Vulnerability archive: section 10, page 22

Open a report to review affected versions, available fixes and original sources. Each report covers a specific issue; its presence does not establish whether your website is affected.

• WP Translitera <= p1.2.5 - Cross-Site Request Forgery
• AJAX Store Locator <= 1.2 - SQL Injection
• ElectroServ | Electrical Repair Service WordPress Theme <= 1.3.2 - Unauthenticated Local File Inclusion
• Google Map Professional <= 1.0 - Reflected Cross-Site Scripting
• Propovoice: All-in-One Client Management System <= 1.7.8 - Authenticated (ndpv_manager+) Privilege Escalation via 'role' Parameter
• Restaurant Menu by MotoPress <= 2.4.7 - Authenticated (Subscriber+) Information Exposure
• Import WP – Export and Import CSV and XML files to WordPress <= 2.14.16 - Authenticated (Admin+) Arbitrary File Read
• User Registration, User Profiles, Login & Membership – ProfilePress (Formerly WP User Avatar) 3.0.0 - 3.1.3 - Unauthenticated Privilege Escalation
• FundEngine – Donation and Crowdfunding Platform <= 1.7.6 - Missing Authorization
• Royal Elementor Addons and Templates <= 1.3.986 - Authenticated (Subscriber+) Private Post Disclosure
• Simple PDF Viewer <= 1.9 - Authenticated (Contributor+) Stored Cross-Site Scripting via googlepdf Shortcode
• Essential Grid <= 3.0.18 - Missing Authorization
• SiteOrigin Widgets Bundle <= 1.61.1 - Authenticated (Contributor+) Stored Cross-Site Scripting via SiteOrigin Blog Widget
• Enhanced Admin Plugin < 1.16 - Reflected Cross-Site Scripting
• WPCafe <= 3.0.19 - Missing Authorization to Unauthenticated Arbitrary Email Notification Flow Read/Create/Update/Delete
• Booking Calendar Contact Form < 1.0.24 - Blind SQL Injection
• Ezoic <= 2.8.8 - Authenticated (Admin+) Stored Cross-Site Scripting
• Sign-up Sheets <= 1.0.13 - Stored Cross-Site Scripting
• LearnPress – WordPress LMS Plugin <= 4.2.6.5 - Authenticated (Contributor+) Stored Cross-Site Scripting via layout_html Parameter
• WP MapIt <= 2.7.1 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode
• Global Gallery <= 9.2.3 - Missing Authorization
• LearnDash LMS <= 4.5.3 - Authenticated (Contributor+) SQL Injection
• Dokan <= 3.7.12 - Authenticated (Vendor+) SQL Injection
• Houzez Theme - Functionality <= 4.1.8 - Authenticated (Contributor+) Local File Inclusion
• Hestia Nginx Cache <= 2.4.0 - Missing Authorization
• Youzify <= 1.3.7 - Authenticated (Subscriber+) Server-Side Request Forgery
• Rotating Tweets (Twitter widget and shortcode) <= 1.9.10 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode
• Salient Core <= 2.0.7 - Authenticated (Contributor+) Local File Inclusion via Shortcode
• HomeSweet - Real Estate WordPress Theme <= 1.4 - Insecure Direct Object Reference
• FOX – Currency Switcher Professional for WooCommerce <= 1.4.1.6 - Missing Authorization to Authenticated (Subscriber+) Stored Cross-Site Scripting
• Void Contact Form 7 Widget For Elementor Page Builder <= 2.4 - Authenticated (Contributor+) Stored Cross-Site Scripting via cf7_redirect_page Attribute
• LetsRecover <= 1.1.0 - Unauthenticated SQL Injection via AJAX action
• RegistrationMagic – Custom Registration Forms, User Registration, Payment, and User Login < 6.0.9.4 - Missing Authorization
• BackupBliss – Backup & Migration with Free Cloud Storage <= 2.1.1 - Unauthenticated Information Exposure
• Ultra Demo Importer <= 1.0.5 - Cross-Site Request Forgery to Remote Code Execution
• Gallery PhotoBlocks <= 1.1.5 - Cross-Site Scripting
• Travel Agency <= 1.5.5 - Missing Authorization
• Optimize Your Campaigns – Google Shopping – Google Ads – Google Adwords <= 3.1 - Information Exposure
• Contact Form Email <= 1.2.65 - Cross-Site Scripting
• CopySafe Web Protection <= 3.15 - Reflected Cross-Site Scripting
• Woocommerce Category Banner Management <= 1.1.0 - Missing Authorization
• WpResidence <= 5.3.2 - Missing Authorization
• RBX Gallery < 3.1 - Arbitrary File Upload
• Modula Image Gallery <= 3.0.1 - Missing Authorization to Unauthenticated Private Gallery Image Disclosure via 'modula_gallery_id' and 'modula_image_id' Parameters
• Elastik Page Builder <= 0.27.4 - Authenticated (Author+) Stored Cross-Site Scripting via SVG File Upload
• Web Directory Free <= 1.7.6 - Unauthenticated SQL Injection
• PowerPress Podcasting plugin by Blubrry <= 11.17.9 - Unauthenticated Information Exposure
• WP Education <= 1.2.6 - Cross-Site Request Forgery to Arbitrary Plugin Activation
• Easy Property Listings <= 3.5.20 - Missing Authorization
• WordPress Core - All Known Versions - Cleartext Storage of wp_signups.activation_key
• Web and WooCommerce Addons for WPBakery Builder <= 1.5 - Authenticated (Contributor+) Stored Cross-Site Scripting
• MX Time Zone Clocks <= 5.1.1 - Authenticated (Contributor+) Stored Cross-Site Scripting
• Developer Tools <= 1.1.3 - Unauthenticated Arbitrary File Upload
• Penci AI SmartContent Creator <= 2.0 - Missing Authorization
• Easy Custom Auto Excerpt <= 2.4.12 - Sensitive Information Exposure
• Duplicator < 1.1.4 - Cross-Site Request Forgery
• SR WP Minify HTML <= 2.1 - Cross-Site Request Forgery to Settings Update
• Tutor LMS <= 3.4.0 - Authenticated (Subscriber+) HTML Injection
• Page Builder: Pagelayer <= 2.0.8 - Authenticated (Contributor+) Stored Cross-Site Scripting via Button Widget Custom Attributes
• Razorpay for WooCommerce <= 4.7.8 - Missing Authentication to Unauthenticated Order Modification
• Post By Email <= 1.0.4b - Unauthenticated Arbitrary File Upload via Email Attachments
• User Activity <= 1.0.1 - IP Address Spoofing
• JetPopup <= 2.0.20.1 - Authenticated (Contributor+) Insecure Direct Object Reference
• ElementInvader Addons for Elementor <= 1.4.3 - Unauthenticated Stored Cross-Site Scripting
• Album Gallery – WordPress Gallery <= 1.6.3 - Authenticated (Editor+) PHP Object Injection via Gallery Meta
• Testimonial < 2.3 - Multiple Vulnerabilities
• Instant VA <= 1.0.1 - Authenticated (Subscriber+) Arbitrary File Deletion
• WP Smart TV <= 2.1.8 - Authenticated (Contributor+) Stored Cross-Site Scripting
• Avada (Fusion) Builder <= 3.12.1 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode
• Stripe Payment Forms by WP Full Pay – Accept Credit Card Payments, Donations & Subscriptions < 8.5.5 - Unauthenticated Insecure Direct Object Reference
• Doneren met Mollie <= 2.10.2 - Unauthenticated Reflected Cross-Site Scripting via search
• Simple Bible Verse via Shortcode <= 1.1 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode
• Chronicle <= 1.0 - Unauthenticated Local File Inclusion
• Woocommerce Custom Checkout Fields Editor With Drag & Drop <= 0.1 - Reflected Cross-Site Scripting via 'tab'
• Section Widget <= 3.3.1 - Unauthenticated Path Traversal
• Elfsight Telegram Chat CC <= 1.1.0 - Missing Authorization to Authenticated (Subscriber+) Stored Cross-Site Scripting
• WP Forum Server <= 1.7.3 - Authenticated (Admin+) Stored Cross-Site Scripting
• SearchPlus <= 1.7.1 - Missing Authorization to Unauthenticated Settings Modification and Deletion via searchplus_save_token & searchplus_reset_token AJAX Actions
• wpDataTables (Premium) <= 6.5.0.1 - Unauthenticated Local File Inclusion
• Business Directory Plugin – Easy Listing & Member Directories for WordPress <= 6.4.26 - Unauthenticated Insecure Direct Object Reference
• Project Honey Pot Spam Trap <= 1.0.1 - Cross-Site Request Forgery to Stored Cross-Site Scripting
• SAHU TikTok Pixel for E-Commerce <= 1.2.2 - Authenticated (Administrator+) Stored Cross-Site Scripting
• PopCash.Net Code Integration Tool <= 1.8 - Missing Authorization
• GeoDirectory <= 2.8.169 - Authenticated (Subscriber+) Arbitrary File Deletion via 'post_type' Parameter via Query-String Bypass in geodir_save_post + geodir_delete_revision
• Survey Maker <= 5.1.8.8 - Authenticated (Administrator+) Stored Cross-Site Scripting
• Prevent Direct Access 2.8.6 - 2.8.8.2 - Incorrect Authorization to Authenticated (Contributor+) Multiple Media Actions
• Formsite | Embed online forms to collect orders, registrations, leads, and surveys <= 1.6 - Authenticated (Contributor+) Stored Cross-Site Scripting
• Import and export users and customers <= 1.14.2.1 - Directory Traversal
• Pinpoint Booking System <= 2.9.9.6.5 - Missing Authorization
• ark-commenteditor <= 2.15.6 - iframe Injection
• Event Manager, Events Calendar, Tickets, Registrations – Eventin <= 4.0.24 - Authenticated (Contributor+) Local File Inclusion
• Use Any Font <= 6.2.0 - Unauthenticated Arbitrary CSS Appending
• Web Invoice <= 2.1.3 - Authenticated SQL Injection
• Product File Upload for WooCommerce <= 2.2.4 - Unauthenticated Arbitrary File Deletion
• Adverts <= 1.4 - Authenticated (Contributor+) Stored Cross-Site Scripting
• ReDi Restaurant Reservation <= 24.0128 - Reflected Cross-Site Scripting
• WPZOOM Addons for Elementor (Templates, Widgets) <= <=1.1.35 - Authenticated (Contributor+) Stored Cross-Site Scripting
• Royal Addons for Elementor – Addons and Templates Kit for Elementor < 1.7.1066 - Authenticated (Administrator+) Remote Code Execution
• Knowledge Base <= 2.3.0 - Authenticated (Contributor+) Stored Cross-Site Scripting
• Block Editor Gallery Slider <= 1.1.1 - Missing Authorization to Authenticated (Subscriber+) Limited Post Meta Update