Vulnerability archive: section 10, page 20

Open a report to review affected versions, available fixes and original sources. Each report covers a specific issue; its presence does not establish whether your website is affected.

• Ultimate Blocks – WordPress Blocks Plugin <= 3.0.8 - Authenticated(Contributor+) Stored Cross-Site Scripting via metabox
• Database Backup and check Tables Automated With Scheduler 2024 <= 2.32 - Authenticated (Admin+) Arbitrary File Read
• Marekkis Watermark-Plugin <= 0.9.4 - Cross-Site Scripting
• LoginPress Pro < 3.0 - Captcha Bypass
• Bookit <= 2.6.0.4 - Missing Authorization
• Droit Dark Mode <= 1.1.2 - Cross-Site Request Forgery
• Anubis <= 1.25 - Unauthenticated Local File Inclusion
• Meteor Slides <= 1.5.7 - Authenticated (Contributor+) Stored Cross-Site Scripting
• Booking Package <= 1.5.98 - Authorization Bypass to Arbitrary Password Reset
• WooCommerce GoCardless Gateway <= 2.5.6 - Unauthenticated Insecure Direct Object Reference
• Simple Popup Images <= 1.8.6 - Authenticated (Administrator+) Stored Cross-Site Scripting
• Orbit Fox by ThemeIsle <= 2.10.43 - Authenticated (Contributor+) Stored Cross-Site Scripting via Pricing Table Widget
• Image Optimizer <= 1.7.4 - Authenticated (Author+) Arbitrary File Deletion via Post Meta Field Injection
• WP-Planification <= 2.3.1 - Cross-Site Request Forgery to Stored Cross-Site Scripting
• Quiz And Survey Master <= 8.1.16 - Missing Authorization
• Similarity <= 3.0 - Cross-Site Request Forgery to Plugin Reset
• WP 404 Auto Redirect to Similar Post <= 1.0.4 - Reflected Cross-Site Scripting via Debug Mode URI
• Product Price by Formula for WooCommerce <= 2.5.6 - Missing Authorization
• TranslatePress <= 3.2.6 - Authenticated (Subscriber+) Stored Cross-Site Scripting via Approved Comment Body in Translation Editor
• MotoPress Hotel Booking < 6.0.4 - Authenticated (Subscriber+) Information Exposure
• WP Image Resizer (Unspecified Version) - Cross-Site Scripting
• Profile Builder Pro <= 3.10.0 - Authenticated (Subscriber+) Time-Based One-Time Password Sensitive Information Exposure
• Cookie Notice & Consent <= 1.6.5 - Unauthenticated Stored Cross-Site Scripting
• Event Tickets and Registration <= 5.29.5 - Authenticated (Contributor+) SQL Injection via 'orderby' Parameter
• Seo Monster <= 3.3.3 - Cross-Site Request Forgery to Stored Cross-Site Scripting
• WP Dispatcher <= 1.2.0 - Authenticated (Subscriber+) Arbitrary File Upload
• LiteSpeed Cache <= 5.7 - Unauthenticated Stored Cross-Site Scripting via 'nameservers' and '_msg'
• ScoreMe <= 2016-04-01 - Cross-Site Scripting
• Simple Sticky Footer <= 1.3.5 - Authenticated (Contributor+) Stored Cross-Site Scripting
• Cyklodev WP Notify <= 1.2.1 - Authenticated (Admin+) Stored Cross-Site Scripting
• Media Library Folders <= 8.2.0 - Reflected Cross-Site Scripting via 's'
• Community Events <= 1.5.6 - Missing Authorization to Unauthenticated Arbitrary Event Approval via 'eventlist' Parameter
• Fluent Forms – Customizable Contact Forms, Survey, Quiz, & Conversational Form Builder <= 6.1.21 - Insecure Direct Object Reference in Stripe SCA Confirmation to Unauthenticated Payment Status Modification
• RSS Aggregator by Feedzy <= 4.4.2 - Authenticated(Contributor+) SQL Injection
• TreePress – Easy Family Trees & Ancestor Profiles <= 2.0.22 - Authenticated (Administrator+) Stored Cross-Site Scripting via 'post_title' parameter
• SecuPress Free — WordPress Security <= 2.2.5.1 - Cross-Site Request Forgery to Banned IP Address
• WidgetKit Pro <= 1.13.1 - Reflected Cross-Site Scripting
• Jobmonster <= 4.7.9 - Authentication Bypass
• Paid Membership Subscriptions – Effortless Memberships, Recurring Payments & Content Restriction <= 2.11.1 - Missing Authorization via pms_stripe_connect_handle_authorization_return
• Cooked Pro <= 1.7.5.5 - Reflected Cross-Site Scripting
• Wholesale Suite <= 2.2.6 - Authenticated (Shop Manager) Privilege Escalation
• ProfileGrid – User Profiles, Groups and Communities <= 6.0.0.2 - Cross-Site Request Forgery
• WPvivid Backup and Migration <= 0.9.68 - Missing Authorization
• Ultimate Blocks <= 3.2.9 - Authenticated (Contributor+) Stored Cross-Site Scripting
• Yellow Swordfish Simple Forum <= 1.11 - SQL Injection
• Awesome Support – WordPress HelpDesk & Support Plugin <= 6.1.7 - Missing Authorization via wpas_get_users()
• Login/Signup Popup ( Inline Form + Woocommerce ) <= 2.8.5 - Authenticated (Contributor+) Stored Cross-Site Scripting via xoo_el_action Shortcode
• Quote Tweet <= 0.7 - Cross-Site Request Forgery to Stored Cross-Site Scripting
• Poll Maker <= 3.4 - Authenticated (Subscriber+) Arbitrary File Upload
• Better Delete Revision <= 1.6.1 - Authenticated (Administrator+) Stored Cross-Site Scripting
• ELEX WordPress HelpDesk & Customer Ticketing System <= 3.3.1 - Missing Authorization to Authenticated (Subscriber+) Ticket Restore
• Live Preview for Contact Form 7 <= 1.2.0 - Missing Authorization via update_option
• Logo Slider <= 4.1.0 - Authenticated (Author+) Stored Cross-Site Scripting
• CorvusPay WooCommerce Payment Gateway <= 2.7.4 - Missing Authorization
• Multiple E-plugins (Various Versions) - Authenticated (Subscriber+) Privilege Escalation
• Easy Site Importer <= 1.0.1 - Missing Authorization to Authenticated (Subscriber+) Settings Change
• BSK Forms Blacklist <= 3.9 - Cross-Site Request Forgery
• WP-Polls <= 2.76.0 - Race Condition
• Custom New User Notification <= 1.2.0 - Authenticated (Administrator+) Stored Cross-Site Scripting via 'User Mail Subject' Setting
• WP Wall <= 1.7.3 - Reflected Cross-Site Scripting
• Miraculous Elementor <= 2.0.7 - Authenticated (Subscriber+) Privilege Escalation
• Eazy Plugin Manager <= 4.4.1 - Authenticated (Subscriber+) Privilege Escalation via pos_get_option AJAX Action and admin/login REST Endpoint
• HeartStar <= 1.0.14 - Unauthenticated Local File Inclusion
• Zota <= 1.3.8 - Unauthenticated Local File Inclusion
• Smart Coupons For WooCommerce Coupons < 2.3.0 - Missing Authorization
• Bauernregeln <= 1.0.1 - Reflected Cross-Site Scripting
• Premium Addons for Elementor – AI-Ready Elementor Addons, Widgets & Templates <= 4.11.109 - Authenticated (Contributor+) Stored Cross-Site Scripting
• Okay Toolkit <= 2.3 - Reflected Cross-Site Scripting
• Points and Rewards for WooCommerce <= 1.5.0 - Cross-Site Request Forgery to Settings Change
• Gutenify <= 1.5.7 - Unauthenticated Stored Cross-Site Scripting
• Futurio Extra <= 2.0.14 - Authenticated (Contributor+) Stored Cross-Site Scripting via header_size tag
• Multiple Shipping And Billing Address For Woocommerce <= 1.2 - Unauthenticated SQL Injection
• pTypeConverter <= 0.2.8.1 - Authenticated (Editor+) SQL Injection
• Sunshine Photo Cart <= 3.5.7.1 - Missing Authorization
• SlingBlocks – Gutenberg Blocks by FunnelKit (Formerly WooFunnels) <= 1.6.0 - Authenticated (Contributor+) Stored Cross-Site Scripting
• Add custom page template <= 2.0.1 - Authenticated (Administrator+) PHP Code Injection to Remote Code Execution
• Extra Product Options For WooCommerce | Custom Product Addons and Fields <= 3.3.8 - Authenticated (Shop Manager+) PHP Object Injection
• Arigato Autoresponder and Newsletter <= 2.5.1.8 - Reflected Cross-Site Scripting
• WordPress Core < 4.4.1 - Cross-Site Scripting via Theme Names
• Classic <= 1.5 - Cross-Site Scripting
• Turn Yoast SEO FAQ Block to Accordion <= 1.0.6 - Authenticated (Contributor+) Stored Cross-Site Scripting
• Instabot <= 1.10 - Cross-Site Request Forgery to Stored Cross-Site Scripting
• Pie Register – User Registration, Profiles & Content Restriction < 3.8.4.10 - Missing Authorization
• WP Event Manager <= 3.1.41 - Reflected Cross-Site Scripting via plugin
• Contact Form Email <= 1.3.24 - Authenticated (Admin+) Stored Cross-Site Scripting
• AZ Content Finder <= 0.1 - Reflected Cross-Site Scripting
• Multisite Content Copier/Updater <= 1.4.0 - Reflected Cross-Site Scripting
• WooCommerce Online Product Designer <= 2.14.0 - Unauthenticated Arbitrary File Upload
• Black-Letterhead <= 1.5 - Cross-Site Scripting
• ACPT (Premium) <= 2.0.66 - Unauthenticated Privilege Escalation via 'acpt_form_post_id' Parameter
• ACF to REST API <= 3.3.4 - Unauthenticated Information Exposure
• Order Listener for WooCommerce – Play Sounds Instantly on New Orders <= 3.2.1 - Unauthenticated SQL Injection
• SMSify <= 6.0.4 - Reflected Cross-Site Scripting
• wpDataTables – WordPress Data Table, Dynamic Tables & Table Charts Plugin <= 3.4.2.2 - Reflected Cross-Site Scripting.
• Redirect Redirection <= 1.1.4 - Cross-Site Request Forgery to Plugin De-Installation
• Libro de Reclamaciones y Quejas <= 0.9 - Cross-Site Request Forgery to Stored Cross-Site Scripting
• JetElements <= 2.6.10 - Authenticated (Contributor+) Remote Code Execution
• Uploadify <= 1.0 - Arbitrary File Upload
• Smart App Banner <= 1.1.2 - Cross-Site Request Forgery via wsl_smart_app_banner_options
• Internal Link Juicer <= 2.23.4 - Authenticated (Admin+) Stored Cross-Site Scripting