Vulnerability archive: section 9, page 9

Open a report to review affected versions, available fixes and original sources. Each report covers a specific issue; its presence does not establish whether your website is affected.

• WP Popups – WordPress Popup builder <= 2.1.5 - Authenticated (Contributor+) Stored Cross-Site Scripting
• The Ultimate WordPress Toolkit – WP Extended <= 3.0.11 - Missing Authorization to Authenticated (Subscriber+) Stored Cross-Site Scripting
• JS Help Desk – AI-Powered Support & Ticketing System <= 3.1.4 - Insecure Direct Object Reference to Authenticated (Subscriber+) Cross-User Support Ticket Disclosure
• Display Terms Shortcode <= 1.0.4 - Authenticated (Contributor+) Stored Cross-Site Scripting
• MainWP Dashboard: Self-hosted WordPress Management for Agencies <= 6.1.1 - Missing Authorization
• Store Locator Plus <= 2311.17.01 - Unauthenticated Sensitive Information Exposure
• Hero Maps Premium <= 2.2.2 - Reflected Cross-Site Scripting
• Ads by WPQuads – Adsense Ads, Banner Ads, Popup Ads <= 2.0.84 - Missing Authorization
• Spam Free WordPress <= 1.9.3 - Full Path Disclosure
• Simple Membership <= 4.3.4 - Account Takeover via Password Reset
• WP Activity Log <= 5.2.2 - Unauthenticated Stored Cross-Site Scripting
• Stylish Price List < 6.9.0 - Arbitrary Image Upload
• Listamester <= 2.3.4 - Authenticated (Contributor+) Stored Cross-Site Scripting
• ShiftController Employee Shift Scheduling <= 4.9.23 - Unauthenticated Stored Cross-Site Scripting via 'hc-title'
• Frontend File Manager <= 22.7 - Sensitive Information Exposure via user uploads
• Community by PeepSo <= 6.4.6.1 - Authenticated (Subscriber+) Stored Cross-Site Scripting
• Stripe Gateway <= 7.6.0 - Cross-Site Request Forgery
• PPOM for WooCommerce <= 18.3 - Authenticated Stored Cross-Site Scripting
• I Am Gloria <= 1.1.4 - Cross-Site Request Forgery
• Bold Timeline Lite <= 1.1.9 - Missing Authorization to Admin Notice Dismissal
• Faction <= 1.1.1 - Arbitrary Options Update
• WP Hotel Booking <= 2.3.1 - Reflected Cross-Site Scripting via 'check_in_date' and 'check_out_date' Parameters
• JSON Options <= 0.0.4 - Unauthenticated Remote Code Execution
• FormBuilder <= 1.05 - Reflected Cross-Site Scripting
• DJ EmailPublish <= 1.7.2 Reflected Cross-Site Scripting
• WPFunnels <= 2.6.8 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortocde
• Redirect Redirection <= 1.1.3 - Missing Authorization in 'loadRedirectSettings' function
• Booster for WooCommerce <= 7.1.2 - Missing Authorization to Product Creation/Modification
• Elementor Addon Elements <= 1.6.3 - Reflected Cross-Site Scripting
• Melipayamak <= 2.2.12 - Authenticated (Administrator+) Stored Cross-Site Scripting
• Icegram <= 3.1.25 - Authenticated (Contributor+) Stored Cross-Site Scripting
• e-shot <= 1.0.2 - Missing Authorization to Authenticated (Subscriber+) Sensitive Information Exposure via API Token via 'eshot_form_builder_get_account_data' AJAX Action
• Backup and Restore WordPress – Backup Plugin <= 1.9 - Authorization Bypass
• HT Mega – Absolute Addons For Elementor <= 2.5.2 - Authenticated (Contributor+) Stored Cross-Site Scripting
• Radio Player <= 2.0.73 - Missing Authorization
• GamiPress <= 2.5.7 - Unauthenticated SQL Injection
• Shortcodes Ultimate <= 7.0.5 - Authenticated (Contributor+) Stored Cross-Site Scripting
• Drag and Drop Multiple File Upload for Contact Form 7 <= 1.3.9.0 - Directory Traversal via `wpcf7_guest_user_id` Cookie
• Text Styler <= 1.1.1 - Authenticated (Contributor+) Stored Cross-Site Scripting
• Similar Posts <= 3.1.5 - Admin+ Arbitrary PHP Code Execution
• Copify <= 1.3.0 - Cross-Site Request Forgery to Cross-Site Scripting
• Advance Search <= 1.1.2 - Reflected Cross-Site Scripting
• AdForest <= 6.0.11 - Missing Authorization
• Login Configurator <= 2.1 - Reflected Cross-Site Scripting
• InPost Gallery < 2.1.2.1 - Local File Inclusion
• Bridge - Creative Multipurpose WordPress Theme <= 30.8.9.1 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'circle_line' Shortcode Attribute
• TheGem Theme Elements (for Elementor) <= 5.10.5.1 - Authenticated (Contributor+) Stored Cross-Site Scripting
• Template Kit – Import <= 1.0.16 - Authenticated (Editor+) Arbitrary File Deletion
• AcyMailing <= 11.1.0 - Unauthenticated Stored Cross-Site Scripting via 'customField[]' Parameter
• Evergreen Content Poster – Auto Post and Schedule Your Best Content to Social Media <= 1.4.4 - Missing Authorization to Unauthenticated Arbitrary Post Deletion
• BuddyPress Builder for Elementor – BuddyBuilder <= 1.7.4 - Authenticated (Contributor+) Post Disclosure
• Jotform Online Forms <= 1.3.1 - Authenticated(Contributor+) Stored Cross-Site Scripting via Shortcode
• Countdown, Coming Soon, Maintenance – Countdown & Clock <= 2.8.9.1 - Unauthenticated Limited Local File Inclusion
• Line Agency <= 1.3.1 - Unauthenticated Local File Inclusion
• Formidable Forms <= 6.11.1 - Authenticated (Subscriber+) Stored Cross-Site Scripting
• CSprite <= 1.1 - Cross-Site Request Forgery
• Elementor Website Builder <= 3.1.3 - Authenticated (Contributor+) Stored Cross-Site Scripting via title_size
• CMC MIGRATE <= 0.0.3 - Reflected Cross-Site Scripting
• VK Blocks <= 1.57.0.5 - Authenticated(Contributor+) Settings Update
• Master Addons for Elementor <= 2.0.9.9.3 - Authenticated (Contributor+) Stored Cross-Site Scripting
• Appointment Calendar <= 2.7.4 - Multiple Reflected Cross-Site Scripting
• eCommerce Product Catalog <= 3.4.3 - Authenticated (Orders manager+) PHP Object Injection
• RT-Theme 18 | Extensions <= 2.4 - Unauthenticated Local File Inclusion
• ARI-Adminer <= 1.1.14 - Missing Authorization and No Direct File Access Restrictions
• MP3-jPlayer <= 2.4.2 - Full Path Disclosure
• Connections Business Directory <= 10.4.66 - Authenticated (Admin+) Arbitrary Directory Deletion
• Batch Cat <= 0.3 - Missing Authorization
• Tripadvisor Shortcode <= 2.2 - Authenticated (Administrator+) Stored Cross-Site Scripting
• HTML5 Video Player – mp4 Video Player Plugin and Block <= 2.5.35 - Authenticated (Contributor+) DOM-Based Stored Cross-Site Scripting via heading Parameter
• Custom Searchable Data Entry System <= 1.7.1 - SQL Injection
• Easy Media Download <= 1.1.4 - Stored Cross-Site Scripting
• SetSail - Travel Agency WordPress Theme <= 2.1 - Authenticated (Contributor+) Local File Inclusion
• PlayerJS <= 2.23 - Authenticated (Contributor+) Stored Cross-Site Scripting
• Clik stats <= 0.8 - Reflected Cross-Site Scripting via $_SERVER['PHP_SELF']
• Image Gallery Box by CRUDLab <= 1.0.3 - Authenticated (Subscriber+) Local File Inclusion
• Contact Form Email <= 1.3.60 - Unauthenticated Insecure Direct Object Reference
• WP Blockade <= 0.9.14 - Reflected Cross-Site Scripting via 'shortcode' Parameter
• Quiz Maker <= 6.6.8.7 - Unauthenticated SQL Injection
• WP SEO Structured Data Schema <= 2.8.1 - Authenticated (Contributor+) Stored Cross-Site Scripting via '_kcseo_ative_tab' Parameter
• Directorist <= 7.0.6.1 - Cross-Site Request Forgery to Arbitrary File Upload
• Institutions Directory <= 1.3.3 - Reflected Cross-Site Scripting
• Slideshow Gallery LITE <= 1.7.6 - Authenticated(Admin+) SQL Injection
• Advanced Order Export For WooCommerce <= 3.3.1 - Reflected Cross-Site Scripting
• FluentSMTP <= 2.0.0 - Authenticated (Admin+) Stored Cross-Site Scripting
• FireBox <= 3.1.10 - Authenticated (Author+) Remote Code Execution to Privilege Escalation
• Broken Link Manager <= 0.6.5 - Reflected Cross-Site Scripting
• Events Calendar for GeoDirectory <= 2.3.25 - Authenticated (Contributor+) PHP Object Injection
• Download Manager <= 3.2.38 - Unauthenticated Brute Force of File Master Key
• miniOrange's Google Authenticator <= 5.5.82 - Missing Authorization
• UsersWP <= 1.2.65 - Authenticated (Subscriber+) Arbitrary File Deletion via File Upload Field
• Educare <= 1.6.1 - Unauthenticated Stored Cross-Site Scripting
• MultiVendorX <= 5.0.9 - Authenticated (Store Owner+) SQL Injection via 'order_by' Parameter
• ARS Affiliate Page Plugin <= 2.0.2 - Reflected Cross-Site Scripting
• SEO Booster <= 7.3.1 - Authenticated (Administrator+) SQL Injection via 'sort_field' Parameter
• Simple Website Logo <= 1.1 - Missing Authorization
• SortTable Post <= 4.2 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode
• Gerencianet Oficial <= 3.1.3 - Unauthenticated Information Exposure
• Widget Options <= 4.0.8 - Missing Authorization to Notice Dismissal
• The Ultimate Video Player For WordPress <= 2.2.2 - Authenticated (Contributor+) Stored Cross-Site Scripting
• Saan World Clock <= 1.8 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode