Vulnerability archive: section 9, page 23

Open a report to review affected versions, available fixes and original sources. Each report covers a specific issue; its presence does not establish whether your website is affected.

• Service Area Postcode Checker <= 2.0.8 - Authenticated (Administrator+) Stored Cross-Site Scripting
• GiveWP – Donation Plugin and Fundraising Platform <= 4.16.9 - Unauthenticated User Impersonation
• WP Job Portal <= 2.2.2 - Missing Authorization to Unauthenticated Arbitrary Resume Download
• Ebook Store <= 5.8001 - Unauthenticated Full Path Disclosure
• Visualizer: Tables and Charts Manager for WordPress <= 3.7.9 - Authenticated (Contributor+) PHAR Deserialization
• FastBook <= 1.1 - Reflected Cross-Site Scripting
• WP-Members Membership Plugin <= 3.4.9.5 - Reflected Cross-Site Scripting
• WP Recipe Maker <= 10.8.1 - Unauthenticated Arbitrary Shortcode Execution via Recipe Comment Content
• Premium Addons for Elementor – AI-Ready Elementor Addons, Widgets & Templates <= 4.11.105 - Authenticated (Contributor+) Stored Cross-Site Scripting
• Bitcoin / AltCoin Payment Gateway for WooCommerce <= 1.7.6 - Unauthenticated SQL Injection
• EmbedSocial – Social Media Feeds, Reviews and Galleries <= 1.1.29 - Authenticated (Contributor+) Stored Cross-Site Scripting
• Maintenance Page <= 1.0.8 - Security Mechanism Bypass via REST API
• HT Team Member <= 1.1.7 - Authenticated (Contributor+) Stored Cross-Site Scripting
• Side Menu Lite – add sticky fixed buttons <= 4.2 - Cross-Site Request Forgery
• Event Manager and Tickets Selling Plugin for WooCommerce < 3.5.3 - Missing Authorization
• FileBird Document Library <= 2.0.6 - Unauthenticated Sensitive Information Exposure
• Tourmaster <= 5.3.8 - Unauthenticated Local File Inclusion
• AppPresser <= 4.3.0 - Missing Authorization
• WooCommerce Designer Pro <= 1.9.28 - Unauthenticated Arbitrary File Read
• JetTabs <= 2.2.9 - Authenticated (Contributor+) Stored Cross-Site Scripting
• Wicked Folders <= 4.1.0 - Insecure Direct Object Reference to Authenticated (Contributor+) Arbitrary Folder Deletion
• Ultimate Carousel For Elementor <= 2.1.7 - Authenticated (Contributor+) Stored Cross-Site Scripting
• WP Hide Categories <= 1.0 - Reflected Cross-Site Scripting
• Advance Search <= 1.1.6 - Cross-Site Request Forgery to Shortcode Deletion
• LearnPress <= 4.2.6.3 - Insecure Direct Object Reference
• Import any XML or CSV File to WordPress <= 3.7.3 - Cross-Site Request Forgery to Notice Dismissal
• Electric Studio Download Counter <= 2.4 - Authenticated (Administrator+) Stored Cross-Site Scripting via Settings Parameters
• EventON - WordPress Virtual Event Calendar Plugin <= 4.5.8 (Pro) & <= 2.2.7 (Free) - Missing Authorization via eventon_save_virtual_event_settings
• Quiz and Survey Master (QSM) <= 9.1.2 - Authenticated (Admin+) Stored Cross-Site Scripting
• EMC2 Alert Boxes <= 1.3 - Authenticated (Contributor+) Stored Cross-Site Scripting
• Email Artillery (MASS EMAIL) <= 4.1 - Arbitrary File Upload
• RestroPress <= 3.4.5 - Unauthenticated Payment Bypass
• Designer <= 1.6.1 - Authenticated (Contributor+) Stored Cross-Site Scripting
• Smart Marketing SMS and Newsletters Forms <= 5.0.4 - Missing Authorization
• InstaWP Connect <= 0.1.1.9 - Missing Authorization
• Fontsampler <= 0.4.14 - Reflected Cross-Site Scripting
• WP Cookie Law Info <= 1.1 - Authenticated (Administrator+) Stored Cross-Site Scripting
• Minify HTML <= 2.1.12 - Cross-Site Request Forgery to Plugin Settings Update
• Javo Core <= 3.0.0.266 - Missing Authorization
• FireBox Popups <= 3.1.7 - Unauthenticated Sensitive Information Exposure in 'form_id' Parameter
• Export and Import Users and Customers <= 2.5.3 - Authenticated (Admin+) PHP Object Injection
• Happy Elementor Addons Pro <= 2.8.0 - Reflected Cross-Site Scripting
• Pinyin Slugs <= 2.3.0 - Authenticated (Administrator+) Stored Cross-Site Scripting
• JetBackup – WP Backup, Migrate & Restore <= 1.4.0 - Sensitive Information Disclosure
• MyParcel <= 4.25.1 - Missing Authorization to Authenticated (Subscriber+) Arbitrary Order Shipment Data Disclosure and Modification via wcmp_get_shipment_options and wcmp_save_shipment_options AJAX Actions
• Gutenberg Blocks with AI by Kadence WP – Page Builder Features <= 3.5.32 - Incorrect Authorization to Authenticated (Contributor+) Post Publication
• Blog2Social: Social Media Auto Post & Scheduler <= 7.5.4 - Authenticated (Author+) Stored Cross-Site Scripting via File Upload
• GiveWP <= 3.15.1 - Unauthenticated Full Path Disclosure
• Blocks <= 1.6.42 - Authenticated (Administrator+) Stored Cross-Site Scripting
• Music Player for Elementor <= 2.4.6 - Authenticated (Contributor+) Stored Cross-Site Scripting via album_buy_url Parameter
• LTL Freight Quotes – Unishippers Edition <= 2.5.8 - Unauthenticated SQL Injection
• LearnPress <= 4.2.3 - Missing Authorization to Information Exposure
• Social Auto Poster <= 5.3.14 - Missing Authorization via Multiple Functions
• Stripe Payment Forms by WP Full Pay <= 8.4.3 - Missing Authorization to Unauthenticated Payment Record Manipulation via 'paymentIntentId' Parameter
• Admin Menu Organizer <= 1.0.1 - Reflected Cross-Site Scripting
• Gallery PhotoBlocks <= 1.2.6 - Authenticated (Contributor+) Stored Cross-Site Scripting
• Ocean Pro Demos <= 1.5.4 and Ocean eComm Treasure Box <= 1.8.0 - Unauthenticated Stored Cross-Site Scripting via 'content' Parameter
• Saitama Addon Pack < 1.0.9 - Authenticated (Contributor+) Stored Cross-Site Scripting
• WP Database Backup <= 4.3 - Cross-Site Scripting
• Skyword API Plugin <= 2.5.3 - Authenticated (Contributor+) Stored Cross-Site Scripting
• Hotel Booking Lite <= 5.2.3 - Authenticated (Hotel Worker+) Remote Code Execution
• Listingo - Business Listing and Directory WordPress Theme <= 3.2.7 - Unauthenticated Arbitrary Shortcode Execution
• Contact Form 7 - Repeatable Fields <= 2.0.1 - Authenticated (Contributor+) Stored Cross-Site Scripting via field_group Shortcode
• Out of the Block: OpenStreetMap <= 2.8.3 - Authenticated (Contributor+) Stored Cross-Site Scripting via ootb_query Shortcode
• GamiPress <= 7.9.4 - Insecure Direct Object Reference to Unauthenticated Sensitive Information Disclosure via 'access' Parameter
• Image Optimizer, Resizer and CDN – Sirv <= 7.2.9 - Authenticated (Author+) Stored Cross-Site Scripting via SVG File Upload
• Awesome Support <= 6.3.5 - Authenticated (Support Manager+) PHP Object Injection
• MoreConvert Wishlist for WooCommerce <= 1.9.19 - Unauthenticated Stored Cross-Site Scripting
• Boost Your Blog's Engagement with WP Post Author <= 3.8.1 - Authenticated (Administrator+) SQL Injection
• leenk.me <= 2.16.0 - Reflected Cross-Site Scripting
• WooDiscuz – WooCommerce Comments <= 2.3.0 - Cross-Site Request Forgery
• Geo Mashup <= 1.13.19 - Authenticated (Subscriber+) SQL Injection
• MyBB Cross-Poster <= 1.0 - Authenticated (Admin+) Stored Cross-Site Scripting
• MM-Breaking News <= 0.7.9 - Reflected Cross-Site Scripting
• Page View Counts <= 2.4.8 - Contributor+ Stored Cross-Site Scripting
• PrePost SEO <= 3.0 - Authenticated(Administrator+) Stored Cross-Site Scripting
• Builderall Builder for WordPress <= 2.0.1 - Unauthenticated Server-Side Request Forgery
• Oboxmedia Ads <= 1.9.8 - Authenticated (Contributor+) Stored Cross-Site Scripting
• Verified Reviews (Avis Vérifiés) <= 2.3.14 - Authenticated (Administrator+) Stored Cross-Site Scripting
• Terms Descriptions <= 3.4.4 - Reflected Cross-Site Scripting via term_search
• WordPress Plugin Tournamatch < 4.6.1 - Authenticated (Subscriber+) Stored Cross-Site Scripting
• Live Composer <= 2.1.19 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'dslc_custom_field' Shortcode
• Solid Affiliate <= 1.9.1 - Sensitive Information Exposure
• Goodlayers Hotel <= 3.1.4 - Reflected Cross-Site Scripting
• Hobo <= 1.0.10 - Unauthenticated Local File Inclusion
• JobSearch <= 2.5.3 - Cross-Site Request Forgery
• Wicked Folders <= 2.18.16 - Missing Authorization on ajax_move_object
• WP Cost Estimation & Payment Forms Builder <= 10.1.76 - Missing Authorization
• Mang Board <= 2.4.3 - Unauthenticated Local File Inclusion via '_type' Parameter
• Food Menu – Restaurant Menu & Online Ordering for WooCommerce <= 6.0.5 - Unauthenticated Stored Cross-Site Scripting
• EKC Tournament Manager <= 2.2.1 - Cross-Site Request Forgery to Tournament Deletion
• Groundhogg <= 3.4.2.3 - Cross-Site Request Forgery
• No CAPTCHA reCAPTCHA for WooCommerce <= 1.2.6 - Authenticated(Admin+) Stored Cross-Site Scripting via Plugin Settings
• WP Listings Pro <= 3.0.14 - Authenticated (Contributor+) Stored Cross-Site Scripting
• Stylish Cost Calculator <= 7.0.3 - Stored Cross-Site Scripting
• MapPress Maps <= 2.54.5 - Remote Code Execution via Improper Capability Checks in AJAX Calls
• Ultimate Addons for WPBakery Page Builder <= 3.19.14 - Authenticated (Contributor+) Stored Cross-Site Scripting
• Alex Reservations: Smart Restaurant Booking <= 2.0.5 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode
• Prime Mover – Backup and Migration <= 2.2.0 - Authenticated (Admin+) Arbitrary File Upload
• I Order Terms <= 1.5.0 - Cross-Site Request Forgery