Vulnerability archive: section 9, page 7

Open a report to review affected versions, available fixes and original sources. Each report covers a specific issue; its presence does not establish whether your website is affected.

• Jobmonster Elementor Addon <= 1.1.4 - Authenticated (Contributor+) Local File Inclusion
• Widget Bundle <= 2.0.0 - Cross-Site Request Forgery to Widget Disable/Enable
• Gravity Booster <= 5.26 - Authenticated (Editor+) Stored Cross-Site Scripting via 'stylerSettings' Parameter
• Broadstreet <= 1.53.1 - Missing Authorization to Authenticated (Subscriber+) Advertiser Creation
• Pz-LinkCard <= 2.5.2 - Sever-Side Request Forgery
• Multi Purpose Mail Form <= 1.0.2 - Unauthenticated Arbitrary File Upload
• Landing Page Builder <= 1.5.3.4 - Authenticated (Author+) Stored Cross-Site Scripting
• WP Job Portal <= 2.5.2 - Authenticated (Editor+) Stored Cross-Site Scripting via Job Description Field
• Affiliate Links: WordPress Plugin for Link Cloaking and Link Management <= 3.0.1 - Missing Authorization to Unauthenticated Import/Export and PHP Object Injection
• Tutor LMS Pro <= 3.9.8 - Missing Authorization
• Woo Custom and Sequential Order Number <= 2.6.0 - Cross-Site Request Forgery
• WooCommerce Warranty Requests <= 2.1.6 - Reflected Cross-Site Scripting
• WP Social Media Login <= 1.0.6 - Authentication Bypass to Account Takeover
• Akismet Spam Protection < 2.0.2 - Cross-Site Scripting
• Powerlift < 3.2.1 - Missing Authorization
• GD Star Rating <= 1.9.22 - Cross-Site Request Forgery
• Google Doc Embedder <= 2.6.1 - Cross-Site Request Forgery
• aBlocks – Gutenberg Blocks, User Dashboard Builder, Popup Builder, Form Builder & Animation Builder < 2.9.1 - Authenticated (Contributor+) Privilege Escalation
• Analytify <= 5.4.3 - Missing Authorization
• SureMembers <= 1.10.6 - Sensitive Information Exposure
• Flatsome <= 3.16.8 - Reflected Cross-Site Scripting in UX Builder
• AutomateWoo <= 5.7.5 - Missing Authorization
• Follow My Blog Post <= 2.4.0 - Missing Authorization to Unauthenticated Arbitrary Content Deletion
• Gutenberg Template Library & Redux Framework <= 4.2.1 - Incorrect Authorization Leading to Arbitrary Plugin Installation and Post Deletion
• WP Search Analytics <= 1.4.5 - Authenticated (Administrator+) Stored Cross-Site Scripting
• Business Directory Plugin – Easy Listing Directories for WordPress <= 6.4.23 - Missing Authorization
• Kirki – Freeform Page Builder, Website Builder & Customizer 6.2.1 - 6.2.5 - Unauthenticated Information Exposure
• Supertext Translation and Proofreading <= 4.25 - Cross-Site Request Forgery to Stored Cross-Site Scripting
• Easyship WooCommerce Shipping Rates <= 0.8.9 - Missing Authorization via multiple AJAX actions
• Filter & Grids <= 3.5.1 - Missing Authorization
• Simple 301 Redirects 2.0.0 - 2.0.3 - Unauthenticated Redirect Export
• Download Manager <= 3.3.66 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'icon' Shortcode Attribute
• Posts List Designer by Category <= 3.1 - Authenticated (Contributor+) Stored Cross-Site Scriptiong via Shortcode
• Tabs Shortcode and Widget <= 1.17 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode
• Rank Math SEO <= 1.0.252.1 - Authenticated (Subscriber+) Information Exposure
• Fluent Forms Pro Add On Pack <= 6.1.17 - Missing Authorization to Unauthenticated Arbitrary Attachment Deletion
• CBX Bookmark & Favorite <= 1.7.20 - Authenticated (Administrator+) SQL Injection
• Dokan: AI Powered WooCommerce Multivendor Marketplace Solution – Build Your Own Amazon, eBay, Etsy < 5.0.14 - Missing Authorization
• Real Estate 7 WordPress <= 3.5.9 - Unauthenticated Stored Cross-Site Scripting
• WP Directory Kit <= 1.2.1 - Cross-Site Request Forgery to Plugin Settings Change/Delete, Demo Import, Directory Kit Modification/Deletion via admin_page_display
• Wisly <= 1.0.0 - Insecure Direct Object Reference to Unauthenticated Wishlist Manipulation
• WP To Do <= 1.3.0 - Authenticated (Contributor+) Stored Cross-Site Scripting
• Affiliate Plus <= 1.3.2 - Cross-Site Request Forgery to Stored Cross-Site Scripting
• Popup box <= 2.3.3 - Cross-Site Scripting
• SNORDIAN's H5PxAPIkatchu <= 0.4.17 - Unauthenticated Stored Cross-Site Scripting via insert_data
• Classified Listing – AI-Powered Classified ads & Business Directory Plugin <= 5.3.8 - Unauthenticated Stored Cross-Site Scripting
• Tour Master - Tour Booking, Travel, Hotel < 5.3.4 - Unauthenticated Stored Cross-Site Scripting via Room Booking
• Tracking Code Manager < 1.11.5 - Cross-Site Scripting
• Arcane <= 3.6.6 - Missing Authorization
• API Bearer Auth < 20190907 - Cross-Site Scripting
• Robots.txt rewrite <= 1.6.1 - Cross-Site Request Forgery
• Secure CAPTCHA <= 1.2 - Cross-Site Request Forgery to Stored Cross-Site Scripting
• Additional Order Filters for WooCommerce <= 1.11 - Reflected Cross-Site Scripting
• Fediverse Embeds <= 1.5.3 - Unauthenticated Arbitrary File Upload
• Ravpage <= 2.31 - PHP Object Injection
• Scroll rss excerpt <= 5.0 - Reflected Cross-Site Scripting
• Affiliate Super Assistent <= 1.5.3 - Unauthenticated Arbitrary Shortcode Execution
• GiveWP – Donation Plugin and Fundraising Platform <= 4.14.2 - Reflected Cross-Site Scripting
• Mass Email To users <= 1.1.4 - Unauthenticated Reflected Cross-Site Scripting via 'entrant'
• Cosmic Blocks (40+) Content Editor Blocks Collection <= 1.3.0 - Authenticated (Contributor+) Stored Cross-Site Scripting
• Hammas Calendar <= 1.5.11 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'apix' Shortcode Attribute
• My auctions allegro <= 3.6.18 - Reflected Cross-Site Scripting
• List Mixcloud <= 1.4 - Authenticated (Contributor+) Stored Cross-Site Scripting
• Post Grid Combo – 36+ Gutenberg Blocks <= 2.2.64 - Authenticated (Contributor+) Cross-Site Scripting
• WP Job Portal – AI-Powered Recruitment System for Company or Job Board website <= 2.5.9 - Authenticated (Subscriber+) Insecure Direct Object Reference
• TinyChat Room Spy <= 1.2.8 - Reflected Cross-Site Scripting
• Popup Builder <= 4.1.0 - SQL Injection
• BSK PDF Manager <= 3.7.1 - Authenticated (Administrator+) Stored Cross-Site Scripting via SVG File Upload
• FlightLog <= 3.0.2 - Authenticated (Editor+) SQL Injection
• FuseWP – WordPress User Sync to Email List & Marketing Automation (Mailchimp, Constant Contact, ActiveCampaign etc.) <= 1.1.23.0 - Missing Authorization to Authenticated (Subscriber+) Sync Rule Creation
• Easy Media Replace <= 0.1.3 - Authenticated (Author+) Arbitrary File Deletion
• School Management System for Wordpress <= 93.0.0 - Missing Authorization to Unauthenticated Arbitrary Post Deletion
• Accommodation System <= 1.0.1 - Missing Authorization
• Posti Shipping <= 3.10.2 - Full Path Disclosure
• Easy Elements for Elementor – Addons & Website Templates <= 1.4.9 - Unauthenticated Privilege Escalation via 'custom_meta' Parameter
• Contact Form Email <= 1.3.41 - Captcha Bypass
• WordPress Core < 4.1.2 - Cross-Site Scripting
• The Plus Addons for Elementor – Elementor Addons, Page Templates, Widgets, Mega Menu, WooCommerce <= 5.5.4 - Authenticated (Contributor+) Stored Cross-Site Scripting via Heading Title Widget
• WP Go Maps <= 9.0.32 - Authenticated (Administrator+) Stored Cross-Site Scripting
• OoohBoi Steroids for Elementor <= 2.1.3 - Missing Authorization leading to Authenticated (Subscriber+) Attachment Deletion
• Surbma | SalesAutopilot Shortcode <= 2.5 - Authenticated (Contributor+) Stored Cross-Site Scripting
• Wholesale Suite <= 2.2.4.2 - Authenticated (Shop Manager+) Privilege Escalation
• Wp-D3 <= 2.4.1 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode
• leads5050-visitor-insights < 1.0.4 - Unauthenticated Arbitrary License Change
• Apollo13 Framework Extensions <= 1.9.3 - Authenticated (Author+) Stored Cross-Site Scripting
• Twitter Friends Widget <= 3.1 - Reflected Cross-Site Scripting
• Improved Include Page <= 1.2 - Authenticated (Contributor+) Arbitrary Posts/Pages Access
• URL Shortify <= 1.10.5.1 - Authenticated (Administrator+) Stored Cross-Site Scripting
• I LOVE IT! < 2.4 - Multiple Vulnerabilities
• WordPress Landing Page – Squeeze Page – Responsive Landing Page Builder Free – WP Lead Plus X <= 0.98 - Authenticated Stored Cross-Site Scripting
• ERP: Complete HR, Accounting & CRM Suite with Recruitment and WooCommerce CRM Support <= 1.17.5 - Authenticated (HR Manager+) SQL Injection via 'orderby' Parameter
• Xpro Addons — 140+ Widgets for Elementor <= 1.5.0 - Missing Authorization to Unauthenticated Xpro Template Creation
• Orbit Fox by ThemeIsle <= 2.10.43 - Authenticated (Contributor+) Stored Cross-Site Scripting via title_tag Parameter
• Nirweb support <= 3.0.3 - Missing Authorization
• WP Search Analytics <= 1.4.7 - Reflected Cross-Site Scripting via 'render_stats_page'
• WP OAuth Server (OAuth Authentication) <= 4.2.1 - Authenticated (Administrator+) Stored Cross-Site Scripting
• Redirect Redirection <= 1.1.3 - Missing Authorization in 'SaveSettings' function
• Kognetiks Chatbot for WordPress <= 2.1.7 - Missing Authorization to Authenticated (Subscriber+) Assistant Addition
• Contest Gallery < 13.1.0.7 - Authenticated Email Address Disclosure
• WPQA - Builder forms Addon For WordPress (<= 5.9.2), Himer (<= 1.9.3) and Discy (<= 5.5.3) - Authenticated (Subscriber+) Insecure Direct Object Reference