Vulnerability archive: section 9, page 27

Open a report to review affected versions, available fixes and original sources. Each report covers a specific issue; its presence does not establish whether your website is affected.

• ListingPro < 2.9.10 - Unauthenticated Local File Inclusion
• Gamic - Gaming Metaverse Game & Crypto WordPress Theme <= 1.19 - Unauthenticated PHP Object Injection
• Comic Easel <= 1.15 - Reflected Cross-Site Scripting
• Google Language Translator <= 5.0.05 - Cross-Site Scripting
• Mosaic <= 1.7.1 - Authenticated (Contributor+) Stored Cross-Site Scripting via Button Shortcode
• Highlight <= 1.0.29 - Cross-Site Request Forgery to Notice Dismissal
• Paymendo Bank Transfer <= 1.1 - Authenticated (Subscriber+) SQL Injection
• Portfolio Filter Gallery <= 2.2.0 - Missing Authorization
• Gmail SMTP <= 1.2.3.19 - Cross-Site Request Forgery
• Password Protected <= 2.7.11 - Unauthenticated Authorization Bypass via IP Address Spoofing
• Calendarista Basic Edition <= 3.0.2 - Cross-Site Request Forgery
• WP Pipes <= 1.4.3 - Unauthenticated Local File Inclusion
• Categorify <= 1.0.7.4 - Missing Authorization in categorifyAjaxUpdateFolderPosition
• Multilevel Referral Affiliate Plugin for WooCommerce <= 2.27 - Reflected Cross-Site Scripting
• Zingiri Web Shop < 2.4.0 - Multiple Vulnerabilities
• Gat <= 1.16 - Unauthenticated Local File Inclusion
• Smart Manager <= 8.52.0 - Authenticated (Administrator+) SQL Injection
• WP Pipes <= 1.4.3 - Reflected Cross-Site Scripting
• Caulk (Unknown Versions) - Full Path Disclosure
• Taxonomy/Term and Role based Discounts for WooCommerce <= 5.1 - Cross-Site Request Forgery to Settings Update
• EAN for WooCommerce <= 4.8.9 - Authenticated (Shop Manager+) Arbitrary Options Update
• Hack me if you can <= 1.2 - Cross-Site Request Forgery to Stored Cross-Site Scripting
• BuddyPress <= 14.3.3 - Insecure Direct Object Reference to Notifications Deletion
• AI ChatBot <= 4.8.9 - Unauthenticated Sensitive Information Exposure via qcld_wb_chatbot_check_user
• WP Google Maps <= 7.11.34 - Cross-Site Request Forgery to Cross-Site Scripting
• Dynamic User Directory <= 2.4 - Authenticated (Administrator+) SQL Injection
• Swift Framework <= 2.7.31 - Missing Authorization to Unauthenticated Arbitrary Content Update
• Ultimate Post Kit – Elementor Post Grid, Post Carousel, Post Slider & Blog Layout Widgets <= 4.5.5 - Missing Authorization
• MSTW League Manager <= 2.10 - Authenticated (Contributor+) Stored Cross-Site Scripting
• Forminator Forms – Contact Form, Payment Form & Custom Form Builder < 1.57.0.5 - Authenticated (Administrator+) Remote Code Execution
• Tutor LMS <= 2.6.0 - Missing Authorization
• Ultimate Addons for WPBakery Page Builder <= 3.19.20 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode
• Real Estate by Templatic (Unknown Version) - Cross-Site Request Forgery to Arbitrary File Upload
• Broadcast Live Video <= 7.2.4 - Unauthenticated Arbitrary File Deletion
• Scylla lite <= 1.8.3 - Authenticated (Contributor+) Stored Cross-Site Scripting via Button Shortcode
• GS Testimonial Slider <= 3.2.9 - Unauthenticated Arbitrary Shortcode Execution
• Appmaker – Convert WooCommerce to Android & iOS Native Mobile Apps <= 1.36.12 - Reflected Cross-Site Scripting
• If-So Dynamic Content Personalization <= 1.8.0.3 - Reflected Cross-Site Scripting
• RSS Aggregator <= 5.0.10 - Reflected Cross-Site Scripting via 'template' Parameter
• Doubly <= 1.0.46 - Authenticated (Subscriber+) PHP Object Injection via ZIP File Import
• WordPress-WPJobBoard <= 25.07010000-WP6.8.1-JB5.11.5 - Unauthenticated SQL Injection
• Add Categories Post Footer <= 2.2.2 - Reflected Cross-Site Scripting
• WordPress Dashboard Tweeter <= 1.3.2 - Missing Authorization
• Malware Scanner <= 4.7.2 and Web Application Firewall <= 2.1.1 - Unauthenticated Privilege Escalation
• Captcha 4.3.6 - 4.4.4 - Plugin Backdoor
• Quick/Bulk Order Form for WooCommerce <= 3.5.7 - Authenticated (Shop manager+) Stored Cross-Site Scripting
• Christmas Greetings <= 1.2.5 - Reflected Cross-Site Scripting
• Slimstat Analytics <= 5.0.8 - Authenticated (Administrator+) Stored Cross-Site Scripting via settings
• WPSolr <= 24.0 - Cross-Site Request Forgery to Privilege Escalation
• WordLift – AI powered SEO – Schema <= 3.54.2 - Missing Authorization to Authenticated (Subscriber+) Settings Update
• Korea SNS <= 1.6.4 - Cross-Site Request Forgery via kon_tergos_options
• CAFEHAUS API <= 1.0.0 - Unauthenticated Privilege Escalation via Password Reset
• Advanced FAQ Manager <= 1.5.2 - Authenticated (Author+) Stored Cross-Site Scripting
• SchedulePress <= 5.0.8 - Missing Authorization
• JVM rich text icons <= 1.2.6 - Directory Traversal to Authenticated(Subscriber+) Arbitrary File Deletion
• WP Forum Server < 1.7.4 - SQL Injection
• Upcasted S3 Offload – AWS S3, DigitalOcean Spaces, Backblaze, MinIO Storage Integration <= 3.1.0 - Missing Authorization
• Masteriyo - LMS for WordPress <= 1.6.7 - Sensitive Information Exposure
• bunny.net – WordPress CDN Plugin <= 2.3.6 - Missing Authorization
• Really Simple Security – Simple and Performant Security (formerly Really Simple SSL) <= 9.5.9 - Missing Authorization
• MainWP Google Analytics Extension <= 4.0.4 - Authenticated (Subscriber+) SQL Injection
• Love Story <= 1.3.12 - Unauthenticated PHP Object Injection
• Category Ajax Filter <= 2.8.2 - Unauthenticated Local File Inclusion
• WordPress Core < 4.6.1 - Authenticated Directory Traversal to Arbitrary File Access
• Online Booking & Scheduling Calendar for WordPress by vcita <= 4.6.0 - Unauthenticated Stored Cross-Site Scripting via REST API 'business_id' Parameter
• WowShipping Pro 1.0.6 - Injected Backdoor
• Hustle <= 7.6.4 = Authenticated (Administrator+) Stored Cross-Site Scripting
• Announcement & Notification Banner – Bulletin <= 3.7.0 - Cross-Site Request Forgery
• GamiPress – Link <= 1.1.4 - Authenticated (Contributor+) Stored Cross-Site Scripting
• Financio <= 1.1.3 - Cross-Site Request Forgery to Notice Dismissal
• turboSMTP <= 4.6 - Reflected Cross-Site Scripting
• Partners <= 0.2.0 - Unauthenticated PHP Object Injection
• Weather Effect – Christmas Santa Snow Falling <= 1.3.3 - Cross-Site Request Forgery
• Order Splitter for WooCommerce <= 5.3.0 - Authenticated (Subscriber+) SQL Injection
• Ungapped Widgets <= 1 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode
• All in One SEO <= 4.1.0.1 - Authenticated Code Injection
• Fitness Trainer <= 1.7.1 - Missing Authorization
• HT Contact Form Widget For Elementor Page Builder & Gutenberg Blocks & Form Builder. <= 2.2.1 - Directory Traversal to Arbitrary File Move
• WP Encryption - One Click SSL & Force HTTPS <= 7.8.5.10 - Missing Authorization to Authenticated (Subscriber+) SSL Setup Tampering
• Preservation <= 1.10 - Unauthenticated Local File Inclusion
• New User Approve <= 3.2.2 - Missing Authorization to Unauthenticated Arbitrary User Approval, Denial, and Information Disclosure
• KD Coming Soon <= 1.7 - Unauthenticated PHP Object Injection via cetitle
• WP Media folder <= 6.2.2 - Unauthenticated Stored Cross-Site Scripting
• Amazon Affiliate <= 3.17 - Reflected Cross-Site Scripting
• FormFacade <= 1.4.1 - Cross-Site Request Forgery
• MasterStudy LMS WordPress Plugin <= 2.9.34 - Missing Authorization via wp_ajax_stm_wpcfto_get_settings
• Elementor Website Builder <= 3.4.7 - DOM-based Cross-Site Scripting
• Media Library Helper by Codexin <= 1.2.0 - Cross-Site Request Forgery via rate_the_plugin_action
• GPTranslate – Multilingual AI Translation for WordPress: Automatically Translate Websites <= 2.32.6 - Unauthenticated SQL Injection
• SSV Events <= 3.2.7 - Unauthenticated Local File Inclusion
• Forminator Forms <= 1.51.1 - Missing Authorization to Authenticated (Subscriber+) Sensitive Information Disclosure via 'forminator_action' Parameter
• Event Booking Manager for WooCommerce <= 5.3.3 - Missing Authorization
• Happy Addons for Elementor <= 3.10.8 - Authenticated (Contributor+) Stored Cross-Site Scripting
• Easy Testimonials <= 3.0.4 - Cross-Site Scripting
• Page Builder: Live Composer <= 1.5.42 - Authenticated (Contributor+) PHP Object Injection
• WP EXtra <= 6.2 - Missing Authorization to .htaccess File Modification
• Ajax WP Query Search Filter <= 1.0.7 - Authenticated (Contributor+) Stored Cross-Site Scripting
• PressMart - Modern Elementor WooCommerce WordPress Theme <= 1.2.16 - Unauthenticated Arbitrary Shortcode Execution
• CMP – Coming Soon & Maintenance <= 4.1.7 - Maintenance Mode Bypass
• BOX NOW Delivery Croatia <= 3.3.0 - Missing Authorization