Vulnerability archive: section 10, page 10

Open a report to review affected versions, available fixes and original sources. Each report covers a specific issue; its presence does not establish whether your website is affected.

• miniOrange OTP Login, Verification and SMS Notifications <= 5.5.8 - Unauthenticated Authentication Bypass via Delay OTP Grace State
• Elementor Website Builder – more than just a page builder <= 4.1.3 - Authenticated (Contributor+) Sensitive Information Exposure
• Customify <= 2.10.4 - Cross-Site Request Forgery to Settings Update
• WordPress Core < 1.5.2 - Remote Code Execution
• WCFM - WooCommerce Multivendor Membership <= 2.11.10 - Insecure Direct Object Reference to Limited Privilege Escalation via User Role Overwrite
• DTracker <= 1.5 - SQL Injection
• WCFM Membership – WooCommerce Memberships for Multivendor Marketplace <= 2.11.8 - Insecure Direct Object Reference to Update Membership Payment
• Wordpress Clicksold IDX Plugin <= 1.90 - Authenticated (Admin+) Stored Cross-Site Scripting
• Bonjour Bar <= 1.0.0 - Authenticated (Administrator+) Stored Cross-Site Scripting
• Review Stars Count For WooCommerce <= 2.0 - Authenticated (Subscriber+) SQL Injection
• MailChimp for WordPress <= 4.0.10 - Reflected Cross-Site Scripting
• MP3 Audio Player – Music Player, Podcast Player & Radio by Sonaar <= 5.8 - Authenticated (Contributor+) Stored Cross-Site Scripting via sonaar_audioplayer Shortcode
• Pinterest Automatic <= 4.14.3 - Unuathenticated Arbitrary Options Update
• Yet Another bol.com - <= 1.4 - Reflected Cross-Site Scripting
• BetterDocs <= 4.5.4 - Unauthenticated Stored Cross-Site Scripting
• Before After Image Comparison – Visual Comparison for Two Images <= 1.1.21 - Unauthenticated Stored Cross-Site Scripting
• Minterpress <= 1.0.5 - Missing Authorization to Authenticated (Subscriber+) Arbitrary Content Deletion
• Cloudflare < 1.3.21 - Cross-Site Scripting
• SupportCandy <= 3.5.3 - Authenticated (Subscriber+) Stored Cross-Site Scripting via 'name' Parameter
• White Label CMS < 1.5.1 - Reflected Cross-Site Scripting
• Autoship Cloud for WooCommerce Subscription Products <= 2.14.3 - Missing Authorization
• MainWP Child Reports <= 2.1.1 - Cross-Site Request Forgery
• MailPoet Newsletters <= 2.7.2 - Reflected Cross-Site Scripting
• Breeze <= 2.2.13 - Missing Authorization
• Tutor LMS Elementor Addons <= 2.1.5 - Missing Authorization
• Pods – Custom Content Types and Fields <= 3.2.8 - Authenticated (Admin+) Stored Cross-Site Scripting
• CATS Job Listings <= 2.0.9 - Authenticated (Contributor+) Stored Cross-Site Scripting
• AI Engine – The Chatbot, AI Framework & MCP for WordPress <= 3.4.9 - Authenticated (Editor+) Privilege Escalation
• DocCheck Login <= 1.1.5 - Unauthorized Post Access
• IP2Location Country Blocker <= 2.26.4 - Ban Bypass
• Chained Quiz <= 1.0.8.2 - Unauthenticated SQL Injection
• Shortcodes Ultimate <= 7.4.2 - Authenticated (Author+) Stored Cross-Site Scripting via Image Title and Slide Link
• Steveas WP Live Chat Shoutbox <= 1.4.2 - Unauthenticated SQL Injection
• LocateAndFilter <= 1.6.14 - Authenticated (Author+) Stored Cross-Site Scripting via SVG File Upload
• FLAP - Business WordPress Theme <= 1.5 - Unauthenticated PHP Object Injection
• Notiqoo – Order Notification & Customer Chat for WooCommerce < 1.4.14 - Missing Authorization to Authenticated (Contributor+) Arbitrary Option Modification
• Mandrill WP <= 1.0.5 - Cross-Site Request Forgery
• Sign-up Sheets <= 2.2.12 - Reflected Cross-Site Scripting
• Post Grid, Slider & Carousel Ultimate – with Shortcode, Gutenberg Block & Elementor Widget <= 1.6.10 - Authenticated (Contributor+) Local File Inclusion
• Themify Builder <= 7.6.2 - Reflected Cross-Site Scripting
• Frontend Admin by DynamiApps <= 3.28.28 - Authenticated (Administrator+) SQL Injection via 'order' Parameter
• Optimole – Optimize Images | Convert WebP & AVIF | CDN & Lazy Load | Image Optimization <= 4.2.6 - Cross-Site Request Forgery via 'optml_replace_file' AJAX Action
• Webpushr <= 4.34.0 - Missing Authorization to Unauthenticated Stored Cross-Site Scripting
• WP Gravity Forms Dynamics CRM <= 1.1.4 - Open Redirect
• Dokan: AI Powered WooCommerce Multivendor Marketplace Solution – Build Your Own Amazon, eBay, Etsy <= 5.0.2 - Authenticated (Customer+) Privilege Escalation
• JetWidgets For Elementor <= 1.0.15 - Authenticated (Contributor+) Stored Cross-Site Scripting via Animated Box Widget
• Ads by datafeedr.com <= 1.2.0 - Authenticated (Contributor+) Stored Cross-Site Scripting
• User Registration & Membership – Free & Paid Memberships, Subscriptions, Content Restriction, User Profile, Custom User Registration & Login Builder <= 5.2.8 - Unauthenticated Information Exposure
• Ajax WooSearch <= 1.0.0 - Unauthenticated SQL Injection
• Quiz And Survey Master <= 11.2.3 - Authenticated (Contributor+) Insecure Direct Object Reference
• Error Log Viewer by BestWebSoft <= 1.1.1 - Cross-Site Request Forgery
• Opal Estate Pro – Property Management and Submission <= 1.7.6 - Authenticated (Contributor+) Stored Cross-Site Scripting
• Atarim <= 5.1.1 - Authenticated (Author+) Arbitrary File Deletion via '_wp_attached_file' Meta
• 评论小秘书 <= 1.3.2 - Reflected Cross-Site Scripting via $_SERVER['PHP_SELF']
• ReviewX <= 1.6.7 - Unauthenticated CSV Injection
• WP Page Numbers <= 0.5 - Cross-Site Request Forgery via wp_page_numbers_settings
• Total Donations <= 2.0.5 - Unauthenticated SQL Injection
• Popularis Extra <= 1.2.10 - Cross-Site Request Forgery
• Ninja Forms - Scheduled Exports <= 3.0.3 - Authenticated (Subscriber+) Stored Cross-Site Scripting via REST API Parameters
• SendPulse Email Marketing Newsletter <= 2.1.6 - Authenticated (Contributor+) Stored Cross-Site Scripting
• Portfolio Gallery <= 1.5.7 - Reflected Cross-Site Scripting
• Five Star Restaurant Reservations <= 2.7.8 - Cross-Site Request Forgery
• LWS Optimize <= 1.9.1 - Cross-Site Request Forgery
• Disabler <= 3.0.3 - Cross-Site Request Forgery
• Elementor Website Builder – more than just a page builder <= 4.1.0 - Missing Authorization
• The Holiday Calendar < 1.11.3 - Cross-Site Scripting
• Events Manager <= 7.3.6 - Unauthenticated SQL Injection
• Wanium <= 1.9.8 - Unauthenticated Local File Inclusion
• iATS Online Forms <= 1.2 - Authenticated (Contributor+) SQL Injection via order Parameter
• podPress <= 8.8.10.17 - Cross-Site Scripting via playerID
• WP Travel Engine – Tour Booking Plugin – Tour Operator Software <= 6.6.7 - Unauthenticated Local File Inclusion
• Ultimate Blocks <= 3.2.1 - Authenticated (Contributor+) Stored Cross-Site Scripting
• MyBookTable Bookstore <= 3.5.3 - Cross-Site Request Forgery
• LA-Studio Element Kit for Elementor <= 1.4.9 - Authenticated (Contributor+) Stored Cross-Site Scripting via Table of Contents Widget
• WP Crontrol < 1.3 - Reflected Cross-Site Scripting
• Address Autocomplete Using Google Place Api <= 1.0.0 - Cross-Site Request Forgery
• Widget4Call <= 1.0.7 - Reflected Cross-Site Scripting
• Hostme v2 <= 7.0 - Unauthenticated Arbitrary File Deletion
• Yame | Link In Bio <= 0.9.0 - Unauthenticated Information Exposure
• TI WooCommerce Wishlist <= 2.10.0 - Authenticated (Contributor+) Stored Cross-Site Scripting
• Masteriyo LMS – LMS Course Builder, Quizzes & Certificates <= 3.4.0 - Missing Authorization
• My Custom Widgets <= 2.0.5 - Reflected Cross-Site Scripting
• Ultimate Classified Listings <= 1.7 - Missing Authorization to Authenticated (Subscriber+) Plugin Settings Update
• ShopWP <= 2.0.4 - Missing Authorization to Stored Cross-Site Scripting
• Trending/Popular Post Slider and Widget <= 1.5.7 - Cross-Site Request Forgery via wtpsw_post_view_count
• wpDataTables (Premium) <= 3.4.1 - Improper Access Control leading to Table Permission Takeover
• TagDiv Composer <= 5.3 - Unauthenticated Arbitrary PHP Object Instantiation
• Powerlift < 3.2.1 - Unauthenticated Local File Inclusion
• AFFI – Affiliate Marketing for WooCommerce <= 1.0.9 - Missing Authorization
• Uploading SVG, WEBP and ICO files <= 1.0.1 - Authenticated Stored Cross-Site Scripting
• WP Recipe Maker <= 9.1.0 - Reflected Cross-Site Scripting via Referer
• Classified Listing <= 5.4.2 - Missing Authorization to Authenticated (Subscriber+) Feature Modification via Multiple AJAX Handlers ('listingId'/'id' Parameters)
• Tickera <= 3.5.5.2 - Missing Authorization
• PDF-Rechnungsverwaltung <= 0.0.1 - Unauthenticated Local File Inclusion
• Fatal Error Notify <= 1.5.2 - Missing Authorization to Test Error Email Sending
• MW WP Form <= 4.4.5 - Missing Authorization
• Modern Events Calendar Lite <= 5.1.6 - Missing Authorization to Stored Cross-Site Scripting and Settings Update
• Fermentio — Brewery and Winemaking Restaurant WordPress Theme <= 1.5.0 - Unauthenticated Local File Inclusion
• Premmerce Dev Tools <= 2.0 - Missing Authorization to Authenticated (Subscriber+) Remote Code Execution via Plugin Creation
• WP Docs <= 2.1.3 - Reflected Cross-Site Scripting