Vulnerability archive: section 9, page 25

Open a report to review affected versions, available fixes and original sources. Each report covers a specific issue; its presence does not establish whether your website is affected.

• RSVPMaker <= 8.7.2 - Server-Side Request Forgery
• Answer My Question < 1.2 - Cross-Site Scripting
• Pondol BBS <= 1.1.8.4 - Authenticated (Editor+) Stored Cross-Site Scripting
• WP Shortcodes Plugin — Shortcodes Ultimate <= 7.1.5 - Authenticated (Contributor+) Stored Cross-Site Scripting via su_members Shortcode
• User Messages <= 1.2.4 - Reflected Cross-Site Scripting
• Golo - City Travel Guide WordPress Theme <= 1.7.0 - Unauthenticated Privilege Escalation
• ListingPro Plugin <= 2.9.10 - Missing Authorization
• Wp Js Detect <= 1.0.9 - Cross-Site Request Forgery to Plugin Settings Update
• pretix widget <= 1.0.5 - Authenticated (Contributor+) Local File Inclusion
• Captain Slider <= 1.0.6 - Stored Cross-Site Scripting
• Foxit eSign for WordPress <= 2.0.3 - Authenticated (Admin+) Information Exposure
• Build App Online <= 1.0.20 - Missing Authorization Authenticated(Subscriber+) Arbitrary Options Update
• Japanized for WooCommerce <= 2.8.4 - Missing Authorization to Unauthenticated Paidy Order Manipulation
• Download Manager <= 3.2.34 - Sensitive Information Disclosure
• Appointment and Event Booking Calendar for WordPress - Amelia < 1.0.47 - Arbitrary Booking Update and Sensitive Data Exposure
• Simple Nested Menu <= 1.0 - Authenticated (Contributor+) Stored Cross-Site Scripting
• Waitlist Woocommerce ( Back in stock notifier ) <= 2.7.5 - Reflected Cross-Site Scripting
• Contact Form DB <= 2.8.19 - Cross-Site Scripting
• WP Cost Estimation & Payment Forms Builder <= 10.1.75 - Reflected Cross-Site Scripting
• WP Encryption – One Click Free SSL Certificate & SSL / HTTPS Redirect to Force HTTPS, SSL Score <= 7.0 - Sensitive Information Exposure via insufficiently protected files
• Orbit Fox by ThemeIsle <= 3.0.7 - Authenticated (Author+) Stored Cross-Site Scripting
• WP JobHunt <= 7.7 - Missing Authorization to Authenticated (Candidate+) Stored Cross-Site Scripting via 'status'
• Ansar Import – One Click Starter Sites – for WordPress Themes <= 2.1.2 - Unauthenticated Stored Cross-Site Scripting
• Events Addon for Elementor <= 2.1.2 - Cross-Site Request Forgery
• Unbounce Landing Pages <= 1.1.4 - Missing Authorization
• Reuters Direct <= 3.0.0 - Missing Authorization to Unauthenticated Settings Reset
• Category and Taxonomy Meta Fields <= 1.0.0 - Cross-Site Request Forgery to Taxonomy Meta Add/Delete
• MB Custom Post Types & Custom Taxonomies <= 2.7.6 - Authenticated (Admin+) Stored Cross-Site Scripting
• WP Google Street View (with 360° virtual tour) & Google maps + Local SEO <= 1.1.8 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'wpgsv_map' Shortcode
• Email Subscribers & Newsletters <= 5.9.10 - Missing Authentication to Unauthenticated Action Scheduler Task Execution
• UltimateAI <= 2.8.3 - Authentication Bypass
• WP Database Backup – Unlimited Database & Files Backup by Backup for WP <= 7.3 - Unauthenticated Database Back-Up Exposure
• Monetag Official Plugin <= 1.1.3 - Missing Authorization
• Bon Toolkit <= 1.3.2 - Authenticated (Contributor+) Stored Cross-Site Scripting
• Quick Chat <= 4.14 - SQL Injection
• Advanced Custom Fields <= 6.0.7 - Authenticated (Contributor+) PHP Object Injection
• Ocean Social Sharing <= 2.2.1 - Authenticated (Contributor+) Stored Cross-Site Scripting
• Ditty <= 3.1.24 - Missing Authorization via save_ditty_permissions_check
• Popup Maker – Boost Sales, Conversions, Optins, Subscribers with the Ultimate WP Popup Builder <= 1.23.0 - Unauthenticated Stored Cross-Site Scripting
• WP-CopyProtect [Protect your blog posts] <= 3.0.0 - Cross-Site Scripting
• iQ Block Country < 1.2.13 - Admin+ Arbitrary File Deletion via Zip Slip
• WP Compress for MainWP <= 6.30.32 - Missing Authorization
• SiteSkite MCP AI – Connector for Claude, ChatGPT, Cursor & WordPress WebOps <= 2.1.5 - Unauthenticated Privilege Escalation
• Product Recommendation Quiz for eCommerce <= 2.1.0 - Missing Authorization in prq_set_token
• Slide Puzzle <= 1.0.0 - Reflected Cross-Site Scripting
• Curly < 3.3 - Unauthenticated Local File Inclusion
• Sliding Door <= 3.6 - Authenticated (Contributor+) Stored Cross-Site Scripting
• WP Course Manager <= 1.3 - Cross-Site Request Forgery to Stored Cross-Site Scripting
• Responsive Progress Bar <= 1.0 - Authenticated (Contributor+) Stored Cross-Site Scripting
• Contact Form Plugin by Fluent Forms for Quiz, Survey, and Drag & Drop WP Form Builder <= 5.1.16 - Missing Authorization to Settings Update and Limited Privilege Escalation
• SMS Alert Order Notifications – WooCommerce <= 3.8.1 - Unauthenticated SQL Injection
• Relevanssi – A Better Search < 3.3.8 - Cross-Site Scripting
• Content Egg <= 5.4.0 - Cross-Site Request Forgery
• Qtranslate Slug <= 1.1.16 - Reflected Cross-Site Scripting
• WP Menu Cart <= 2.11.0 - Reflected Cross-Site Scripting
• Avante < 3.0.5 - Reflected Cross-Site Scripting
• Masteriyo - LMS <= 1.11.4 - Missing Authorization
• QR Code Tag for WC order emails <= 1.9.36 - Cross-Site Request Forgery
• WP Terms Popup <= 2.6.0 - Authenticated (Admin+) Stored Cross-Site Scripting
• WP Full Stripe Free <= 8.2.5 - Authenticated (Administrator+) SQL Injection
• Barcode Scanner with Inventory & Order Manager <= 1.5.4 - Authenticated (Subscriber+) SQL Injection
• B Carousel Block – Responsive Image and Content Carousel <= 1.1.5 - Missing Authorization to Authenticated (Subscriber+) Server-Side Request Forgery
• wProject < 5.8.0 - Reflected Cross-Site Scripting
• YaDisk Files <= 1.2.5 - Authenticated (Administrator+) Stored Cross-Site Scripting
• Grand Restaurant WordPress <= 7.0 - Missing Authorization to Unauthenticated Arbitrary Options Deletion
• Market Exporter <= 2.0.19 - Missing Authorization to Arbitrary File Deletion
• Smash Balloon Social Post Feed <= 4.9.0 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'id' Shortcode Attribute
• Jobmonster <= 4.7.5 - Unauthenticated Privilege Escalation
• Tutor LMS <= 3.9.3 - Missing Authorization to Authenticated (Subscriber+) Sensitive Information Exposure via tutor_order_details
• Bulk Edit and Create User Profiles – WP Sheet Editor <= 1.5.13 - Cross-Site Scripting
• Rox Appointment Booking <= 1.2.7 - Unauthenticated Information Exposure
• Infographic Maker iList <= 4.7.4 - Missing Authorization to Authenticated (Subscriber+) Arbitrary Title Update
• Creator LMS – WordPress LMS Plugin for Coaches, Cohorts & Course Creators <= 1.2.19 - Authenticated (Subscriber+) Free Paid Course Enrollment
• Contact Form Builder, Contact Widget <= 1.6.1 - Reflected Cross-Site Scripting
• Conditional Menus <= 1.2.6 - Cross-Site Request Forgery to Menu Options Update
• Omnipress <= 1.5.4 - Authenticated (Contributor+) Post Disclosure
• Spike <= 1.2 - Unauthenticated Local File Inclusion
• WP EasyCart <= 5.4.10 - Authenticated (Administrator+) SQL Injection via 'orderby'
• LoginWP - Pro <= 4.0.8.5 - Missing Authorization
• Narnoo Commerce Manager <= 1.6.0 - Reflected Cross-Site Scripting
• WP Recipe Maker <= 9.1.0 - Authenticated (Contributor+) Stored Cross-Site Scripting via Recipe Notes
• Forge – Front-End Page Builder <= 1.4.6 - Cross-Site Request Forgery to Stored Cross-site Scripting
• Bg Patriarchia BU <= 2.2.3 - Authenticated (Contributor+) Stored Cross-Site Scripting
• Best Posts Summary <= 1.0 - Cross-Site Request Forgery to Stored Cross-Site Scripting
• Oberliga Theme (All Versions) - SQL Injection
• Table of Contents Plus <= 2302 - Authenticated (Administrator+) Stored Cross-Site Scripting
• Cost of Goods: Product Cost & Profit Calculator for WooCommerce <= 4.1.0 - Authenticated (Contributor+) Stored Cross-Site Scripting
• Seo By 10Web <= 1.2.9 - Reflected Cross-Site Scripting
• Auto Refresh Single Page <= 1.1 - Authenticated (Contributor+) PHP Object Injection
• Payment forms, Buy now buttons, and Invoicing System | GetPaid <= 2.8.61 - Unauthenticated Stored Cross-Site Scripting via 'mmdwqzpoxadd' Parameter
• File Uploader for WooCommerce <= 1.0.4 - Unauthenticated Path Traversal
• WPBot Pro Wordpress Chatbot <= 13.6.2 - Authenticated (Subscriber+) Arbitrary File Deletion
• ELEX WooCommerce Dynamic Pricing and Discounts <= 2.1.2 - Cross-Site Request Forgery
• Tablesome <= 1.1.35.1 - Missing Authorization
• Highlight Searched Terms in Results <= 1.03 - Reflected Cross-Site Scripting
• WS Form LITE <= 1.11.7 - Missing Authorization to Authenticated (Subscriber+) Arbitrary Settings Update
• WordPress Core <= 3.5.1 - Cross-Site Scripting
• BMI Calculator Plugin <= 1.0.3 - Authenticated (Contributor+) Stored Cross-Site Scripting
• NewsBlogger <= 0.2.5.4 - Cross-Site Request Forgery to Arbitrary Plugin Installation
• Simple Dashboard <= 2.0 - Unauthenticated Privilege Escalation