Vulnerability archive: section 9, page 3

Open a report to review affected versions, available fixes and original sources. Each report covers a specific issue; its presence does not establish whether your website is affected.

• WordPress Button Plugin MaxButtons <= 9.8.0 - Authenticated (Admin+) Stored Cross-Site Scripting via Text Color
• Donation Forms by Charitable <= 1.7.0.12 - Unauthenticated Privilege Escalation
• Email Log <= 2.4.8 - Unauthenticated Hook Injection
• Simple Business Directory Pro <= 15.9.4 - Unauthenticated SQL Injection
• Pods <= 3.3.9 - Unauthenticated Privilege Escalation via Authorization Bypass to Admin Methods via 'pods_admin' AJAX Router
• Clone <= 2.4.5 - Missing Authorization
• WP shop <= 2.6.0 - Cross-Site Request Forgery to Arbitrary File Upload
• Zeinet <= 1.0.0 - Reflected Cross-Site Scripting
• List Child Pages Shortcode <= 1.3.1 - Authenticated (Contributor+) Stored Cross-Site Scripting
• WP Cloudy <= 4.4.9 - Authenticated (Admin+) SQL Injection
• Advanced Forms for ACF <= 1.9.3.7 - Missing Authorization
• Post Grid, Form Maker, Popup Maker, WooCommerce Blocks, Post Blocks, Post Carousel – Combo Blocks <= 2.2.85 - Authenticated (Contributor+) Stored Cross-Site Scripting via redirectURL Parameter of Date Countdown Widget
• Media File Renamer – Auto & Manual Rename <= 5.2.5 - Cross-Site Request Forgery
• RestroPress <= 3.1.2 - Cross-Site Request Forgery via rpress_orders_list_table_process_bulk_actions
• Realty Workstation <= 1.0.45 - Missing Authorization
• Design Scuole Italia <= 2.18.1 - Unauthenticated Arbitrary File Donwload
• Display Future Posts <= 0.2.3 - Cross-Site Request Forgery to Cross-Site Scripting
• Better Tag Cloud <= 0.99.5 - Authenticated (Admin+) Stored Cross-Site Scripting
• Category Icon <= 1.0.2 - Authenticated (Editor+) Stored Cross-Site Scripting
• Stop Spammers Classic <= 2026.1 - Cross-Site Request Forgery via Email Allowlist
• eewee admin custom <= 1.8.2.4 - Reflected Cross-Site Scripting
• RSVPMaker <= 10.6.6 - Unauthenticated PHP Object Injection
• ChatBot <= 6.3.5 - Authenticated (Contributor+) Local File Inclusion
• Premium Addons for Elementor <= 4.10.24 - Authenticated (Contributor+) DOM-Based Stored Cross-Site Scripting
• Html5 Audio Player <= 2.2.23 - Authenticated (Contributor+) Stored Cross-Site Scripting
• FundEngine – Donation and Crowdfunding Platform <= 1.7.9 - Unauthenticated PHP Object Injection
• VikRentCar Car Rental Management System <= 1.3.2 - Information Exposure
• Photography <= 7.5.2 - Missing Authorization
• Code Engine <= 0.3.5 - Authenticated (Contributor+) Remote Code Execution
• Uncode <= 2.9.1.6 - Authenticated (Subscriber+) Arbitrary File Read in uncode_recordMedia
• WP Image Mask <= 3.1.2 - Authenticated (Contributor+) Stored Cross-Site Scripting
• Bricks Builder <= 2.1.4 - Missing Authorization
• Magic Tooltips For Contact Form 7 <= 1.0.34 - Unauthenticated Stored Cross-Site Scripting via 'esc_html' Filter Override via Comment Author
• WP JobSearch <= 2.3.3 - Unauthenticated Arbitrary File Upload
• B2BKing <= 4.6.00 - Missing Authorization to Authenticated(Subscriber+) Information Disclosure
• Mobile App Canvas <= 3.8.2 - Missing Authorization
• WP AutoKeyword <= 1.0 - Missing Authorization to Arbitrary Content Deletion
• Interactive Medical Drawing of Human Body <= 2.4 - Cross-Site Scripting
• Form Vibes – Database Manager for Forms <= 1.4.12 - Missing Authorization in Multiple Functions
• EscortWP <= 3.6.2 - Backdoored Software
• Team Showcase <= 1.22.15 - Stored Cross-Site Scripting
• 123.chat <= 1.3.0 - Authenticated(Administrator+) Stored Cross-Site Scripting
• OneElements – Best Elementor Addons <= 1.3.7 - Authenticated (Author+) Stored Cross-Site Scripting via SVG File Upload
• Product Carousel Slider & Grid Ultimate for WooCommerce <= 1.10.0 - Authenticated (Editor+) Stored Cross-Site Scripting
• my-related-posts <= 1.1 - Cross-Site Request Forgery to Stored Cross-Site Scripting
• Mail logging - WP Mail Catcher <= 2.1.3 - Authenticated (Admin+) SQL Injection
• WP Insightly for Contact Form 7, WPForms, Elementor, Formidable and Ninja Forms <= 1.1.4 - Unauthenticated PHP Object Injection
• Restaurant Reservations <= 1.8 - Authenticated (Contributor+) Stored Cross-Site Scripting
• WP EXtra <= 6.2 - Missing Authorization to Arbitrary Email Sending
• Redux Framework <= 4.5.13 - Authenticated (Subscriber+) Stored Cross-Site Scripting via Spinner Field Input
• multi Scheduler <= 1.0.0 - Cross-Site Request Forgery
• WP htaccess Control <= 3.5.1 - Authenticated (Administrator+) Stored Cross-Site Scripting
• StoryChief <= 1.0.42 - Unauthenticated Arbitrary File Upload
• Random Banner <= 4.2.11 - Authenticated (Admin+) Stored Cross-Site Scripting
• CM On Demand Search And Replace <= 1.3.0 - Authenticated (Administrator+) Stored Cross-Site Scripting
• LearnDash LMS - Reports Free <= 1.8.2.1 - Missing Authorization to Plugin Settings Update
• WP Fast Total Search <= 1.79.270 - Cross-Site Request Forgery
• WordPress Core <= 2.8.4 - Denial of Service
• SSL Zen <= 4.7.42 - Reflected Cross-Site Scripting via 'uri' Parameter
• Extreme Store <= 1.5.7 - Unauthenticated PHP Object Injection
• pipDisqus <= 1.6 - Authenticated (Administrator+) Stored Cross-Site Scripting
• WordPres 同步微博 <= 1.1.0 - Cross-Site Request Forgery
• WordPress Core <= 3.3.2 - Sensitive Information Disclosure
• Instant Locations <= 1.0 - Authenticated (Administrator+) Stored Cross-Site Scripting
• WPB Quick View for WooCommerce <= 2.1.8 - Authenticated (Contributor+) Stored Cross-Site Scripting
• Ocean Product Sharing <= 2.2.2 - Authenticated (Shop manager+) Stored Cross-Site Scripting
• Affiliate For WooCommerce <= 4.7.0 - Missing Authorization
• Hotscot Contact Form < 1.3 - SQL Injection
• Woffice Core <= 5.4.21 - Authenticated (Subscriber+) Arbitrary File Upload
• WooCommerce PDF Vouchers <= 4.9.4 - Missing Authorization
• Werkstatt - Creative Portfolio WordPress Theme <= 4.8.3 - Unauthenticated Local File Inclusion
• LA-Studio Element Kit for Elementor <= 1.5.1 - Authenticated (Contributor+) Stored Cross-Site Scripting
• S3Player – WooCommerce & Elementor Integration <= 4.2.1 - Authenticated (Contributor+) Stored Cross-Site Scripting
• Visual Form Builder <= 3.0.3 - Admin+ Stored Cross-Site Scripting
• WP Ticket Customer Service Software & Support Ticket System <= 6.0.2 - Unauthenticated PHP Object Injection
• FTP Sync <= 1.1.6 - Cross-Site Request Forgery to Stored Cross-Site Scripting
• Quick Playground <= 1.3.3 - Unauthenticated Path Traversal to Arbitrary File Read via 'stylesheet' Parameter
• Nari Accountant <= 1.0.12 - Authenticated (Editor+) Stored Cross-Site Scripting
• Minimal Coming Soon – Coming Soon Page <= 2.33 - Authenticated (Admin+) Stored Cross-Site Scripting
• Academy LMS <= 3.0.0 - Authenticated (Subscriber+) Insecure Direct Object Reference
• Buddypress Moderation <= 1.2.5 - Unauthenticated Stored Cross-Site Scripting
• Customer Reviews for WooCommerce < 5.118.0 - Unauthenticated Stored Cross-Site Scripting
• Sight – Professional Image Gallery and Portfolio <= 1.1.2 - Missing Authorization to Sensitive Information Exposure in handler_post_title
• Nimbata Call Tracking <= 1.7.2 - Cross-Site Request Forgery to Stored Cross-Site Scripting
• Salon Booking System <= 10.30.19 - Missing Authorization to Authenticated (Subscriber+) Booking Approval Bypass
• Thebe <= 1.3.0 - Reflected Cross-Site Scripting
• Timed Content <= 2.72 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode
• Simple Text Slider <= 1.0.5 - Authenticated (Contributor+) Stored Cross-Site Scripting
• Popup Builder <= 4.3.0 - Missing Authorization in Multiple AJAX Actions
• 12 Step Meeting List <= 3.16.5 - Missing Authorization to Authenticated (Contributor+) Arbitrary Content Deletion
• Podlove Podcast Publisher <= 4.0.11 - Missing Authorization to Unauthenticated Data Export
• WP STAGING WordPress Backup Plugin Free <= 3.1.2 and Pro <= 5.1.2 - Sensitive Information Exposure
• Custom 404 Pro <= 3.7.0 - Authenticated (Administrator+) SQL Injection
• WP Recipe Maker <= 9.6.1 - Authenticated (Contributor+) DOM-Based Stored Cross-Site Scripting via 'tooltip'
• LearnPress <= 4.2.5.7 - Command Injection
• Appointment Booking Plugin <= 5.7.3 - Authenticated (Subscriber+) Sensitive Information Exposure in 'first_name' Parameter Template Re-expansion
• Bold Page Builder <= 5.7.2 - Authenticated (Contributor+) Stored Cross-Site Scripting via bt_bb_service title
• SVG Support <= 2.3.19 Admin+ Cross-Site Scripting
• Event Tickets and Registration <= 5.30.0.1 - Missing Authorization
• CoDesigner WooCommerce Builder for Elementor – Customize Checkout, Shop, Email, Products & More <= 4.4.1 - Authenticated (Contributor+) Stored Cross-Site Scripting via Multiple Widgets