Vulnerability archive: section 10, page 25

Open a report to review affected versions, available fixes and original sources. Each report covers a specific issue; its presence does not establish whether your website is affected.

• ChaosTheory <= 1.3 - Authenticated (Subscriber+) Stored Cross-Site Scripting
• MapSVG <= 8.5.31 - Authenticated (Contributor+) Stored Cross-Site Scripting
• WPForms Pro <= 1.10.1.1 - Unauthenticated Arbitrary File Write via Chunked Upload Init/Finalize Ordering
• Forminator Forms – Contact Form, Payment Form & Custom Form Builder <= 1.45.0 - Authenticated (Administrator+) SQL Injection via `order_by` Parameter
• Custom 404 Pro <= 3.10.0 - Unauthenticated Stored Cross-Site Scripting via logging
• WordPress Logging Service <= 1.5.4 - Cross-Site Request Forgery to Stored Cross-Site Scripting
• TableOn – WordPress Posts Table Filterable <= 1.0.4.4 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'class' Shortcode Attribute
• Welcart e-Commerce < 1.8.3 - Object Injection
• WPZOOM Addons for Elementor – Starter Templates & Widgets <= 1.3.4 - Unauthenticated Reflected Cross-Site Scripting via 'title_tag' Parameter
• Easy Digital Downloads – Recurring Payments <= 2.3 - Cross-Site Scripting
• Easy Email Subscription <= 1.3 - Authenticated (Admin+) SQL Injection via uid
• Premium Addons for Elementor <= 4.10.52 - Authenticated (Contributor+) Stored Cross-Site Scripting via Media Grid Widget
• Simple Job Board <= 2.4.4 - Reflected Cross-Site Scripting
• BuddyBoss Theme <= 2.4.61 - Cross-Site Request Forgery
• KiotViet Sync <= 1.8.5 - Unauthenticated Webhook Key Exposure
• Unlimited Elements For Elementor (Free Widgets, Addons, Templates) <= 1.5.93 - Reflected Cross-Site Scripting
• Login with phone number <= 1.7.26 - Authentication Bypass due to Missing Empty Value Check
• Newsletter <= 8.3.4 - Unauthenticated Stored Cross-Site Scripting via np1
• Eventin <= 4.0.7 - Authenticated (Contributor+) Local File Inclusion
• EmbedPress <= 3.8.2 - Missing Authorization to Authenticated (Subscriber+) Plugin Settings Delete via admin_post_remove and remove_private_data
• Chained Quiz <= 1.3.2.8 - Missing Authorization
• WooLentor – WooCommerce Elementor Addons + Builder <= 1.8.5 - Authenticated Stored Cross-Site Scripting
• Google Map Shortcode <= 3.1.2 - Authenticated(Contributor+) Stored Cross-Site Scripting via shortcode
• Request a Quote <= 2.3.4 - Stored Cross-Site Scripting
• WP-Recall – Registration, Profile, Commerce & More <= 16.26.10 - Authenticated (Contributor+) Protected Post Disclosure
• Mail Subscribe List <= 2.1.6 - Stored Cross-Site Scripting
• Advanced Cron Manager <= 2.4.1 - Subscriber+ Arbitrary Events/Schedules Creation/Deletion
• Private Content <= 8.11.5 - Missing Authorization
• Count Per Day <= 3.1.1 - Cross-Site Scripting
• YayMail <= 4.3.2 - Missing Authorization to Authenticated (Shop Manager+) Arbitrary Options Update via 'yaymail_import_state' AJAX Action
• Folders <= 3.0 and Folders Pro <= 3.0.2 - Directory Traversal via handle_folders_file_upload
• Savyour Affiliate Partner <= 2.1.4 - Cross-Site Request Forgery to Stored Cross-Site Scripting
• Altra Side Menu <= 2.0 - Authenticated (Admin+) SQL Injection
• Prostore < 1.1.3 - Open Redirect
• WooCommerce < 10.5.3 - Cross-Site Request Forgery
• Video Share VOD – Turnkey Video Site Builder Script <= 2.7.6 - Cross-Site Request Forgery to Command Injection
• YayExtra <= 1.5.5 - Authenticated (Administrator+) SQL Injection
• WPML <= 4.5.13 - Cross-Site Request Forgery
• Next Page <= 1.5.2 - Authenticated (Administrator+) Stored Cross-Site Scripting via settings
• banner-manager <= 16.04.19 - Cross-Site Request Forgery to Stored Cross-Site Scripting
• URL Shortener | Conversion Tracking | AB Testing | WooCommerce <= 9.0.2 - Cross-Site Request Forgery
• VK All in One Expansion Unit <= 9.88.1.0 - Stored (Contributor+) Cross-Site Scripting in CTA Post
• Multi Rating <= 5.0.6 - Cross-Site Request Forgery to Arbitrary Ratings Value Change
• WP Maintenance Mode <= 2.0.6 - Remote Code Execution
• Calendar <= 1.3.17 - Authenticated (Contributor+) Stored Cross-Site Scripting
• Smart Agenda <= 4.7 - Cross-Site Request Forgery to Stored Cross-Site Scripting
• Albo Pretorio Online <= 4.6 - Reflected Cross-Site Scripting via 'Errore'
• Frame <= 2.4.0 - Unauthenticated Local File Inclusion
• Payment Page | Payment Form for Stripe <= 1.4.6 - Authenticated (Author+) Stored Cross-Site Scripting via 'pricing_plan_select_text_font_family' Parameter
• Sports Rankings and Lists <= 1.0.2 - Unauthenticated Arbitrary File Download
• Library Management System <= 3.5.7 - Unauthenticated SQL Injection
• Movie Database <= 1.0.11 - Authenticated (Admin+) Stored Cross-Site Scripting
• Ibtana – WordPress Website Builder <= 1.2.2 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode
• InFunding – Plugin for Charity & Crowdfunding Website <= 1.0 - Reflected Cross-Site Scripting
• Interactive UK Regional Map <= 2.0 - Cross-Site Request Forgery
• HTML Forms – Simple WordPress Forms Plugin <= 1.6.0 - Unauthenticated Stored Cross-Site Scripting
• Integration for Contact Form 7 and Zoho CRM, Bigin <= 1.1.7 - Cross-Site Scripting
• avalex – Automatisch sichere Rechtstexte <= 3.1.3 - Missing Authorization
• Demo Importer Plus <= 2.0.8 - Missing Authorization to Authenticated (Subscriber+) Site Reset and Privilege Escalation
• WordPress Core <= 2.0.1 - Cross-Site Scripting
• Gallagher Website Design <= 2.6.4 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'prefix' Shortcode Attribute
• Quick Contact Form <= 8.0.3.1 - Authenticated (Admin+) Stored Cross Site Scripting
• News Wall <= 1.1.0 - Cross-Site Request Forgery to Plugin Settings Update
• AI Search Bar <= 2.1 - Unauthenticated Stored Cross-Site Scripting
• AR for WordPress <= 7.3 - Missing Authorization to Unauthenticated Limited File Upload
• WS Form LITE – Drag & Drop Contact Form Builder for WordPress <= 1.9.244 - Reflected Cross-Site Scripting via URL
• Youzify <= 1.2.5 - Authenticated (Contributor+) SQL Injection
• Forminator <= 1.29.0 - Unauthenticated Stored Cross-Site Scripting via File Upload
• Print My Blog – Print, PDF, & eBook Converter WordPress Plugin <= 3.4.1 - Cross-Site Request Forgery
• WooCommerce Bulk Product Editor <= 3.0 - Missing Authorization
• Email Before Download <= 6.7 - Admin+ SQL Injection
• Laurits <= 1.5.1 - Unauthenticated PHP Object Injection
• Chartify <= 2.0.6 - Authenticated(Administrator+) Stored Cross-Site Scripting
• Tutor LMS <= 3.9.7 - Missing Authorization to Authenticated (Subscriber+) Unauthorized Private Course Enrollment
• xSmart <= 1.2.9.4 - Authenticated (Subscriber+) Arbitrary Shortcode Execution
• HeartThis <= 0.1.0 - Authenticated (Contributor+) Stored Cross-Site Scripting
• CM Download Manager <= 2.0.6 - Cross-Site Request Forgery to Cross-Site Scripting
• Orbit Fox by ThemeIsle <= 2.10.32 - Authenticated (Contributor+) Stored Cross-Site Scripiting via Registration Form Widget
• 2Checkout Add-on for iThemes Exchange < 1.1.0 - Reflected Cross-Site Scripting
• ELEX WordPress HelpDesk & Customer Ticketing System <= 3.3.2 - Authenticated (Contributor+) Privilege Escalation via eh_crm_edit_agent AJAX Action
• Related Posts < 2.7.2 - Cross-Site Request Forgery
• All in One Slider <= 1.1 - Reflected Cross-Site Scripting
• SMTP for Amazon SES – YaySMTP <= 1.8 - Unauthenticated Stored Cross-Site Scripting via Email Logs
• Events Calendar Made Simple – Pie Calendar <= 1.2.5 - Authenticated (Contributor+) Stored Cross-Site Scripting via piecal Shortcode
• Seraphinite Bulk Discounts for WooCommerce <= 2.4.6 - Reflected Cross-Site Scripting
• Fast Courier <= 5.2.3 - Missing Authorization
• Blog2Social: Social Media Auto Post & Scheduler <= 7.2.0 - Reflected Cross-Site Scripting
• Digi Store <= 1.1.4 - Authenticated (Contributor+) Stored Cross-Site Scripting
• Simple Banner <= 3.0.3 - Authenticated (Administrator+) Stored Cross-Site Scripting
• WordPress Core 4.7.0 - 7.1.2 - Authenticated (Contributor+) Stored Cross-Site Scripting via Imgur oEmbed
• Pagelines Theme < 1.4.6 - Missing Authorization
• Welcome Software Publishing <= 0.0.31 - Authenticated (Subscriber+) Arbitrary Options Update to Privilege Escalation via 'nc.setOption' XML-RPC Method
• OpenSheetMusicDisplay <= 1.4.0 - Authenticated (Contributor+) Stored Cross-Site Scripting via className Parameter
• InteractiveCalculator for WordPress <= 1.0.3 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'id' Shortcode Attribute
• Divi <= 4.25.1 - Authenticated (Contributor+) Stored Cross-Site Scripting
• WP Responsive Tabs horizontal vertical and accordion Tabs <= 1.1.15 - Reflected Cross-Site Scripting
• ImageRecycle pdf & image compression <= 3.1.13 - Cross-Site Request Forgery to Settings Update in enableOptimization
• Stylish Cost Calculator <= 8.1.5 - Authenticated (Contributor+) Stored Cross-Site Scripting
• Bold Page Builder <= 4.8.8 - Authenticated (Contributor+) Stored Cross-Site Scripting via AI Features
• Throws SPAM Away <= 3.8.2 - Unauthenticated SQL Injection