Vulnerability archive: section 10, page 12

Open a report to review affected versions, available fixes and original sources. Each report covers a specific issue; its presence does not establish whether your website is affected.

• Social Share And Social Locker <= 1.4.2 - Unauthenticated SQL Injection
• Workreap <= 3.3.1 - Authentication Bypass via 'workreap_verify_user_account'
• LUNA RADIO PLAYER <= 6.24.01.24 - Unauthenticated Arbitrary File Read
• WP Remote Users Sync <= 1.2.11 - Missing Authorization to Authenticated (Subscriber+) Log View
• Graphene <= 2.9.4 - Authenticated (Subscriber+) Stored Cross-Site Scripting via Profile Fields
• Project Status <= 1.6 - Reflected Cross-Site Scripting
• WP Not Login Hide <= 1.0 - Authenticated (Admin+) Stored Cross-Site Scripting
• Listihub <= 1.0.6 - Missing Authorization
• Simple Shortcodes <= 1.0.20 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode
• Geotagged Media <= 0.3.0 - Reflected Cross-Site Scripting
• WP Vegas <= 2.2 - Authenticated (Contributor+) Stored Cross-Site Scripting
• YayMail <= 4.3.2 - Missing Authorization to Authenticated (Shop Manager+) License Key Deletion via '/yaymail-license/v1/license/delete' Endpoint
• LifterLMS – WP LMS for eLearning, Online Courses, & Quizzes <= 10.0.9 - Authenticated (Custom role+) Stored Cross-Site Scripting
• Contact Form 7 with ChatWork <= 1.1.0 - Authenticated (Administrator+) Stored Cross-Site Scripting via 'api_token' and 'roomid' Settings
• Publish Confirm Message <= 1.3.1 - Cross-Site Request Forgery
• Multi Purpose Mail Form <= 1.0.2 - Unauthenticated Arbitrary File Upload
• WP TripAdvisor Review Slider <= 14.1 - Authenticated (Subscriber+) Stored Cross-Site Scripting
• Print Labels with Barcodes. Create price tags, product labels, order labels for WooCommerce <= 4.0.0 - Authenticated (Subscriber+) Information Exposure
• MasterStudy LMS <= 3.6.27 - Authenticated (Instructor+) SQL Injection
• Welcart e-Commerce <= 2.11.20 - Authenticated (Editor+) Stored Cross-Site Scripting
• Subscribe2 <= 10.45 - Reflected Cross-Site Scripting
• Comparison Slider <= 1.0.5 - Missing Authorization
• Hotel Booking <= 3.6 - Authenticated (Contributor+) Local File Inclusion
• Easy Contact Form Solution <= 1.6 - Stored Cross-Site Scripting
• Credova_Financial <= 2.4.8 - Reflected Cross-Site Scripting
• Injection Guard <= 1.2.9 - Unauthenticated Stored Cross-Site Scripting via Query Parameter Name
• WP Fast Total Search <= 1.80.280 - Unauthenticated SQL Injection
• WP VR <= 8.2.8 - Reflected Cross-Site Scripting
• Event Manager, Events Calendar, Tickets, Registrations – Eventin <= 4.0.4 - Missing Authorization to Authenticated (Contributor+) Event Data Import
• WP-Cirrus <= 0.6.11 - Cross-Site Request Forgery
• VG WooCarousel <= 1.3 - Authenticated (Contributor+) Local File Inclusion
• (dp) AddThis <= 1.0.2 - Authenticated (Contributor+) Stored Cross-Site Scripting
• Duplicate Page and Post <= 2.9.5 - Authenticated (Contributor+) SQL Injection via meta_key Parameter
• Slightly troublesome permalink <= 1.2.0 - Authenticated (Administrator+) Stored Cross-Site Scripting
• Chat Bubble <= 2.3 - Authenticated (Administrator+) Stored Cross-Site Scripting
• Tutor LMS <= 4.0.5 - Unauthenticated Remote Code Execution via 'template' and 'data' POST Parameters
• Filter Custom Fields & Taxonomies Light <= 1.05 - Authenticated (Contributor+) PHP Object Injection
• Shopp <= 1.4 - Unauthenticated Arbitrary File Upload
• EmbedPress – Embed PDF, Google Docs, Vimeo, Wistia, Embed YouTube Videos, Audios, Maps & Embed Any Documents in Gutenberg & Elementor <= 3.9.14 - Authenticated (Contributor+) Stored Cross-Site Scripting via Youtube Block
• wpDiscuz <= 7.6.3 - Authenticated(Author+) Insecure Direct Object Reference
• NinjaTeam Chat for Telegram <= 1.0 - Authenticated (Contributor+) Stored Cross-Site Scripting
• Custom Admin Menu <= 1.0.0 - Authenticated (Contributor+) Stored Cross-Site Scripting
• MaxButtons <= 9.8.5 - Reflected Cross-Site Scripting via 'view' Parameter
• Flexi Product Slider and Grid for WooCommerce <= 1.0.5 - Authenticated (Contributor+) Local File Inclusion via 'theme' Shortcode Attribute
• Leblix <= 2.4 - Unauthenticated Local File Inclusion
• WORDPRESS VIDEO GALLERY <= 2.8 - SQL Injection
• WordPress Core < 5.5.2 - Stored Cross-Site Scripting via post slugs
• NextGen Gallery <= 2.1.10 - Unrestricted File Upload
• Easy Digital Downloads – Simple eCommerce for Selling Digital Files <= 2.3.2 - SQL Injection
• HTML Forms <= 1.3.24 - Authenticated (Administrator+) SQL Injection
• Smart SEO Tool – SEO优化插件 <= 4.1.2 - Authenticated (Contributor+) Stored Cross-Site Scripting
• Print Science Designer <= 1.3.155 - Unauthenticated Arbitrary File Download
• News Kit Addons For Elementor <= 1.4.8 - Authenticated (Subscriber+) Stored Cross-Site Scripting via nekit_update_mega_menu_form AJAX Action
• WordPress Spreadsheet (wpSS) <= 0.62 - Cross-Site Scripting
• Pixeline's Email Protector <= 1.3.8 - Authenticated (Admin+) Stored Cross-Site Scripting
• tagDiv Opt-In Builder <= 1.4.4 - Authenticated (Admin+) SQL Injection
• UsersWP <= 1.2.48 - Cross-Site Request Forgery
• WP Google Map Plugin <= 3.1.1 - Cross-Site Scripting
• Multiple sparklewpthemes Themes (Various versions) - Missing Authorization to Arbitrary Plugin Activation
• Premmerce Brands for WooCommerce <= 1.2.13 - Missing Authorization To Authenticated (Subscriber+) Brand Permalink Settings Update
• Slideshow, Image Slider by 2J <= 1.3.54 - Authenticated (Contributor+) Stored Cross-Site Scripting
• YITH WooCommerce Wishlist < 4.13.0 - Unauthenticated Insecure Direct Object Reference to Wishlist Rename
• Perfmatters <= 2.1.6 - Missing Authorization
• DSGVO snippet for Leaflet Map and its Extensions <= 3.1 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'unset' Attribute
• Skip to Timestamp <= 1.4.4 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode
• WP-Lister Lite for eBay <= 3.6.3 - Reflected Cross-Site Scripting
• Cost of Goods for WooCommerce <= 3.7.0 - Authenticated (Contributor+) Stored Cross-Site Scripting
• NewsMash <= 1.0.71 - Authenticated (Contributor+) Stored Cross-Site Scripting
• Kirki 6.0.0 - 6.0.6 - Unauthenticated Privilege Escalation via 'handle_forgot_password'
• Sky Addons for Elementor <= 2.5.11 - Authenticated (Contributor+) Stored Cross-Site Scripting
• Easy Image Gallery <= 1.5.4 - Authenticated (Contributor+) Stored Cross-Site Scripting via Gallery Shortcode Post Meta
• PopAd <= 1.0.4 - Authenticated (Admin+) Server-Side Request Forgery
• Feeds for YouTube (YouTube video, channel, and gallery plugin) < 2.6.4 - Missing Authorization
• WP Microblogs <= 0.4.0 - Cross-Site Scripting
• Everest Backup – WordPress Cloud Backup, Migration, Restore & Cloning Plugin <= 2.3.12 - Unauthenticated SQL Injection
• SEO Redirection Plugin – 301 Redirect Manager <= 8.9 - Cross-Site Request Forgery
• Hot Random Image <= 1.9.2 - Path Traversal to Authenticated (Contributor+) Limited Arbitrary Image Access via path Parameter
• Themify – WooCommerce Product Filter <= 1.4.3 - Reflected Cross-Site Scripting
• I Recommend This <= 3.7.2 - Authenticated (Subscriber+) SQL Injection via Shortcode
• Email Template Customizer for WooCommerce <= 1.2.9.1 - Authenticated (Shop manager+) Stored Cross-Site Scripting
• Popup – MailChimp, GetResponse and ActiveCampaign Intergrations <= 3.2.6 - Missing Authorization to Unauthenticated DB Table Truncation
• Facebook for WooCommerce <= 1.9.12 - Cross-Site Request Forgery
• Charitable <= 1.8.10.4 - Authenticated (Custom+) SQL Injection via 's' Search Parameter
• Sounder | Internet Radio & Streaming Elementor Template Kit <= 1.3.11 - Unauthenticated Local File Inclusion
• Advanced iFrame <= 2025.6 - Authenticated (Contributor+) Stored Cross-Site Scripting
• Off Page SEO <= 3.0.3 - Reflected Cross-Site Scripting
• Kriya <= 3.4 - Authenticated (Subscriber+) PHP Object Injection
• Woocommerce Support System <= 1.2.2 - Missing Authorization
• AJAX Login and Registration modal popup + inline form <= 2.24 - Reflected Cross-Site Scripting
• HT Mega <= 2.4.6 - Authenticated (Contributor+) Stored Cross-Site Scripting via titleTag
• MP-Ukagaka <= 1.5.2 - Reflected Cross-Site Scripting
• Leadster <= 1.1.2 - Cross-Site Request Forgery via leadster_script_code_action
• RSVP and Event Management Plugin <= 2.7.14 - Authenticated (Administrator+) SQL Injection
• Blog2Social: Social Media Auto Post & Scheduler <= 8.7.2 - Incorrect Authorization to Authenticated (Subscriber+) Sensitive Information Exposure
• JivoChat Live Chat – WP live chat plugin for WordPress <= 1.3.5.3 - Cross-Site Request Forgery to Cross-Site Scripting
• Appointment Booking Calendar — Simply Schedule Appointments Booking Plugin <= 1.6.6.20 - Cross-Site Request Forgery to Plugin Data Reset
• VK All in One Expansion Unit <= 9.85.0.1 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode
• Counter Box <= 2.0.5 - Cross-Site Request Forgery
• Coming Soon Page, Under Construction & Maintenance Mode by SeedProd <= 6.17.4 - Authenticated (Editor+) Stored Cross-Site Scripting
• WP Smart Editor <= 1.3.3 - Reflected Cross-Site Scripting