Vulnerability archive: section 9, page 4

Open a report to review affected versions, available fixes and original sources. Each report covers a specific issue; its presence does not establish whether your website is affected.

• ARMember – Membership Plugin, Content Restriction, Member Levels, User Profile & User signup <= 4.0.30 - Open Redirect
• Referrer Detector <= 4.2.1.0 - Unauthenticated PHP Object Injection
• List category posts <= 0.89.3 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode
• MDTF – Meta Data and Taxonomies Filter <= 1.3.5 - Authenticated (Contributor+) Stored Cross-Site Scripting
• WP-Members Membership Plugin <= 3.5.4.3 - Authenticated (Subscriber+) Stored Cross-Site Scripting via Multiple Checkbox and Multiple Select User Profile Fields
• WP Delicious <= 1.9.1 - Missing Authorization
• JS Help Desk <= 2.9.2 - Unauthenticated Arbitrary File Deletion
• MP3 Audio Player – Music Player, Podcast Player & Radio by Sonaar 5.3 - 5.10 - Authenticated (Author+) Server-Side Request Forgery
• Goracash <= 1.1 - Authenticated (Administrator+) Stored Cross-Site Scripting
• ProfileGrid <= 5.7.8 - Cross-Site Request Forgery
• Form Maker by 10Web – Mobile-Friendly Drag & Drop Contact Form Builder <= 1.15.46 - Reflected Cross-Site Scripting
• Breeze <= 2.0.8 - Cross-Site Request Forgery via import_json_settings
• Premium Packages – Sell Digital Products Securely <= 5.9.3 - Reflected Cross-Site Scripting via add_query_arg
• WP Email Template <= 2.8.6 - Cross-Site Request Forgery
• Wheel of Life <= 1.2.0 - Missing Authorization
• Responsive Coming Soon Landing Page / Holding Page for WordPress <= 3.0 - Authenticated (Susbcriber+) Privilege Escalation
• Debug Assistant <= 1.4 - Authenticated (Administrator+) Stored Cross-Site Scripting
• The Plus Addons for Elementor Page Builder Lite < 2.0.6 - Authenticated Stored Cross-Site Scripting
• FancyPost <= 6.0.1 - Authenticated (Contributor+) Stored Cross-Site Scripting
• Rank Math SEO with AI SEO Tools <= 1.0.216 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'titleWrapper'
• Slider Revolution <= 4.2.2 - Cross-Site Scripting
• Conditional Fields for Contact Form 7 <= 2.4.1 - Missing Authorization
• Premmerce Wishlist for WooCommerce <= 1.1.11 - Unauthenticated SQL Injection
• ShopLentor Pro <= 2.8.5 - Missing Authorization
• Deliciosa <= 1.10.0 - Unauthenticated Local File Inclusion
• Diza <= 1.3.15 - Authenticated (Contributor+) Local File Inclusion
• Nexter Blocks <= 4.6.3 - Authenticated (Subscriber+) Information Exposure
• Miller <= 1.3.3 - Unauthenticated Local File Inclusion
• Kubio AI Page Builder <= 2.7.0 - Authenticated (Contributor+) Stored Cross-Site Scripting
• Stripe Payment Forms by WP Full Pay – Accept Credit Card Payments, Donations & Subscriptions <= 8.4.1 - Missing Authorization
• 360 Javascript Viewer <= 1.7.11 - Missing Authorization
• Page Builder: Live Composer <= 1.5.23 - Authenticated (Contributor+) Stored Cross-Site Scripting
• Google Plus One Bottom <= 0.0.2 - Cross-Site Request Forgery to Plugin Settings Update via Settings Page
• The Plus Addons for Elementor – Addons for Elementor, Page Templates, Widgets, Mega Menu, WooCommerce <= 6.4.11 - Authenticated (Contributor+) Stored Cross-Site Scripting
• Message Filter for Contact Form 7 <= 1.6.3 - Missing Authorization to Authenticated (Subscriber+) Filter Updates/Deletions
• Simple Job Manager <= 1.1 - Authenticated (Contributor+) SQL Injection
• Geo Mashup <= 1.13.21 - Unauthenticated Stored Cross-Site Scripting
• mFolio Lite <= 1.2.1 - Missing Authorization to Authenticated (Author+) File Upload via EXE and SVG Files
• Robo Gallery <= 5.1.3 - Authenticated (Author+) Stored Cross-Site Scripting via 'Loading Label' Setting
• Weekly Schedule <= 3.4.2 - Stored Cross-Site Scripting
• CSV Import <= 1.0 - Reflected Cross-Site Scripting
• Waitlist Woocommerce ( Back in stock notifier ) <= 2.5.1 - Cross-Site Request Forgery to Arbitrary Options Update
• Client Logo Carousel <= 3.0.0 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode
• WP Simple Anchors Links <= 1.0.0 - Authenticated (Contributor+) Stored Cross-Site Scripting via wpanchor Shortcode
• Agentimus – AI SEO, llms.txt & MCP for AI Agents <= 1.51.0 - Missing Authorization
• User Private Files <= 2.1.8 - Authenticated (Subscriber+) Information Exposure
• CAPTCHA in Thai <= 1.1 - Reflected Cross-Site Scripting
• WordPress Core < 2.0.1 - Cross-Site Scripting
• Hide Category by User Role for WooCommerce <= 2.1.1 - Missing Authorization
• Dropdown Menu Widget <= 1.9.7 - Reflected Cross-Site Scripting
• Custom User Registration Fields for WooCommerce <= 2.2.3 - Unauthenticated Privilege Escalation via 'afreg_select_user_role' Parameter in Store API Checkout
• SoftMe <= 1.1.24 - Missing Authorization
• Tutor LMS <= 4.0.0 - Authenticated (Subscriber+) SQL Injection via Stored Quiz Answer Array
• Better Search <= 4.2.1 - Authenticated (Author+) Stored Cross-Site Scripting
• Upsell Funnel Builder for WooCommerce <= 3.0.0 - Unauthenticated Order Manipulation
• Safe SVG <= 1.9.4 - Denial of Service
• WP Google Maps < 7.10.43 - Reflected Cross-Site Scripting
• Bears Backup <= 2.0.0 - Unauthenticated Remote Code Execution
• Insert or Embed Articulate Content into WordPress <= 4.3000000021 - Authenticated (Contributor+) Stored Cross-Site Scripting via shortcode
• Elementor Website Builder <= 3.1.3 - Authenticated (Contributor+) Stored Cross-Site Scripting via html_tag
• User Registration & Membership <= 5.2.8 - Unauthenticated Stored Cross-Site Scripting via Checkbox Field Value
• Login Widget With Shortcode < 3.2.1 - Cross-Site Scripting
• FixTeam | Electronics & Mobile Devices Repair WordPress Theme <= 1.4 - Unauthenticated Local File Inclusion
• WP TripAdvisor Review Slider <= 14.3 - Authenticated (Administrator+) SQL Injection
• Booking Calendar <= 10.11.1 - Authenticated (Contributor+) Stored Cross-Site Scripting via wpbc Shortcode
• Wawp <= 4.4 - Missing Authorization
• Quiz Maker by AYS <= 6.7.1.29 - Unauthenticated Stored Cross-Site Scripting via 'rate_reason'
• RTMKit <= 1.6.8 - Reflected Cross-Site Scripting via 'themebuilder' Parameter
• Explore pages <= 1.01 - Reflected Cross-Site Scripting
• Patricia Lite <= 1.2.3 - Cross-Site Request Forgery
• WordPress Core < 3.0.2 - Missing Authorization
• GeoDirectory <= 2.3.84 - Authenticated (Contributor+) Stored Cross-Site Scripting
• Syndicate Out <= 0.9 - Unauthenticated Stored Cross-Site Scripting
• Contact Form 7 – PayPal & Stripe Add-on <= 2.0 - Reflected Cross-Site Scripting
• Migration, Backup, Staging – WPvivid <= 0.9.69 - Reflected Cross-Site Scripting via sub_page Parameter
• Multiple Themes by bslthemes <= Various Version - Unauthenticated Local File Inclusion
• Rover IDX <= 3.0.0.2903 - Authenticated (Subscriber+) Missing Authorization via Multiple Functions
• WP AntiDDOS <= 2.0 - Reflected Cross-Site Scripting
• Soledad <= 8.4.1 - Reflected Cross-Site Scripting
• LatePoint <= 4.9.91 - Authenticated (Subscriber+) Stored Cross-Site Scripting
• MasterStudy LMS Pro < 4.7.16 - Missing Authorization to Unauthenticated Arbitrary Content Deletion
• WPGraphQL <= 2.9.1 - Missing Authorization
• WP Photo Album Plus <= 8.0.10 - Stored Cross-Site Scripting
• WP-WebAuthn <= 1.3.1 - Authenticated (Contributor+) Stored Cross-Site Scripting
• Login with NEAR <= 0.3.3 - Authentication Bypass via 'account' Parameter
• Trinity Audio <= 5.21.0 - Unauthenticated Information Exposure
• Linet ERP-Woocommerce Integration <= 3.5.12 - Authenticated (Admin+) Arbitrary File Read & Deletion
• Team Members <= 3.4.4 - Authenticated (Contributor+) PHP Object Injection
• Easy FAQs <= 3.2.1 - Authenticated (Contributor+) Stored Cross-Site Scripting
• Soledad <= 8.6.8 - Authenticated (Contributor+) Local File Inclusion
• AutomateWoo <= 5.7.5 - Cross-Site Request Forgery
• Add custom content after post <= 1.0 - Reflected Cross-Site Scripting
• Health Check & Troubleshooting <= 1.2.3 - Missing Authorization Checks
• Events Manager 7.4.1 - 7.4.4 - Authenticated (Subscriber+) Information Exposure
• RestroPress – Online Food Ordering System 3.0.0 - 3.2.1 - Unauthenticated Information Exposure to Authentication Bypass via Forged JWT
• Smooth Slider < 2.8.7 - Authenticated SQL Injection
• Total Security <= 3.4 - Cross-Site Scripting
• Chained Quiz <= 1.3.2.3 - Reflected Cross-Site Scripting via date
• WordPress Core < 5.5.2 - Misconfiguration That Allows Trigger of New Installation
• REST API | Custom API Generator For Cross Platform And Import Export In WP 1.0.0 - 2.0.3 - Missing Authorization to Unauthenticated Privilege Escalation via process_handler Function