Vulnerability archive: section 10, page 3

Open a report to review affected versions, available fixes and original sources. Each report covers a specific issue; its presence does not establish whether your website is affected.

• Weaver Xtreme Theme Support <= 6.3.0 - Authenticated (Administrator+) PHP Object Injection via Imported File
• Welcart e-Commerce <= 2.11.1 - Authenticated (Admin+) SQL Injection
• WP 2FA – Two-factor authentication for WordPress <= 2.1.0 - Insecure Direct Object Reference
• BadgeOS <= 3.7.1.6 - Cross-Site Request Forgery
• WP Multilang – Translation and Multilingual Plugin <= 2.4.31 - Authenticated (Contributor+) Stored Cross-Site Scripting via Post Content
• DiviGear Carousel <= 5.2.0 - Authenticated (Subscriber+) Stored Cross-Site Scripting via update_license AJAX Action
• RSVPMarker <= 10.6.6 - Unauthenticated SQL Injection
• WP Helper Premium <= 4.2.0 - Reflected Cross-Site Scripting
• Form Builder CP <= 1.2.31 - Authenticated (Administrator+) Stored Cross-Site Scripting
• Page Builder: KingComposer < 2.9.4 - Authorization Bypass due to Improper Access Control
• WP Hardening – Fix Your WordPress Security <= 1.2.1 - Reflected Cross-Site Scripting
• Ultimate AJAX Login <= 1.2.1 - Cross-Site Request Forgery
• WP Bulk Delete <= 1.3.1 - Reflected Cross-Site Scripting
• 3DPrint < 3.5.6.9 - Cross-Site Request Forgery to Arbitrary File Deletion
• WPBot <= 8.5.6 - Missing Authorization to Authenticated (Subscriber+) Arbitrary RAG Document Re-Sync via ajax_rag_manual_sync() Function
• Dealia <= 1.0.9 - Authenticated (Contributor+) Stored Cross-Site Scripting via Gutenberg Block Attributes
• Demo Import Kit <= 1.1.0 - Authenticated (Admin+) Arbitrary File Upload
• Smush Image Compression and Optimization <= 3.17.0 - Authenticated (Admin+) Directory Traversal
• StoreEngine <= 2.1.1 - Authenticated (Vendor+) Arbitrary File Read via Path Traversal in Downloadable File URL
• Essential Addons for Elementor <= 5.8.8 - Authenticated (Contributor+) Privilege Escalation
• Vibes <= 2.2.0 - Unauthenticated SQL Injection via `resource` Parameter
• Photo Gallery by 10Web <= 1.8.40 - Authenticated (Contributor+) SQL Injection via 'order_by' Shortcode Attribute
• MinhNhut Link Gateway <= 3.6.1 - Reflected Cross-Site Scripting via 'url' Parameter
• Guest Support <= 1.2.3 - Unauthenticated User Email Disclosure in guest_support_handler AJAX Endpoint
• Booking and Rental Manager for Bike | Car | Resort | Appointment | Dress | Equipment <= 2.7.2 - Unauthenticated Price Maniputlation
• StylePress for Elementor <= 1.2.1 - Authenticated (Contributor+) Stored Cross-Site Scripting
• Ultimate Member <= 1.3.17 - Cross-Site Scripting
• Kudos Donations – Easy donations and payments with Mollie <= 3.2.9 - Reflected Cross-Site Scripting via 'add_query_arg'
• MediaPress <= 1.6.1 - Authenticated (Contributor+) Stored Cross-Site Scripting via Plugin's Shortcode
• e-xact-hosted-payment <= 2.0 - Unauthenticated Arbitrary File Deletion
• MainWP <= 4.4.3.3 - Authenticated (Administrator+) SQL Injection
• Post and Page Builder by BoldGrid – Visual Drag and Drop Editor <= 1.24.1 - Cross-Site Request Forgery via submitDefaultEditor
• CartFlows Pro <= 1.11.12 - Cross-Site Request Forgery
• JetEngine <= 3.8.10.1 - Unauthenticated SQL Injection via Listing Grid Load More AJAX Endpoint
• WooCommerce <= 3.4.5 - WooCommerce File Deletion
• WpMobi <= 0.0.3 - Cross-Site Request Forgery via save_general_settings Action
• Ibtana – Ecommerce Product Addons <= 0.4.7.4 - Authenticated (Contributor+) Stored Cross-Site Scripting
• Customize My Account for WooCommerce <= 1.8.3 - Cross-Site Request Forgery via restore_my_account_tabs
• Beam me up Scotty – Back to Top Button <= 1.0.21 - Reflected Cross-Site Scripting
• Appsero Helper <= 1.3.4 - Authenticated (Subscriber+) SQL Injection
• Global Flash Gallery <= 0.15.1 - Arbitrary File Upload
• Timeline Event History <= 3.2 - Reflected Cross-Site Scripting
• Count per Day Plugin < 3.2.3 - Cross-Site Scripting
• Solace <= 2.1.16 - Missing Authorization
• Responsive Check <= 0.0.3 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode Attributes
• Vavo Core <= 2.3.0 - Unauthenticated Local File Inclusion
• MC Woocommerce Wishlist <= 1.7.8 - Missing Authorization
• Wp photo text slider 50 <= 8.0 - Authenticated (Subscriber+) SQL Injection via Shortcode
• WP ULike <= 4.7.4 - Cross-Site Request Forgery to Statistic Deletion
• Special Text Boxes <= 5.9.109 - Authenticated (Admin+) Stored Cross-Site Scripting
• WP Photo Album Plus <= 9.2.02.004 - Unauthenticated Stored Cross-Site Scripting
• Infusionsoft Web Form JavaScript <= 1.1.1 - Authenticated (Contributor+) Stored Cross-Site Scripting
• WP Customer Reviews <= 3.7.0 - Authenticated (Contributor+) Malicious Redirect via HTTP-EQUIV Injection
• Support Plus Responsive Ticket System <= 9.1.2 - Unauthenticated Stored Cross-Site Scripting
• Custom Post <= 1.0 - Cross-Site Request Forgery to Stored Cross-Site Scripting
• Classified Listing <= 3.0.4 - Cross-Site Request Forgery to Account Takeover via rtcl_update_user_account
• Royal Elementor Addons and Templates <= 1.3.87 - Cross-Site Request Forgery via remove_from_wishlist
• 404 Solution <= 2.35.7 - Authenticated (Admin+) SQL Injection
• Syndication Links < 1.0.3 - DOM-based Cross-Site Scripting
• WordPress Core < 4.7.5 - Stored Cross-Site Scripting via filenames
• Popping Sidebars and Widgets Light <= 1.27 - Cross-Site Request Forgery
• Gmedia Photo Gallery <= 1.18.4 - Cross-Site Scripting
• WPCargo Track & Trace <= 8.0.3 - Unauthenticated SQL Injection
• LA-Studio Element Kit for Elementor <= 1.3.9.3 - Authenticated (Contributor+) Stored Cross-Site Scripting
• LLM Hubspot Blog Import <= 1.0.1 - Missing Authorization to Authenticated (Subscriber+) Hubspot Import
• Frontend File Manager <= 21.2 - Missing Authorization
• Classic Addons – WPBakery Page Builder <= 3.0 - Authenticated (Contributor+) Limited Local PHP File Inclusion
• Elementor Website Builder – More than Just a Page Builder <= 3.20.2 - Authenticated (Contributor+) DOM-Based Stored Cross-Site Scripting via Path Widget
• Ninja Forms Contact Form <= 3.3.17 - Cross-Site Scripting via begin_date, end_date, or form_id Parameter
• Wishlist for WooCommerce: Multi Wishlists Per Customer PRO 3.0.8 - 3.1.2 - Reflected Cross-Site Scripting via wtab Parameter
• Elegant Themes Icons <= 1.3 - Authenticated (Contributor+) Stored Cross-Site Scripting
• Flexible Subscriptions <= 1.8.1 - Authenticated (Customer+) PHP Object Injection
• Barcode Scanner with Inventory & Order Manager <= 1.6.7 - Authenticated (Admin+) Arbitrary File Upload
• Request a Quote <= 2.3.7 - Authenticated (Admin+) Stored Cross-Site Scripting
• Ronneby Theme Core <= 1.5.68 - Authenticated (Contributor+) Local File Inclusion
• Thumbnail Slider With Lightbox <= 1.0.4 - Authenticated (Admin+) SQL Injection
• GroupDocs.Comparison for Cloud < 1.0.3 - Cross-Site Scripting
• Import Export WordPress Users <= 2.5.2 - Authenticated (Shop Manager+) Path Traversal
• My Calendar <= 3.6.16 - Missing Authorization
• Rentsyst <= 2.0.100 - Reflected Cross-Site Scripting
• The Plus Addons for Elementor – Elementor Addons, Page Templates, Widgets, Mega Menu, WooCommerce <= 5.6.0- Authenticated (Contributor+) Stored Cross-Site Scripting
• CodeBard Help Desk <= 1.1.1 - Cross-Site Request Forgery
• Email Subscription Popup <= 1.2.19 - Reflected Cross-Site Scripting
• Mark User as Spammer <= 1.0.1 - Reflected Cross-Site Scripting
• Konami Easter Egg <= v0.4 - Cross-Site Request Forgery
• ListingPro Plugin <= 2.9.10 - Unauthenticated SQL Injection
• OVRI Payment 1.7.0 - Malicious .htaccess directive
• Custom Dashboard Page <= 1.0 - Cross-Site Request Forgery
• Form Maker by 10Web – Mobile-Friendly Drag & Drop Contact Form Builder < 1.15.38 - Unauthenticated SQL Injection
• Contest Gallery <= 19.1.4.1 - Authenticated (Author+) SQL Injection via option_id
• JetPopup <= 2.0.15 - Authenticated (Subscriber+) Information Disclosure
• GoZen Forms <= 1.1.5 - Unauthenticated SQL Injection via dirGZActiveForm()
• Wholesale Market for WooCommerce <= 2.0.0 & Wholesale Market <= 2.2.1 - Cross-Site Request Forgery
• BlockSpare: Gutenberg Blocks & Patterns for Blogs, Magazines, Business Sites <= 3.2.13.1 - Authenticated (Contributor+) Stored Cross-Site Scripting via Image Carousel and Image Slider Widgets
• 3D Flick Slideshow < 2.2 - Arbitrary File Upload
• Event post <= 5.9.7 - Authenticated (Contributor+) Stored Cross-Site Scripting
• Kali Forms <= 2.4.8 - Insecure Direct Object Reference to Authenticated (Contributor+) Sensitive Form Data Exposure
• Video Gallery – YouTube Playlist, Channel Gallery by YotuWP <= 1.3.13 - Authenticated (Contributor+) Arbitrary File Inclusion via Shortcode
• DearFlip – PDF Flipbook, 3D Flipbook, PDF embed, PDF viewer <= 2.4.29 - Missing Authorization
• FraudLabs Pro for WooCommerce <= 2.22.8 - Cross-Site Request Forgery to Stored Cross-Site Scripting