Vulnerability archive: section 10, page 17

Open a report to review affected versions, available fixes and original sources. Each report covers a specific issue; its presence does not establish whether your website is affected.

• Custom Banners < 2.1 - Cross-Site Scripting
• Team Builder For WPBakery Page Builder(Formerly Visual Composer) <= 1.0 - Authenticated (Contributor+) Local File Inclusion
• FlashMart <= 2.0.15 - Unauthenticated Local File Inclusion
• Polylang <= 3.8.7 - Authenticated (Contributor+) Information Exposure
• Vitepos <= 3.1.4 - Missing Authorization
• ProfileGrid <= 5.8.9 - Authenticated (Subscriber+) Insecure Direct Object Reference
• Page Builder: Live Composer <= 1.5.22 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode
• Video List Manager <= 1.7 - Unauthenticated SQL Injection
• AAWEP Obfuscator <= 1.0 - Authenticated (Author+) Stored Cross-Site Scripting
• JS Help Desk – AI-Powered Support & Ticketing System <= 4.0.0 - Authenticated (Subscriber+) Insecure Direct Object Reference
• Simple Balance <= 2.2 - Cross-Site Scripting
• FastDup – Fastest WordPress Migration & Duplicator <= 2.7.2 - Unauthenticated Path Traversal
• WooCommerce Checkout Field Editor (Checkout Manager) <= 2.1.8 - Cross-Site Request Forgery
• EasyRecipe <= 3.5.3251 - Cross-Site Request Forgery
• Travel Engine <= 6.8.4 - Insecure Direct Object Reference to Unauthenticated Booking Details Disclosure and Modification
• Collapsing Categories <= 3.0.9 - Authenticated (Contributor+) SQL Injection
• User Registration & Membership – Custom Registration Form, Login Form, and User Profile <= 4.0.4 - Reflected Cross-Site Scripting
• Various Plugins <= Various Version - Use of Polyfill.io
• RestroPress <= 3.2.3.5 - Missing Authorization
• TabGarb Pro <= 2.6 - Cross-Site Request Forgery to Stored Cross-Site Scripting
• BuddyForms <= 2.8.17 - Authenticated (Contributor+) Local File Inclusion
• pdf.js < 2.0.943 - Authenticated (Author+) Stored Cross-Site Scripting
• Featured Image from URL (FIFU) <= 5.3.3 - Authenticated (Contributor+) Stored Cross-site Scripting
• BP Member Type Manager <= 1.01 - Reflected Cross-Site Scripting
• Super Store Finder <= 6.9.7 - Authenticated (Subscriber+) SQL Injection
• Simple User Capabilities <= 1.0 - Missing Authorization to Unauthenticated Capability Reset
• AMP WP <= 1.5.15 - Cross-Site Request Forgery via multiple settings pages
• Magic Post Thumbnail <= 5.2.9 - Reflected Cross-Site Scripting
• ERP: Complete HR, Accounting & CRM Suite Built for WooCommerce <= 1.17.8 - Unauthenticated Arbitrary File Upload via CRM Email Connect IMAP Attachment
• Lead Form Builder & Contact Form <= 2.0.1 - Unauthenticated Stored Cross-Site Scripting
• Theme Demo Import <= 1.1.3 - Authenticated (Admin+) Arbitrary File Upload
• TM Islamic Helper <= 1.0.1 - Reflected Cross-Site Scripting
• Kama Click Counter <= 4.0.4 - Authenticated (Contributor+) Stored Cross-Site Scripting
• User Access Manager <= 2.3.18 - Reflected Cross-Site Scripting via 'tab_group_section' Parameter
• SEO Booster <= 7.3.1 - Authenticated (Administrator+) SQL Injection via 'orderby' Parameter
• CMS für Motorrad Werkstätten <= 1.0.0 - Cross-Site Request Forgery
• Simple Link Directory Pro < 14.8.1 - Missing Authorization
• The Events Calendar <= 6.2.8.2 - Unauthenticated Sensitive Information Exposure
• Hydra Booking <= 1.2.1 - Authenticated (Hydra Host+) Insecure Direct Object Reference
• Zendesk Chat < 1.2.6 - Cross-Site Scripting
• Motta Addons < 1.6.1 - Reflected Cross-Site Scripting
• Geo Mashup <= 1.13.16 - Unauthenticated Local File Inclusion
• Booking.com Banner Creator <= 1.4.2 - Cross-Site Scripting
• Admin Menu Editor <= 1.0.4 - Reflected Cross-Site Scripting
• Bookly <= 21.7 - Authenticated (Admin+) Stored Cross-Site Scripting
• Ronneby Theme Core <= 1.5.68 - Authenticated (Contributor+) Stored Cross-Site Scripting
• Inline Click To Tweet <= 1.0.0 - Authenticated (Contributor+) Stored Cross-Site Scripting
• No Follow All External Links 2.1.0 - 2.3.0 - Backdoor
• Hanani <= 1.2.11 - Unauthenticated Local File Inclusion
• LatePoint <= 5.1.94 - Unauthenticated Authentication Bypass via load_step Function
• WOW Styler for CF7 – Visual Styler for Contact Form 7 Forms <= 1.7.6 - Missing Authorization
• Meta Box AIO <= 3.11.0 And Standalone Plugin Extensions - Unauthenticated Privilege Escalation to Administrator to 'rwmb_frontend_field_object_id' Parameter
• VidShop – Shoppable Videos for WooCommerce <= 1.1.4 - Unauthenticated Time-Based SQL Injection via 'fields'
• Infility Global < 2.15.20 - Authenticated (Editor+) SQL Injection
• Retain Live Chat <= 0.1 - Authenticated (Administrator+) Stored Cross-Site Scripting
• Author Avatars List/Block <= 2.1.23 - Authenticated (Contributor+) Stored Cross-Site Scripting
• Horizontal Line Shortcode <= 1.0 - Authenticated (Contributor+) Stored Cross-Site Scripting
• Goodlayers Core <= 2.0.9 - Authenticated (Contributor+) Stored Cross-Site Scripting
• Contact Form 7 – PayPal & Stripe Add-on <= 2.5.1 - Missing Authorization
• Search Atlas SEO – Premier SEO Plugin for One-Click WP Publishing & Integrated AI Optimization 2.4.4 - 2.5.15 - Missing Authorization to Authenticated (Subscriber+) Authentication Bypass via Account Takeover
• GPTranslate – Multilingual AI Translation Agent for WordPress: Translate Your Site with AI < 2.34.14 - Unauthenticated Stored Cross-Site Scripting
• Debugger & Troubleshooter <= 1.3.2 - Unauthenticated Privilege Escalation to Administrator via Cookie Manipulation
• Tainacan <= 1.0.3 - Unauthenticated SQL Injection via 'geoquery' REST API Parameter
• Nelio Content – Editorial Calendar & Social Media Auto-Posting <= 4.3.4 - Missing Authorization
• Solar Energy <= 3.5 - Authenticated (Subscriber+) PHP Object Injection
• Slider Pro <= 1.0.0 - Unauthenticated Information Exposure
• WP SHAPES <= 1.0.0 - Authenticated (Author+) Stored Cross-Site Scripting via SVG File Upload
• Easy Accordion <= 2.0.21 - Authenticated Stored Cross-Site Scripting
• MainWP File Uploader Extension <= 4.1 - Unauthenticated Arbitrary File Upload
• SQL Chart Builder <= 3.0.6 - Authenticated (Subscriber+) Stored Cross-Site Scripting via SQL Chart Label (X-axis) via Stored User Field
• PDF Viewer for Elementor <= 2.9.3 - Authenticated (Contributor+) Stored Cross-Site Scripting
• The Events Calendar <= 6.17.3 - Unauthenticated Code Injection to Remote Code Execution via Widget 'classes' Map Callable Invocation
• WebToffee WooCommerce PDF Invoices, Packing Slips, Delivery Notes & Shipping Labels <= 5.0.2 - Insecure Direct Object Reference to Unauthenticated Unauthorized Order Document Access via 'email' Parameter
• Custom Layouts – Post + Product grids made easy <= 1.4.11 - Authenticated (Contributor+) Stored Cross-Site Scripting
• IP Blacklist Cloud <= 3.42 - Authenticated (Admin+) Path Traversal
• Worker for WPBakery <= 1.1.1 - Missing Authorization
• jQuery Dropdown Menu <= 3.0 - Cross-Site Request Forgery to Stored Cross-Site Scripting
• Extensions For CF7 <= 2.0.8 - Cross-Site Request Forgery
• Meta Box <= 5.11.1 - Authenticated (Contributor+) Arbitrary File Deletion
• WordPress Core < 6.0.3 - Authenticated (Editor+) Stored Cross-Site Scripting via Comments
• Pinpoint Booking System <= 2.9.9.5.1 - Authenticated (Subscriber+) SQL Injection
• WP Brutal AI < 2.0.1 - Reflected Cross-Site Scripting
• Image Gallery - Responsive Photo Gallery <= 1.9.57 - Cross-Site Request Forgery
• AliExpress Dropshipping with AliNext Lite <= 3.3.6 - Missing Authorization via Several Functions
• Zephyr Project Manager <= 3.3.99 - Unauthenticated Information Exposure
• Ninja Forms <= 3.5.7 - Unprotected REST-API to Email Injection
• WP Quiz <= 2.0.10 - Authenticated (Contributor+) Stored Cross-Site Scripting
• Free WooCommerce Theme 99fy Extension <= 1.2.8 - Authenticated (Contributor+) Stored Cross-Site Scripting
• Debug Log Manager <= 2.2.1 - Missing Authorization
• Product Filter for WooCommerce by WBW <= 3.4.2 - Reflected Cross-Site Scripting via 'wpf_fid' Parameter
• SpaLab | Beauty Salon WordPress <= 6.7 - Unauthenticated Stored Cross-Site Scripting
• Master Addons For Elementor <= 2.1.1 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'ma_el_bh_table_btn_text'
• EventPrime – Events Calendar, Bookings and Tickets <= 3.4.2 - Missing Authorization to Authenticated (Subscriber+) Attendee List Retrieval
• Ali2Woo Lite <= 3.4.4 - Cross-Site Request Forgery to PHP Object Injection
• CAPTCHA 4WP <= 7.0.6.1 - Cross-Site Request Forgery to Local File Inclusion
• Really Simple CSV Importer <= 1.3 - Authenticated (Admin+) Arbitrary File Upload
• Google Forms <= 0.93 - Remote Code Execution
• WP e-Commerce Style Email <= 0.6.2 - Reflected Cross-Site Scripting
• LJ comments import: reloaded <= 0.97.1 - Reflected Cross-Site Scripting via PHP_SELF Parameter
• Easy Digital Downloads – Sell Digital Files & Subscriptions (eCommerce Store + Payments Made Easy) <= 3.2.9 - Sensitive Information Exposure