Kaya QR Code Generator <= 1.5.2 - Authenticated(Contributor+) Stored Cross-Site Scripting via url parameter
• Social Link Pages: link-in-bio landing pages for your social media profiles <= 1.6.9 - Missing Authorization to Arbitrary Page Creation and Cross-Site Scripting
• Short URL <= 1.6.8 - Reflected Cross-Site Scripting
• Pressroom - News Magazine WordPress Theme <= 7.0 - Reflected Cross-Site Scripting
• Hide My WP Ghost <= 7.0.12 - Unauthenticated Stored Cross-Site Scripting via Comment Content
• Forminator Forms – Contact Form, Payment Form & Custom Form Builder <= 1.36.0 - Insecure Direct Object Reference to Submission Manipulation
• CMB2 <= 2.13.0 - Unauthenticated Stored Cross-Site Scripting via 'file_list' Field Type
• BeRocket Plugins <= (Various Versions) - Missing Authorization
• B Slider- Gutenberg Slider Block for WP <= 1.1.23 - Authenticated (Contributor+) Private Post Disclosure via bsb-slider Shortcode
• Booking Calendar <= 10.14.7 - Authenticated (Contributor+) Stored Cross-Site Scripting
• Paypal Donation <= 1.3.1 - Admin+ Stored Cross-Site Scripting
• Narnoo Distributor <= 2.5.1 - Path Traversal
• Custom Post Type List Shortcode <= 1.4.4 - Authenticated (Contributor+) Stored Cross-Site Scripting
• XStore <= 9.3.8 - Unauthenticated SQL Injection
• WooCommerce Checkout Manager <= 4.2.6 - Unauthenticated Arbitrary Media Deletion
• BetterLinks – Shorten, Track and Manage any URL <= 1.2.5 - Stored Cross-Site Scripting
• Reviewer <= 3.14.2 - Authenticated (Subscriber+) SQL Injection
• Flash News (All Versions) - Multiple Vulnerabilities
• Essential WP Real Estate <= 1.1.3 - Reflected Cross-Site Scripting
• Joy Of Text Lite <= 2.3.1 - Missing Authorization
• Payoneer Checkout <= 3.4.0 - Missing Authorization
• WP Database Backup <= 4.3 - Cross-Site Request Forgery
• WooCommerce < 4.7.0 - Insecure Direct Object Reference via order_id Parameter
• Booster (<= 5.6.2), Booster Plus (< 6.0.0), and Booster Elite (< 6.0.0) for WooCommerce - Reflected Cross-Site Scripting
• Busiprof <= 2.5.2 - Cross-Site Request Forgery
• WOOF - Products Filter for WooCommerce <= 1.1.9 - Remote Code Execution
• The Tribal <= 1.3.4 - Unauthenticated Information Exposure
• OSM Map Widget for Elementor <= 1.3.0 - Authenticated (Contributor+) Stored Cross-Site Scripting via Button URL
• Currency Switcher for WordPress <= 1.0.3 - Reflected Cross-Site Scripting
• LogDash Activity Log <= 1.1.3 - Unauthenticated SQL Injection
• WP Flow Plus <= 5.2.3 - Authenticated (Contributor+) Stored Cross-Site Scripting
• MC4WP: Mailchimp for WordPress <= 4.1.6 - Reflected Cross-Site Scripting
• Munk Sites <= 1.0.7 - Cross-Site Request Forgery to Arbitrary Plugin Installation
• Create Block <= 2.9.0 - Code Injection to Authenticated (Admin+) PHP Code Injection
• Advanced iFrame <= 2026.1 - Authenticated (Contributor+) Stored Cross-Site Scripting via Gutenberg Block 'additional' Attribute
• FV Flowplayer Video Player <= 7.2.0.727 - Reflected Cross-Site Scripting
• Login by Auth0 <= 3.11.3 - Insecure Direct Object Reference
• Booking Calendar <= 9.4.2 - Authenticated (Admin+) SQL Injection
• WP Custom Cursors <= 3.0 - Cross-Site Request Forgery to Cursor Manipulation
• Arigato Autoresponder and Newsletter <= 2.5.1.8 - Reflected Cross-Site Scripting
• Form Maker by 10Web – Mobile-Friendly Drag & Drop Contact Form Builder <= 1.15.42 - Unauthenticated SQL Injection via 'inputs'
• TemplateSpare – 1000+ WordPress Starter Templates & Full Site Migration Tool | 1-Click Import/Export & No-Code Builder <= 4.2.2 - Missing Authorization
• Enfold <= 6.0.9 - Missing Authorization to Sensitive Information Disclosure in avia-export-class.php
• yPHPlista <= 1.1.1 - Cross-Site Request Forgery to Stored Cross-Site Scripting
• Donation Thermometer <= 2.1.2 - Authenticated (Administrator+) Stored Cross-Site Scripting
• Super Progressive Web Apps <= 2.2.43 - Authenticated (Administrator+) Stored Cross-Site Scripting via Offline Message Setting
• Drag and Drop Multiple File Upload (Pro) - WooCommerce <= 1.7.1 and 5.0 - 5.0.5 - Unauthenticated Arbitrary File Upload
• Flaming Forms <= 1.0.1 - Reflected Cross-Site Scripting
• Build App Online <= 1.0.22 - Cross-Site Request Forgery
• 140+ Widgets | Best Addons For Elementor – FREE <= 1.4.3 - Authenticated (Admin+) Cross Site Scripting
• Nova Blocks by Pixelgrade <= 2.1.7 - Authenticated (Contributor+) Stored Cross-Site Scripting via align Attribute
• Elementor Header & Footer Builder <= 1.6.26 - Authenticated (Author+) HTML Injection
• CSS JS Manager <= 2.4.49 - Cross-Site Request Forgery
• Lisfinity Core - Lisfinity Core plugin used for pebas® Lisfinity WordPress theme <= 1.4.0 - Authenticated (Subscriber+) Privilege Escalation
• MultiParcels Shipping For WooCommerce < 1.16.9 - Cross-Site Request Forgery
• WPKoi Templates for Elementor <= 3.1.0 - Authenticated (Contributor+) Stored Cross-Site Scripting
• WP eCommerce <= 3.9.2 - Reflected Cross-Site Scripting
• Schedule Posts Calendar <= 5.2 - Cross-Site Request Forgery
• WPshop 2 – E-Commerce 2.0.0 - 2.6.0 - Insecure Direct Object Reference to Authenticated (Subscriber+) Arbitrary User Key Generation
• User Submitted Posts <= 20230902 - Unauthenticated Arbitrary File Upload
• JetFormBuilder <= 3.6.5.2 - Authenticated (Administrator+) Arbitrary File Deletion
• Pardakht Delkhah <= 3.0.0 - Cross-Site Request Forgery
• Payment Gateway for PayPal on WooCommerce <= 9.1.4 - Missing Authorization
• Beaver Builder <= 2.7.4.2 - Authenticated (Contributor+) Stored Cross-Site Scripting via Icon Widget
• Widget Options - Extended <= 5.1.0 & Widget Options <= 4.0.1 - Authenticated (Subscriber+) Information Disclosure
• Code Embed <= 2.5.1 - Authenticated (Contributor+) Stored Cross-Site Scripting via Custom Fields
• HT Mega – Absolute Addons For Elementor <= 2.8.3 - Authenticated (Contributor+) Stored Cross-Site Scripting via Multiple Widgets
• Youzify – BuddyPress Community, User Profile, Social Network & Membership Plugin for WordPress By KaineLabs <= 1.3.2 - Missing Authorization to Authenticated (Subscriber+) Arbitrary Review Deletion
• Cozy Blocks <= 2.0.15 - Authenticated (Contributor+) Stored Cross-Site Scripting
• WP Custom Cursors <= 3.0 - Authenticated (Administrator+) Stored Cross-Site Scripting
• Fitness Calculators <= 1.9.5 - Cross-Site Request Forgery to Stored Cross-Site Scripting
• WeDesignTech Ultimate Booking Addon <= 1.0.1 - Authentication Bypass
• Popup Builder - Create highly converting, mobile friendly marketing popups. <= 4.4.2 - Improper Authorization to Unauthenticated Subscriber Removal via Predictable Tokens
• HL Twitter <= 2014.1.18 - Cross-Site Request Forgery to Twitter Account Unlink
• Popup Images (Unknown Version) - Cross-Site Scripting
• Divi Dash <= 1.0.6 - Unauthenticated IP Spoofing to Protection Bypass
• Sharkdropship for AliExpress Dropshipping and Affiliate <= 2.2.4 - Missing Authorization to Unauthenticated Arbitrary Post Deletion
• Sitewide Discount for WooCommerce: Apply Discount to All Products <= 2.2.1 - Authenticated (Contributor+) Stored Cross-Site Scripting
• WP Accessibility Helper <= 0.6.2.8 - Missing Authorization to Authenticated (Subscriber+) Limited Settings Update
• Carousel Ultimate <= 1.8 - Authenticated (Editor+) Stored Cross-Site Scripting
• AI ChatBot for WordPress – WPBot <= 5.5.7 - Authenticated (Administrator+) Stored Cross-Site Scripting
• eCommerce Product Catalog <= 3.5.10 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'style' Shortcode Attribute
• WP Meta SEO <= 4.5.3 - Missing Authorization in 'saveSitemapSettings'
• Curly Core <= 2.1.6 - Unauthenticated Local File Inclusion
• Social Web Suite <= 4.1.12 - Missing Authorization
• Advanced Customized Prompts <= 1.0.1 - Authenticated (Subscriber+) Stored Cross-Site Scripting
• WordPress Core <= 7.0.2 - Authenticated (Subscriber+) Missing Authorization to Arbitrary Site Creation on Multisite
• Master Addons for Elementor <= 2.0.6.2 - Authenticated (Author+) Stored Cross-Site Scripting
• ThePerfectWedding.nl Widget <= 2.8 - Cross-Site Request Forgery to Stored Cross-Site Scripting
• Flex Mag - Responsive WordPress News Theme <= 3.5.2 - Missing Authorization to Authenticated (Subscriber+) Arbitrary Option Deletion
• HAPPY – Helpdesk Support Ticket System <= 1.0.10 - Missing Authorization
• flexoslider <= 1.0004 - Reflected Cross-Site Scripting
• Cron Logger <= 1.3.3 - Missing Authorization
• GiveWP – Donation Plugin and Fundraising Platform <= 3.4.2 - Authenticated (GiveWP Manager+) PHP Object Injection
• Behance Portfolio Manager <= 1.7.5 - Authenticated (Contributor+) Stored Cross-Site Scripting
• TWChat – Send or receive messages from users <= 4.0.4 - Reflected Cross-Site Scripting
• Ultimate Member – User Profile, User Registration, Login & Membership Plugin <= 2.5.0 - Authenticated (Admin+) Remote Code Execution via Multi-Select
• Neosense - Multipurpose WordPress Theme | WordPress < 1.8 - Arbitrary File Upload
• Tax Rate Upload <= 2.4.5 - Reflected Cross-Site Scripting
• Innovio <= 1.7 - Authenticated (Subscriber+) Insecure Direct Object Reference