Vulnerability archive: section 10, page 11

Open a report to review affected versions, available fixes and original sources. Each report covers a specific issue; its presence does not establish whether your website is affected.

• Wp Social <= 1.9.0 - Authenticated (Subscriber+) Information Disclosure
• Woocommerce Custom Profile Picture <= 1.0 - Authenticated (Subscriber+) Arbitrary File Upload
• Instant Popup Builder <= 1.1.7 - Unauthenticated Arbitrary Shortcode Execution via 'token' Parameter
• Ultimate Addons for WPBakery <= 3.16.11 - Cross-Site Scripting
• pCloud WP Backup <= 2.0.3 - Missing Authorization on the 'start_backup' AJAX Method to Authenticated (Subscriber+) Arbitrary File Read
• All in One SEO 4.1.3.1 - 4.1.5.2 - Authenticated SQL Injection
• WP Customer Area <= 8.2.2 - Reflected Cross-Site Scripting
• Author Avatars List/Block <= 2.1.17 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode
• Slideshow, Image Slider by 2J <= 1.3.31 - Authorization Bypass
• FL3R FeelBox <= 8.1 - Unauthenticated SQL Injection
• Product Import Export for WooCommerce <= 2.5.0 - Authenticated (Admin+) PHP Object Injection via form_data Parameter
• Transposh WordPress Translation <= 1.0.7 - Unauthenticated Stored Cross-Site Scripting via 'tp_translation'
• Multiple miniOrange Plugins (Various Version) - Reflected Cross-Site Scripting
• Save as PDF Plugin by Pdfcrowd <= 4.2.1 - Authenticated (Contributor+) Stored Cross-Site Scripting
• Academy LMS Pro <= 3.3.8 - Unauthenticated Sensitive Information Exposure via 'enqueue_social_login_script'
• Realty Portal <= 0.4.1 - Missing Authorization to Authenticated (Subscriber+) Arbitrary Options Update
• Booster for WooCommerce <= 7.1.6 - Authenticated (Contributor+) Stored Cross-Site Scripting
• Order Attachments for WooCommerce <= 2.5.1 - Unauthenticated Sensitive Information Exposure Through Unprotected Directory
• WordPress Core < 2.1.3 - SQL Injection
• Page Builder: KingComposer < 2.9.4 - Stored Cross-Site Scripting
• Post Grid < 2.1.16 - Reflected Cross-Site Scripting
• MasterStudy LMS <= 3.7.49 - Authenticated (Instructor+) Insecure Direct Object Reference
• Message Filter for Contact Form 7 <= 1.6.3.8 - Reflected Cross-Site Scripting
• Elementor Addon Elements <= 1.13.2 - Authenticated (Contributor+) DOM-Based Stored Cross-Site Scripting via 'Text Separator' and 'Image Compare' Widget
• RSVPMaker <= 9.2.6 - Unauthenticated SQL Injection
• Masteriyo LMS – LMS Course Builder, Quizzes & Certificates < 3.4.1 - Authenticated (Custom Role+) Stored Cross-Site Scripting
• iCARRY <= 2.9 - Unauthenticated Information Exposure
• Hotel Booking <= 3.8 - Unauthenticated Stored Cross-Site Scripting
• Primary Addon for Elementor <= 1.6.2 - Authenticated (Contributor+) Post Disclosure
• Social Share, Social Login and Social Comments <= 7.13.51 - Reflected Cross-Site Scripting
• CM On Demand Search And Replace <= 1.5.6 - Missing Authorization
• Formidable Kinetic <= 1.1.01 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode Attributes
• Pagination by BestWebSoft <= 1.2.2 - Authenticated (Administrator+) Stored Cross-Site Scripting
• Single-user-chat <= 0.5 - Authenticated (Subscriber+) Limited Options Update
• Feed Them Social <= 4.0.7 - Cross-Site Request Forgery
• WP eStore <= 8.5.4 - Reflected Cross-Site Scripting via Customer Editing
• My Reading Library <= 1.0 - Unauthenticated PHP Object Injection
• Listingo <= 3.2.5 - Unauthenticated Arbitrary File Upload
• AllWebMenus WordPress Menu Plugin < 1.1.9 - Arbitrary File Upload
• SendPress Newsletters <= 1.23.11.6 - Reflected Cross-Site Scripting
• Blossom Spa <= 1.3.3 - Sensitive Information Exposure
• JS Help Desk <= 3.1.3 - Missing Authorization to Authenticated (Subscriber+) Ticket Reply Modification
• Salon booking system <= 9.9 - Unauthenticated Arbitrary File Deletion
• Wholesale Market for WooCommerce <= 1.0.6 - Unauthenticated Arbitrary File Download
• Exclusive Addons Elementor <= 2.7.9 - Authenticated (Administrator+) Stored Cross-Site Scripting
• Wishlist <= 1.0.44 - Cross-Site Request Forgery
• WPLP Cookie Consent – Cookie Banner & Consent Management for GDPR, CCPA & Google Consent Mode <= 4.4.6 - Unauthenticated Stored Cross-Site Scripting
• RegistrationMagic <= 6.0.7.4 - Missing Authorization to Unauthenticated Arbitrary Settings Modification
• Welcart e-Commerce <= 2.11.31 - Authenticated (Editor+) SQL Injection
• Leaflet Map <= 3.3.0 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode
• Qubely – Advanced Gutenberg Blocks <= 1.8.5 - Insufficient Authorization
• tagDiv Composer <= 5.3 - Reflected Cross-Site Scripting via 'data'
• Simple Basic Contact Form <= 20250114 - Unauthenticated Stored Cross-Site Scripting
• Homerunner <= 1.0.30 - Cross-Site Request Forgery to Settings Update
• XStore <= 9.3.8 - Reflected Cross-Site Scripting
• Share This Image <= 2.03 - Open Redirect via link Parameter
• MAS Companies For WP Job Manager <= 1.0.13 - Reflected Cross-Site Scripting
• Avada (Fusion) Builder < 3.15.0 - Missing Authorization
• ProfilePress <= 4.3.2 - Authenticated (Admin+) PHP Object Injection
• Contact Form Builder Plugin: Multi Step Contact Form, Payment Form, Custom Contact Form Plugin by Bit Form <= 2.10.1 - Unauthenticated Insecure Direct Object Reference to Form Submission Alteration
• Rede Itaú for WooCommerce — Payment PIX, Credit Card and Debit <= 5.1.5 - Missing Authorization to Unauthenticated Rede Order Logs Deletion
• Social Pug: Author Box <= 1.0.0 - Reflected Cross-Site Scripting
• Coming Soon Page by SeedProd <= 5.1.1 - Authenticated Stored Cross-Site Scripting
• Passeum Ticketing <= 1.0 - Authenticated (Administrator+) Stored Cross-Site Scripting via 'shop_name' Setting
• Link Library <= 7.7.2 - Reflected Cross-Site Scripting
• BlockWheels <= 1.0.2 - Authenticated (Contributor+) Stored Cross-Site Scripting
• Photo Gallery by Ays – Responsive Image Gallery < 1.0.1 - SQL Injection
• B2BKing <= 4.6.00 - Missing Authorization to Authenticated(Subscriber+) Price Modification
• AutomatorWP – Automator plugin for no-code automations, webhooks & custom integrations in WordPress <= 5.6.7 - Missing Authorization
• Awesome Event Booking <= 2.7.2 - Missing Authorization
• WPComplete <= 2.9.5.3 - Missing Authorization
• Music Store - WordPress eCommerce <= 1.1.13 - Authenticated (Admin+) SQL Injection
• Cryptocurrency Payment Gateway for WooCommerce <= 2.0.25 - Missing Authorization to Unauthenticated Tracking Status Update
• Master Addons – Free Widgets, Hover Effects, Toggle, Conditions, Animations for Elementor <= 2.0.6.0 - Authenticated (Contributor+) Stored Cross-Site Scripting
• Blog Filter <= 1.7.6 - Authenticated (Contributor+) Stored Cross-Site Scripting
• WP Domain Redirect <= 1.0 - Authenticated (Admin+) SQL Injection
• Pagelayer <= 2.0.9 - Incorrect Authorization to Authenticated (Contributor+) Mail Relay Configuration via 'contacts'
• WP User Frontend <= 4.1.12 - Authenticated (Subscriber+) Arbitrary Shortcode Execution
• WP Responsive Video <= 1.0 - Authenticated (Contributor+) Stored Cross-Site Scripting
• URL Shortener by MyShop <= 1.0.17 - Authenticated (Admin+) Stored Cross-Site Scripting
• Employee, Leave and Recruitment Management System – Crew HRM <= 1.2.2 - Missing Authorization
• JSON Structuring Markup <= 0.1 - Cross-Site Request Forgery to Stored Cross-Site Scripting
• Happy Elementor Addons <= 3.10.0 - Authenticated (Contributor+) Stored Cross-Site Scripting
• Booking Package <= 1.7.29 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'id' Shortcode Attribute
• Attention Bar <= 0.7.2.1 - Authenticated (Contributor+) SQL Injection
• MP3 Audio Player for Music, Radio & Podcast by Sonaar <= 4.10 - Missing Authorization to Template Import
• Logo Slider <= 3.7.0 - Cross-Site Request Forgery
• Image Caption Hover Pro < 20.0 - Missing Authorization
• Newsletter <= 8.7.0 - Authenticated (Admin+) Stored Cross-Site Scripting
• Ultimate WordPress Auction Plugin < 1.0.1 - Cross-Site Request Forgery
• Donations <= 1.8 - Authenticated (Contributor+) Stored Cross-Site Scripting
• Super Store Finder <= 7.5 - Cross-Site Request Forgery
• WordPress Tag Cloud Plugin – Tag Groups <= 2.0.3 - Missing Authorization to Information Exposure
• Mailchimp for WooCommerce <= 2.7.1 - Authenticated (Admin+) Server-Side Request Forgery
• Hash Form <= 1.2.1 - Missing Authorization to Authenticated (Contributor+) Form Style Creation
• Neptunus <= 1.0.11 - Unauthenticated Local File Inclusion
• WP Live Chat Support <= 8.0.05 - Stored Cross-Site Scripting
• MakeCommerce for WooCommerce <= 4.1.0 - Missing Authorization
• Material Design for Contact Form 7 <= 2.6.4 - Missing Authorization to Arbitrary Settings Update
• AnalyticsWP <= 2.1.2 - Unauthenticated SQL Injection