Vulnerability archive: section 9, page 22

Open a report to review affected versions, available fixes and original sources. Each report covers a specific issue; its presence does not establish whether your website is affected.

• Nested Pages <= 3.0.7 - Missing Authorization
• Outdoor <= 3.9.6 - Reflected Cross-Site Scripting
• Ultimate Addons for Contact Form 7 <= 3.1.23 - Authenticated (Subscriber+) SQL Injection via id
• Elementor Addon Elements <= 1.13.2 - Authenticated (Contributor+) Stored Cross-Site Scripting
• CoCart 4.9.0 - 4.9.6 - Cross-Site Request Forgery to Privilege Escalation
• MultiVendorX <= 4.2.23 - Missing Authorization
• Unlimited Elements For Elementor (Free Widgets, Addons, Templates) <= 1.5.109 - Authenticated (Contributor+) Information Exposure
• Media.net Ads Manager <= 2.10.13 - Missing Authorization to Authenticated (Subscriber+) Arbitrary File Upload
• My WP Customize Admin/Frontend <= 1.21.0 - Authenticated (Administrator+) Stored Cross-Site Scripting via plugin settings
• Booster Elite for WooCommerce < 8.4.0 - Missing Authorization to Authenticated (Subscriber+) Arbitrary Option Disclosure
• Abbie Expander <= 1.0.1 - Authenticated (Contributor+) Stored Cross-Site Scripting
• WIP Custom Login <= 1.2.7 - Missing Authorization
• Subscription & Recurring Payment for WooCommerce <= 1.9.1 - Cross-Site Request Forgery
• Elementor Forms Google Sheet Connector <= 1.0.6 - Reflected Cross-Site Scripting via 'code'
• Brave Conversion Engine (PRO) <= 0.7.7 - Authentication Bypass to Administrator
• Comments Ratings <= 1.1.7 - Authenticated (Administrator+) Stored Cross-Site Scripting
• MelaPress Login Security and MelaPress Login Security Premium 2.1.0 - Missing Authorization to Unauthenticated Arbitrary User Deletion
• Bit File Manager <= 5.0.0 - Information Disclosure
• WooCommerce Conversion Tracking <= 2.0.4 - Cross-Site Request Forgery and Cross-Site Scripting
• Simple Download Counter <= 1.6 - Authenticated (Contributor+) Stored Cross-Site Scripting
• uListing <= 1.6.6 - Unauthenticated SQL Injection
• Multiple Page Generator Plugin <= 3.3.17 - Cross-Site Request Forgery to SQL Injection
• Wicked Folders <= 2.18.16 - Cross-Site Request Forgery via ajax_save_state
• eShop Swipe plugin <= 3.7.0 - Cross-Site Scripting
• LoginPress Pro <= 6.2.3 - Unauthenticated Authentication Bypass via Unverified OAuth Email in Spotify OAuth Callback
• Contact Form 7 Integrations 1.0 - 1.3.10 - Multiple Cross-Site scripting
• Ultimate Addons for Contact Form 7 3.2.4 - 3.5.50 - Unauthenticated Arbitrary File Upload
• UniTimetable <= 1.1 - Unauthenticated Stored Cross-Site Scripting
• Admin Notices Manager <= 1.6.0 - Authenticated (Administrator+) SQL Injection
• Interactive Polish Map <= 1.2 - Authenticated (Admi+) Stored Cross-Site Scripting
• WP-PostRatings Cheater <= 1.5 - Cross-Site Request Forgery
• JetBlocks for Elementor <= 1.5.0 - Unauthenticated Information Exposure
• Xpro Addons — 140+ Widgets for Elementor <= 1.4.24 - Authenticated (Contributor+) Stored Cross-Site Scripting via Icon Box Widget
• ElementInvader Addons for Elementor <= 1.3.6 - Authenticated (Contributor+) Stored Cross-Site Scripting
• Map Store Locator <= 1.2.1 - Authenticated (Contributor+) Stored Cross-Site Scripting
• Elementor <= 3.5.4 - DOM-Based iFrame Injection
• WooCommerce Food - Restaurant Menu & Food ordering <= 3.3.2 - Unauthenticated Arbitrary Shortcode Execution via ids
• WordPress Core < 4.7.3 - Cross-Site Scripting via Media Metadata
• Smart Hashtags [#hashtagger] <= 7.2.3 - Missing Authorization
• Royal MCP – Secure AI Connector for Claude, ChatGPT & Gemini <= 1.4.2 - Missing Authorization
• Amazon Link <= 3.2.10 - Authenticated (Admin+) Cross-Site Scripting
• InstaWP Connect <= 0.1.0.8 - Authenticated (Subscriber+) Remote Code Execution
• Academy LMS <= 4.0.3 - Missing Authorization to Authenticated (Custom+) Arbitrary Academy Comment Deletion via delete_lesson_comment AJAX — Attacker-Controlled course_id vs. Target comment_id
• SimpleMap Store Locator <= 2.6.1 - Unauthenticated Stored Cross-Site Scripting
• WP Vault <= 0.8.6.6 - Local File Inclusion
• Visitor Traffic Real Time Statistics pro <= 11.17 - Unauthenticated SQL Injection
• Gallery Plugin for WordPress – Envira Photo Gallery <= 1.8.4.6 - Reflected Cross-Site Scripting
• Zarinpal Gateway for WooCommerce <= 5.0.16 - Improper Access Control to Payment Status Update
• WP Visitor Statistics (Real Time Traffic) <= 8.4 - Missing Authorization
• Molongui <= 4.6.19 - Authenticated (Administrator+) Stored Cross-Site Scripting
• WordPress Share Buttons Plugin – AddThis < 2.2.0 - Code Injection
• Caching Compatible Cookie Opt-In and JavaScript <= 0.0.10 - Authenticated (Contributor+) Stored Cross-Site Scripting
• My Album Gallery <= 1.0.4 - Authenticated (Subscriber+) Arbitrary File Deletion
• GEO my WordPress <= 4.0.2 - Authenticated(Administrator+) SQL Injection
• Media Sweep <= 1.1.3 - Authenticated (Administrator+) SQL Injection via 'fields' Parameter
• Contact Form Plugin <= 4.0.1 - Stored Cross-Site Scripting
• GEO my WordPress <= 4.0 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode
• Newsletter <= 6.5.3 - CSV Injection
• NextScripts: Social Networks Auto-Poster <= 4.3.17 - Missing Authorization
• leenk.me <= 2.5.0 - Cross-Site Request Forgery
• StaffList <= 3.2.6 - Authenticated (Admin+) Stored Cross-Site Scripting
• Testimonials Widget <= 3.5.1 - Multiple Authenticated Stored Cross-Site Scripting
• SupportCandy – Helpdesk & Customer Support Ticket System <= 3.4.4 - Missing Authorization
• Issuu Panel <= 2.1.1 - Cross-Site Request Forgery to Stored Cross-Site Scripting
• Klarna for WooCommerce <= 4.13.3 - Missing Authorization to Unauthenticated Sensitive Information Disclosure via 'order-pay' Endpoint
• SlideOnline <= 1.2.1 - Authenticated (Contributor+) Stored Cross-Site Scripting
• MJ Contact us <= 5.2.3 - Reflected Cross-Site Scripting
• Debt.com Business in a Box <= 4.1.0 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode Attributes
• Responsive Menu <= 4.0.3 - Cross-Site Request Forgery to Arbitrary File Upload
• Orbisius Simple Notice <= 1.1.3 - Authenticated (Administrator+) Stored Cross-Site Scripting
• Bold Page Builder <= 5.9.9 - Authenticated (Contributor+) Stored Cross-Site Scripting
• Robokassa payment gateway for Woocommerce <= 1.8.8 - Unauthenticated Payment Bypass
• SEO Title Tag <= 3.5.9 - Reflected Cross-Site Scripting
• Majestic Support – The Leading-Edge Help Desk & Customer Support Plugin <= 1.0.5 - Authenticated (Subscriber+) Insecure Direct Object Reference
• Qtranslate Slug <= 1.1.18 - Cross-Site Request Forgery Bypass
• Interface <= 3.1.0 - Authenticated (Contributor+) Stored Cross-Site Scripting
• Booking for Appointments and Events Calendar – Amelia <= 1.2 - Unauthenticated Full Path Disclosure
• Termageddon: Cookie Consent & Privacy Compliance <= 1.8.1 - Authenticated (Contributor+) Stored Cross-Site Scripting
• WooCommerce Product Table Lite <= 3.8.7 - Missing Authorization
• ionCube Tester Plus <= 1.3 - Unauthenticated Arbitrary File Download
• Pricing Table by Supsystic <= 1.8.8 - Boolean-Based Blind SQL Injections
• iDump iPhone to WordPress Photo Uploader <= 1.8 - Arbitrary File Upload
• Property Hive <= 2.2.2 - Unauthenticated Stored Cross-Site Scripting
• Push Envoy Notifications <= 1.0.0 - Reflected Cross-Site Scripting
• WP Dashboard Notes <= 1.0.10 - Missing Authorization to Arbitrary Private Notes Update
• Astra Widgets <= 1.2.14 - Authenticated (Contributor+) Stored Cross-Site Scripting
• Event Tickets and Registration <= 5.30.0.1 - Missing Authorization
• Company Directory <= 4.3 - Reflected Cross-Site Scripting via add_query_arg Function
• UNIVERSAM < 8.59 - Reflected Cross-Site Scripting
• Greenshift – animation and page builder blocks <= 7.6.2 - Authenticated (Administrator+) Arbitrary File Upload
• Bold Page Builder <= 5.7.2 - Authenticated (Contributor+) Stored Cross-Site Scripting via bt_bb_css_image_grid 'images' Shortcode Attribute
• DethemeKit For Elementor <= 2.1.10 - Missing Authorization
• Plugin README Parser <= 1.3.15 - Authenticated (Contributor+) Stored Cross-Site Scripting via target Parameter
• affiliate-toolkit <= 3.7.3 - Cross-Site Request Forgery
• License For Envato <= 1.0.0 - Unauthenticated Local File Inclusion
• WPFunnels <= 3.5.18 - Unauthenticated PHP Object Injection
• Active Products Tables for WooCommerce <= 1.0.6.8 - Authenticated (Contributor+) Stored Cross-Site Scripting
• WP-Filebase <= 0.2.9.24 - Missing Authorization Checks
• MountDev AI MCP Connector for WordPress <= 1.6.5 - Missing Authorization
• GeoDirectory <= 2.8.181 - Authenticated (Subscriber+) Stored Cross-Site Scripting via Text-type Custom Field (e.g., 'phone')