Vulnerability archive: section 9, page 26

Open a report to review affected versions, available fixes and original sources. Each report covers a specific issue; its presence does not establish whether your website is affected.

• Brook - Agency Business Creative WordPress Theme <= 2.9.0 - Authenticated (Contributor+) Local File Inclusion
• WordPress Core 6.3 - 6.3.1 - Authenticated(Contributor+) Cross-Site Scripting via Footnotes Block
• Image Hover Effects Ultimate 9.8.1 - 9.8.4 - Authenticated (Admin+) Stored Cross-Site Scripting
• Password Protected <= 2.6.2 - Authenticated (Administrator+) Stored Cross-Site Scripting
• Directorist <= 8.2 - Missing Authorization to Unauthenticated Arbitrary Post Publishing
• Ultimate Video Player <= 10.0 - Unauthenticated Arbitrary File Download
• Contact Form to DB by BestWebSoft <= 1.7.0 - Authenticated (Contributor+) SQL Injection via cntctfrmtdb_department
• Pricing Tables For WPBakery Page Builder (formerly Visual Composer) <= 2.0 - Authenticated (Subscriber+) Local File Inclusion via Shortcode
• Simple Share Follow Button <= 1.03 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode
• SALERT <= 1.2.1 - Missing Authorization via salert_save_settings_with_ajax()
• MoneyTheme (All Versions) - Arbitrary File Upload
• Inline Image Upload for BBPress <= 1.1.19 - Authenticated (Subscriber+) Arbitrary File Upload
• Groundhogg <= 4.5.4 - Authenticated (Custom+) SQL Injection via 'after' Parameter
• WP Forms Puzzle Captcha <= 4.1 - Cross-Site Request Forgery
• HomeRoofer <= 2.11.0 - Unauthenticated Local File Inclusion
• Simple Basic Contact Form <= 20240502 - Unauthenticated Arbitrary Shortcode Execution
• Interactive World Map <= 3.2.0 - Reflected Cross-Site Scripting
• Multiple Plugins <= (Various Versions) - Authenticated (Contributor+) Stored DOM-Based Cross-Site Scripting via prettyPhoto JavaScript Library
• WP-Lister Lite for eBay <= 3.5.7 - Reflected Cross-Site Scripting via 's'
• Email Verification, Email OTP, Block Spam Email, Passwordless login, Hide Login, Magic Login – User Verification <= 2.0.44 - Authentication Bypass to Account Takeover
• RSS Feed Widget <= 2.9.7 - Authenticated (Admin+) Stored Cross-Site Scripting
• افزونه پیامک حرفه ای فراز اس ام اس <= 2.7.3 - Reflected Cross-Site Scripting
• Tock Widget <= 1.1 - Cross-Site Request Forgery to Stored Cross-Site Scripting
• user files <= 2.4.2 - Unauthenticated Arbitrary File Upload
• RentPress <= 6.6.4 - Reflected Cross-Site Scripting
• AHAthat Plugin <= 1.6 - Authenticated (Admin+) SQL Injection
• WPFunnels – Funnel Builder for WooCommerce with Checkout & One Click Upsell <= 3.12.13 - Missing Authorization
• CartFlows <= 1.11.11 - Insecure Direct Object Reference to Arbitrary Post Deletion
• JSM Screenshot Machine Shortcode <= 2.3.0 - Authenticated (Contributor+) Stored Cross-Site Scripting
• Single Sign On For TNG <= 2.0.0 - Unauthenticated Privilege Escalation via Unverified Password Change
• Jeg Elementor Kit <= 2.6.4 - Authenticated (Contributor+) Stored Cross-Site Scripting via JKit - Banner
• TBTestimonials <= 1.7.3 - Reflected Cross-Site Scripting
• Beautiful taxonomy filters <= 2.4.6 - Unauthenticated SQL Injection
• JetTabs <= 2.2.7 - Authenticated (Contributor+) Stored Cross-Site Scripting
• F70 Lead Document Download <= 1.4.4 - Missing Authorization to Unauthenticated Arbitrary Media File Download
• StoreKeeper for WooCommerce <= 14.4.4 - Unauthenticated Arbitrary File Upload
• WP Upload Restriction <= 2.2.4 - Missing Authorization Checks
• Option Tree <= 2.5.5 - Cross-Site Scripting
• Seven Stars <= 1.4.4 - Reflected Cross-Site Scripting
• Post Grid Combo – 36+ Gutenberg Blocks <= 2.2.68 - Information Exposure via get_posts API Endpoint
• Pricing Table by Supsystic <= 1.8.1 - Missing Authorization on AJAX Actions
• Happy Addons for Elementor <= 3.10.1 - Authenticated (Contributor+) Stored Cross-Site Scripting
• Tweet Wheel < 1.0.3.3 - Reflected Cross-Site Scripting
• Recall Products <= 0.8 - Cross-Site Scripting
• Frontend Profile <= 1.3.9 - Missing Authorization
• Rank Math SEO <= 1.0.40.2 - Privilege Escalation via Unprotected REST API Endpoint
• Sliced Invoices <= 3.8.2 - Reflected Cross-Site Scripting
• ElementCamp <= 2.3.6 - Authenticated (Author+) SQL Injection via 'meta_query[compare]' Parameter
• NextMove Lite – Thank You Page for WooCommerce <= 2.19.0 - Missing Authorization to Authenticated (Subscriber+) Deactivation Reason Submission
• Greenshift – animation and page builder blocks <= 4.9.9 - Authenticated (Author+) Stored Cross-Site Scripting
• Plestar Directory Listing <= 1.0 - Reflected Cross-Site Scripting
• Accordions – Responsive Accordion & FAQ Plugin for WordPress <= 3.0.6 - Authenticated (Subscriber+) Stored Cross-Site Scripting
• All In One WP Security & Firewall <= 4.4.10 - Open Redirect and Reflected Cross-Site Scripting
• Simple Membership <= 4.5.3 - Unauthenticated Open Redirect
• Tickera – WordPress Event Ticketing <= 3.5.4.4 - Unauthenticated Arbitrary Shortcode Execution
• Extensive VC Addons for WPBakery page builder <= 1.9 - Unauthenticated Local File Inclusion
• WPML <= 3.1.9 - Arbitrary Deletion of Content
• Popup box <= 4.5.1 - Missing Authorization
• WP Slimstat <= 4.8 - Unauthenticated Stored Cross-Site Scripting from Visitors
• WPMU Ldap Authentication <= 5.0.1 - Cross-Site Request Forgery to Stored Cross-Site Scripting
• Collapsing Archives <= 3.0.5 - Authenticated (Contributor+) Stored Cross-Site Scripting
• MP3 Audio Player – Music Player, Podcast Player & Radio by Sonaar <= 5.9.3 - Authenticated (Contributor+) Stored Cross-Site Scripting via Podcast RSS Feed
• JetEngine <= 3.8.13.0 - Unauthenticated Stored Cross-Site Scripting
• WooCommerce Support Ticket System < 18.5 - Unauthenticated Arbitrary File Deletion
• Music Player for WooCommerce <= 1.0.172 - Authenticated (Admin+) Stored Cross-Site Scripting
• Projectopia <= 5.1.17 - Missing Authorization
• Export All Posts, Products, Orders, Refunds & Users <= 2.13 - Unauthenticated PHP Object Injection
• Ridhi <= 1.1.2 - Missing Authorization
• WPBakery Page Builder Clipboard <= 4.5.5 - Stored Cross-Site Scripting
• افزونه پیامک ووکامرس فوق حرفه ای (جدید) payamito sms woocommerce <= 1.3.5 - Unauthenticated Time-Based Blind SQL Injection
• JetSmartFilters <= 3.6.3 - Authenticated (Contributor+) Stored Cross-Site Scripting
• Advanced Local Pickup for WooCommerce <= 1.6.2 - Missing Authorization
• Mollie Payments for WooCommerce <= 7.3.11 - Authenticated (Shop Manager+) Arbitrary File Upload
• iThemes Sync <= 2.1.13 - Cross-Site Request Forgery and Missing Authorization via 'hide_authenticate_notice'
• Newspaper <= 11.5.1 - Reflected Cross-Site Scripting
• WP Super Cache <= 1.7.2 - Authenticated Remote Code Execution
• Brizy – Page Builder <= 2.7.16 - Authenticated (Contributor+) Sensitive Information Exposure via get_users Function
• Amoli <= 1.0 - Unauthenticated Local File Inclusion
• Wallet System for WooCommerce – Digital Wallet, Buy Now Pay Later (BNPL), Instant Cashback, Referral program, Partial & Subscription Payments <= 2.7.5 - Missing Authorization
• Seamless Donations: A Platform for Global Fundraising and Rebuilding using Stripe and PayPal <= 5.1.12 - Cross-Site Scripting
• Advanced Custom Fields PRO 6.1 - 6.1.7 - Authenticated (Administrator+) Stored Cross-Site Scripting
• Wd-image-magnifier-xoss <= 1.0 - Authenticated (Contributor+) Stored Cross-Site Scripting
• Uncanny Toolkit for LearnDash <= 3.6.3 - Cross-Site Request Forgery
• WordPress Core < 3.0.1 - Missing Authorization
• Price Table <= 0.2.2 - Authenticated (Contributor+) Stored Cross-Site Scripting
• Parsi Date <= 5.1.1 - Reflected Cross-Site Scripting via add_query_arg Parameter
• CedCommerce Integration for Good Market <= 1.0.6 - Unauthenticated Local File Inclusion
• Social Slider Feed <= 2.0.4 - Missing Authorization
• Privacy Policy Generator, Terms & Conditions, GDPR, CCPA, Cookie Policy & Disclaimer Templates – WPLP Legal Pages <= 3.7.0 - Missing Authorization
• EU Cookie Law <= 3.1.6 - Authenticated (Admin+) Stored Cross-Site Scripting
• PostX - Gutenberg Blocks for Post Grid <= 2.4.9 - Stored Cross-Site Scripting
• Toolbar Extras for Elementor & More – WordPress Admin Bar Enhanced <= 1.4.9 - Authenticated (Contributor+) Stored Cross-Site Scripting
• EasyCart <= 5.8.13 - Authenticated (Contributor+) SQL Injection
• WP Downgrade <= 1.2.2 - Admin+ Stored Cross-Site Scripting
• BP Profile Shortcodes Extra <= 2.6.0 - Authenticated (Contributor+) Stored Cross-Site Scripting
• Hillter <= 3.0.7 - Authenticated (Subscriber+) PHP Object Injection
• Photo Gallery by 10Web <= 1.8.41 - Authenticated (Contributor+) SQL Injection via 'compact_album_order_by' Shortcode Parameter
• Qi Addons for Elementor <= 1.9.2 - Authenticated (Contributor+) Stored Cross-Site Scripting via TypeOut Text Widget
• Tweet Wheel <= 0.2 - Missing Authorization Checks
• SIP Reviews Shortcode for WooCommerce <= 1.2.3 - Authenticated (Contributor+) SQL Injection