Vulnerability archive: section 10, page 1

Open a report to review affected versions, available fixes and original sources. Each report covers a specific issue; its presence does not establish whether your website is affected.

• Gravity Forms <= 2.10.5 - Unauthenticated Stored Cross-Site Scripting via Post Body Field Value
• WP Emmet <= 0.3.4 - Authenticated (Administrator+) Stored Cross-Site Scripting
• Responsive Contact Form Builder & Lead Generation Plugin <= 1.9.7 - Authenticated (Admin+) Stored Cross-Site Scripting
• Pinpoint Booking System <= 2.9.9.4.7 - Authenticated (Admin+) Stored Cross-Site Scripting
• Mixed Media Gallery Blocks <= 3.3.3.1 - Authenticated (Author+) Stored Cross-Site Scripting via sliderMaxHeight Block Attribute
• TheNa <= 1.5.5 - Reflected Cross-Site Scripting
• Social LikeBox & Feed <= 2.8.4 - Cross-Site Request Forgery to Cross-Site Scripting
• PPWP – Password Protect Pages <= 1.9.10 - Authenticated (Subscriber+) Content Exposure via REST API
• RentMy Real-Time Rental Management Plugin <= 4.0.4.1 - Missing Authorization to Unauthenticated Settings Update via rentmy_cdn_request AJAX Action
• Essential Addons for Elementor <= 4.6.4 - Authenticated (Contributor+) Privilege Escalation
• Groundhogg <= 2.7.9.8 - Missing Authorization to Admin Account and Ticket Creation
• CF7 Spreadsheets <= 2.3.2 - Authenticated (Subscriber+) Stored Cross-Site Scripting
• Behance Portfolio Manager <= 1.7.5 - Authenticated (Administrator+) SQL Injection
• Article Analytics <= 1.0 - Unauthenticated SQL Injection
• Form Maker by 10Web <= 1.15.48 - Reflected Cross-Site Scripting via 'inputs' Parameter Array Key
• AI Engine 2.8.0 - 2.8.3 - Authenticated (Subscriber+) Insufficient Authorization to Privilege Escalation via MCP
• UiCore Elements <= 1.3.0 - Missing Authorization to Unauthenticated Arbitrary File Read
• Kintpv Wooconnect <= 8.129 - Unauthenticated Stored Cross-Site Scripting
• Popup Maker – Popup for opt-ins, lead gen, & more <= 1.18.2 - Authenticated (Contributor+) Stored Cross-Site Scripting
• Explara Membership <= 0.0.7 - Reflected Cross-Site Scripting
• Happy Addons for Elementor <= 3.10.4 - Authenticated (Contributor+) Stored Cross-Site Scripting via Page Title HTML Tag
• Lytebox <= 1.3 - Local File Inclusion
• TransFinanz <= 1.0.0 - Reflected Cross-Site Scripting
• CMP – Coming Soon & Maintenance <= 4.1.10 - Authenticated (Admin+) Server-Side Request Forgery
• Waitlist Woocommerce ( Back in stock notifier ) <= 2.5.2 - Cross-Site Request Forgery to Settings Reset
• IF AS Shortcode <= 1.2 - Authenticated (Contributor+) Remote Code Execution
• Post Status Notifier Lite and Premium <= 1.11.6 - Reflected Cross-Site Scripting via page
• Portfolio Gallery – Image Gallery Plugin <= 1.5.6 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode
• Yandex Site search pinger <= 1.5 - Authenticated (Administrator+) Stored Cross-Site Scripting
• Logo Carousel Gutenberg Block <= 2.1.6 - Authenticated (Contributor+) Stored Cross-Site Scripting via sliderId Parameter
• Schema & Structured Data for WP & AMP < 1.60 - Unauthenticated Arbitrary Media Upload
• Custom Script Integration <= 2.1 - Cross-Site Request Forgery
• Spectra Pro <= 1.1.4 - Authenticated (Contributor+) Stored Cross-Site Scripting via Block IDs
• User Registration & Membership <= 5.2.8 - Cross-Site Request Forgery to trigger_bulk_action()
• YaySMTP – Simple WP SMTP Mail <= 2.2 - Missing Authorization to Sensitive Information Exposure
• Download Manager <= 3.3.06 - Unauthenticated Information Disclosure via Unprotected Directory
• WPB Show Core <= 2.5 - Reflected Cross-Site Scripting
• WP OAuth Server (OAuth Authentication) <= 4.2.5 - Cross-Site Request Forgery
• Konte <= 2.4.6 - Missing Authorization
• WP Courses LMS – Online Courses Builder, eLearning Courses, Courses Solution, Education Courses <= 3.2.21 - Missing Authorization to Authenticated (Subscriber+) Arbitrary User Meta Update
• Tripetto <= 8.0.11 - Unauthentiated Stored Cross-Site Scripting via Form File Upload
• Droip < 2.5.2 - Missing Authorization to Authenticated (Subscriber+) Arbitrary Settings Change
• Crossword Compiler Puzzles <= 5.2 - Authenticated (Subscriber+) Arbitrary File Upload
• WP Fastest Cache <= 0.8.5.9 - Local File Inclusion
• Jannah - Newspaper Magazine News BuddyPress AMP <= 7.6.4 - Unauthenticated Local File Inclusion
• Tera Charts < 1.0 - Directory Traversal
• ThumbPress – Compress Images, Manage Thumbnails, Detect Image Issues, WebP/AVIF, Lazy Loading, Hotlinking & More <= 6.3.2 - Missing Authorization
• WP Visitor Statistics (Real Time Traffic) <= 4.7 - SQL Injection
• Easy Drag And drop All Import : WP Ultimate CSV Importer < 6.4.1 - Missing Authorization Checks
• Easy Testimonials <= 3.9.2 - Authenticated (Contributor+) Stored Cross-Site Scripting
• WP Image Zoom <= 1.23 - Cross-Site Request Forgery to Denial of Service
• Tripgo < 1.5.6 - Unauthenticated Local File Inclusion
• Smart Flexslider <= 2.5 - Reflected Cross-Site Scripting
• Various Orange themes (Various Unspecified Versions) - Cross-Site Request Forgery to Arbitrary File Upload
• MapSVG <= 8.5.34 - Unauthenticated Arbitrary Shortcode Execution
• Checkout Field Editor <= 1.7.2 - Authenticated (Admin+) PHP Object Injection
• Clever Fox <= 25.2.0 - Authenticated (Contributor+) Stored Cross-Site Scripting
• MWB Point of Sale (POS) for WooCommerce <= 1.0.0 - Missing Authorization
• WHMPress - WHMCS Client Area <= 4.3-revision-3- Authenticated (Subscriber+) Arbitrary Options Update
• DotLife < 4.9.5 - Reflected Cross-Site Scripting
• WP Live Chat Support Pro <= 8.0.26 - Arbitrary File Upload
• WooCommerce Ship to Multiple Addresses <= 3.8.5 - Missing Authorization
• WP Activity Log <= 4.1.4 - SQL Injection
• Post Meta Data Manager <=1.2.0 - Missing Authorization to User, Term, and Post Meta Deletion
• WP Foodbakery <= 4.8 - Reflected Cross-Site Scripting
• Broadstreet <= 1.51.2 - Authenticated (Contributor+) Stored Cross-Site Scripting
• Dynamic Visibility for Elementor <= 5.0.5 - Missing Authorization to Authenticated(Subscriber+) Post Visibility Modification
• Kayon <= 1.3 - Unauthenticated Local File Inclusion
• Simple Archive Generator <= 5.2 - Cross-Site Request Forgery
• GiveWP <= 2.23.2 - Unauthenticated SQL Injection
• AJAX Random Posts <= 0.3.3 - PHP Object Injection
• Block Editor Bootstrap Blocks <= 6.6.1 - Reflected Cross-Site Scripting via tab
• Enable Shortcodes inside Widgets,Comments and Experts <= 1.0.0 - Unauthenticated Arbitrary Shortcode Execution
• Event Tickets and Registration <= 5.8.0 Events Tickets Plus <= 5.9.0 - Authenticated (Contributor+) Information Exposure
• AI Preloader <= 1.0.2 - Authenticated (Administrator+) Stored Cross-Site Scripting
• Chat by Chatwee <= 2.1.3 - Cross-Site Request Forgery to Settings Update
• WordPress Core < 4.5 - Cross-Site Scripting via Network Settings Page
• WordPress Auction Plugin <= 3.7 - Authenticated (Editor+) SQL Injection
• SEO Friendly Images <= 3.0.5 - Authenticated (Contributor+) Stored Cross-Site Scripting
• Super Forms <= 6.3.316 - Authenticated (Subscriber+) Arbitrary File/Directory Deletion via 'subdir' / 'path' Parameter
• WP Directory Kit <= 1.3.0 - Authenticated (Subscriber+) SQL Injection
• Master Addons For Elementor – Widgets, Extensions, Theme Builder, Popup Builder & Template Kits <= 2.1.3 - Authenticated (Author+) Stored Cross-Site Scripting
• Ultra Addons for Contact Form 7 <= 3.5.51 - Authenticated (Editor+) PHP Object Injection
• Beds24 Online Booking <= 2.0.23 - Authenticated(Administrator+) Stored Cross-Site Scripting
• Goods Catalog <= 2.4.1 - Authenticated (Contributor+) Stored Cross-Site Scripting
• TK Google Fonts GDPR Compliant <= 2.2.11 - Missing Authorization to Font Deletion
• Watu Quiz <= 2.5.0.1 - Stored Cross-Site Scripting
• Content Snippet Manager <= 1.1.5 - Cross-Site Request Forgery to Stored Cross-Site Scripting
• wp Hosting Performance Check <= 2.18.8 - Reflected Cross-Site Scripting
• JiangQie Official Website Mini Program < 1.1.1 - SQL Injection
• eCommerce <= 3.15.1 - Unauthenticated PHP Object Injection
• My auctions allegro <= 3.6.20 - Authenticated (Contributor+) SQL Injection
• Logo Changer <= 1.2 - Unauthenticated Stored Cross-Site Scripting
• LearnPress <= 4.3.6 - Missing Authorization to Unauthenticated Sensitive User Information Disclosure
• WPML Multilingual & Multicurrency for WooCommerce <= 5.5.6 - Authenticated (Subscriber+) Stored Cross-Site Scripting
• Smash - Tennis WordPress Theme <= 1.12.0 - Unauthenticated PHP Object Injection
• Download, Downloads – WordPress Download plugin By Edmon <= 1.4.2 - Reflected Cross-Site Scripting
• Pop ups, Exit intent popups, email popups, banners, bars, countdowns and cart savers – Promolayer <= 1.1.0 - Missing Authorization
• DS.DownloadList <= 1.3 - Unauthenticated PHP Object Injection
• Responsive Contact Form Builder & Lead Generation Plugin <= 1.9.7 - Authenticated (Admin+) Stored Cross-Site Scripting