Vulnerability archive: section 10, page 4

Open a report to review affected versions, available fixes and original sources. Each report covers a specific issue; its presence does not establish whether your website is affected.

• Crafti - Handmade Store WordPress Theme <= 1.12 - Unauthenticated Local File Inclusion
• Yo 1.1 - 1.3.1 - Unauthenticated SQL Injection
• 1 Flash Gallery <= 1.9.0 - Cross-Site Scripting
• AffiliateX – Amazon Affiliate Plugin, Product Boxes, Comparison Tables & Affiliate Link Tracking <= 2.3.5 - Unauthenticated Server-Side Request Forgery
• Paytium: Mollie payment forms & donations <= 4.3.7 - Missing Authorization in 'check_mollie_account_details'
• DandyID Services <= 1.5.9 - Cross-Site Request Forgery
• Widgets on Pages <= 1.6.0 - Authenticated (Contributor+) Stored Cross-Site Scripting
• Subitem AL Slider <= 1.0.0 - Reflected Cross-Site Scripting via $_SERVER['PHP_SELF']
• iNET Webkit 1.2.4 - Authenticated (Contributor+) SQL Injection
• Royal Addons for Elementor – Addons and Templates Kit for Elementor <= 1.7.1052 - Missing Authorization
• Solace Extra <= 1.3.0 - Authenticated (Subscriber+) Arbitrary File Upload
• Booking and Rental Manager <= 2.5.3 - Unauthenticated Stored Cross-Site Scripting
• Embed Google Datastudio <= 1.0.0 - Authenticated (Contributor+) Stored Cross-Site Scripting
• Awesome Support – WordPress HelpDesk & Support Plugin < 3.1.7 - Cross-Site Scripting
• Yaad Sarig Payment Gateway For WC <= 2.2.12 - Authenticated (Subscriber+) Insecure Direct Object Reference
• Ultimate Member <= 1.3.83 - Shortcode Injection
• RestroPress <= 3.2.7 - Missing Authorization
• WP Docs <= 2.2.0 - Authenticated (Subscriber+) Time-Based SQL Injection via 'dir_id'
• Newsletter <= 8.2.0 - IP Spoofing
• teachPress <= 9.0.2 - Reflected Cross-Site Scripting via meta_field_id and cite_id
• WP Google Review Slider <= 13.5 - Authenticated (Administrator+) Stored Cross-Site Scripting
• Button contact VR <= 4.7.9.1 - Authenticated (Administrator+) Stored Cross-Site Scripting
• Advanced WordPress Backgrounds <= 1.12.3 - Authenticated (Contributor+) Stored Cross-Site Scripting via imageTag Parameter
• Aptivada for WP <= 2.0.0 - Authenticated (Contributor+) Stored Cross-Site Scripting
• Simple History <= 1.0.7 - Sensitive Information Disclosure
• Everest Forms <= 3.1.1 - Reflected Cross-Site Scripting
• GamiPress <= 7.9.4 - Authenticated (Subscriber+) Stored Cross-Site Scripting via 'video_id' Parameter
• FormCraft <= 1.2.9 - Authenticated (Contributor+) Stored Cross-Site Scripting via fcb shortcode
• WP Guppy <= 4.3.3 - Authenticated (Subscriber+) SQL Injection
• Travel Booking WordPress Theme < 3.2.3 - Reflected Cross-Site Scripting
• WP ULike 4.7.1 - 4.7.2 - Authenticated (Subscriber+) Stored-Cross-Site Scripting
• Real WYSIWYG <= 0.0.2 - Reflected Cross-Site Scripting
• Rapid Car Check Vehicle Data <= 2.1.2 - Missing Authorization
• WP Delete User Accounts <= 1.2.3 - Authenticated (Contributor+) Stored Cross-Site Scripting
• WP MultiTasking <= 0.1.12 - Reflected Cross-Site Scripting
• LiteSpeed Cache <= 3.6 - Authenticated Stored Cross-Site Scripting via IP setting
• DukaPress <= 2.5.9 - Blind SQL Injection
• Simple GDPR Cookie Compliance <= 2.0.0 - Missing Authorization
• Debug Tool <= 2.2 - Missing Authorization
• Frndzk Expandable Bottom Bar <= 1.0 - Authenticated (Administrator+) Stored Cross-Site Scripting via text Parameter
• X Addons for Elementor <= 1.0.23 - Missing Authorization
• WordPress Download Manager <= 3.1.24 - Authenticated File Upload
• Share and Follow <= 1.80.3 - Cross-Site Scripting
• EDD Product Catalog Feed by PixelYourSite <= 1.0.2 - Authenticated (Subscriber+) Arbitrary Options Deletion via Missing Authorization on 'delete' Parameter
• Sifalo Pay – Mobile Money & Card Payments for WooCommerce 2.0 - 2.5.2 - Missing Authorization
• Store Locator WordPress <= 1.5.2 - Authenticated (Admin+) Arbitrary File Upload
• Disable Content Editor For Specific Template <= 2.0 - Cross-Site Request Forgery to Template Configuration Update
• FormGent – Next-Gen AI Form Builder for WordPress with Multi-Step, Quizzes, Payments & More <= 1.4.2 - Unauthenticated Arbitrary File Deletion
• JetPopup <= 2.0.15 - Authenticated (Contributor+) Stored Cross-Site Scripting
• Export WordPress Data with Advanced Filters < 1.2 - SQL Injection
• Newspaper - News & WooCommerce WordPress Theme < 6.7.2 - Cross-Site Scripting
• WP tarteaucitron.js Self Hosted <= 1.2.4 - Running a Vulnerable Dependency
• SUMIT Payment Gateway for WooCommerce <= 3.0.0 - Unauthenticated Payment Bypass
• APIExperts Square for WooCommerce <= 4.4.1 - Missing Authorization
• Powerkit <= 3.0.4 - Authenticated (Contributor+) Stored Cross-Site Scripting via Lazy Load Image Processing
• Flexible Refund for WooCommerce – EU One Click Return <= 1.0.51 - Authenticated (Customer+) Stored Cross-Site Scripting
• Orbit Fox by ThemeIsle <= 3.0.0 - Authenticated (Contributor+) Stored Cross-Site Scripting
• CubeWP <= 1.1.26 - Authenticated (Contributor+) Stored Cross-Site Scripting
• Photo Gallery by 10Web <= 1.8.0 - Reflected Cross-Site Scripting
• MainWP Child <= 4.1.7.1 - SQL Injection via orderby, order Parameters
• ThirstyAffiliates <= 3.11.8 - Authenticated (Contributor+) Stored Cross-Site Scripting
• Image Gallery – Photo Grid & Video Gallery <= 2.12.28 - Improper Authorization to Authenticated (Author+) Arbitrary Image File Move
• Intelligent WordPress Live Chat Support Plugin | Utilities <= 1.0.4 - Stored Cross-Site Scripting
• Login with QR <= 1.0.0 - Authentication Bypass
• WooCommerce UPS Shipping – Live Rates and Access Points <= 2.2.4 - Cross-Site Request Forgery
• wordpress related Posts with thumbnails <= 3.0.0.1 - Cross-Site Request Forgery to Stored Cross-Site Scripting
• Location Manager < 2.1.0.10 - SQL Injection
• WP Shortcodes Plugin — Shortcodes Ultimate <= 7.2.2 - Authenticated (Contributor+) DOM-Based Stored Cross-Site Scripting
• YayExtra – WooCommerce Extra Product Options <= 1.3.7 - Unauthenticated Arbitrary File Upload via handle_upload_file Function
• Nextend Social Login Pro <= 3.1.14 - Authentication Bypass via WordPress.com OAuth provider
• WP Affiliate Platform <= 6.3.9 - Reflected Cross-Site Scripting
• Ajax Load More – Infinite Scroll, Load More, & Lazy Load < 7.8.4 - Unauthenticated Stored Cross-Site Scripting
• GPX Viewer <= 2.2.9 - Authenticated (Subscriber+) Arbitrary File Creation
• eaSYNC <= 1.3.19 - Missing Authorization
• Related Post <= 2.0.53 - Authenticated (Contributor+) Stored Cross-Site Scripting
• Album and Image Gallery plus Lightbox <= 2.0 - Unauthenticated Arbitrary Shortcode Execution
• Ultimate FAQ Accordion Plugin <= 2.4.14 - Authenticated (Contributor+) Stored Cross-Site Scripting
• FlipBook <= 1.0 - Arbitrary File Upload
• Call Now Accessibility Button <= 1.1 - Authenticated (Administrator+) Stored Cross-Site Scripting
• NextScripts: Social Networks Auto-Poster <= 4.4.3 - Authenticated(Subscriber+) Sensitive Information Exposure
• WP Fastest Cache <= 1.5.0 - Unauthenticated Stored Cross-Site Scripting via HTTP Host Header
• Awesome Support <= 6.1.7 - Missing Authorization
• Persistent Login <= 3.1.3 - Unauthenticated Stored Cross-Site Scripting
• WordPress Core < 6.2.1 - Insufficient Sanitization of Block Attributes
• Booking Calendar <= 6.2 - Cross-Site Request Forgery to SQL Injection
• CMP – Coming Soon & Maintenance Plugin by NiteoThemes < 4.1.18 - Missing Authorization to Unauthenticated Settings Change
• IDonatePro <= 2.1.11 - Missing Authorization
• WPLP Cookie Consent – Cookie Banner & Consent Management for GDPR, CCPA & Google Consent Mode < 4.4.2 - Authenticated (Administrator+) SQL Injection
• Category Post Shortcode <= 2.4 - Authenticated (Contributor+) Stored Cross-Site Scripting
• Appointment <= 3.7.3 - Cross-Site Request Forgery
• Ravpage <= 2.40 - Reflected Cross-Site Scripting
• NaturaLife Extensions <= 2.1 - Reflected Cross-Site Scripting
• Motors – Car Dealer, Classifieds & Listing <= 1.4.57 - Missing Authorization to Authenticated (Subscriber+) Arbitrary Post Deletion and Listing Template Creation
• wp2syslog <= 1.0.5 - Authenticated (Administrator+) Stored Cross-Site Scripting
• WP Job Portal <= 2.4.9 - Authenticated (Subscriber+) Arbitrary File Deletion via Resume Custom File Field
• Official Integration for Billingo <= 3.3.9 - Reflected Cross-Site Scripting
• FoxyPress <= 0.4.2.7 - Open Redirect
• CookieHint WP <= 1.0.0 - Authenticated (Contributor+) Stored Cross-Site Scripting
• RLSWordPressSearch (All Versions) - SQL Injection
• Z-URL Preview <= 1.6.2 - Cross-Site Scripting