Vulnerability archive: section 10, page 6

Open a report to review affected versions, available fixes and original sources. Each report covers a specific issue; its presence does not establish whether your website is affected.

• ChatBot 4.8.6 - 4.9.6 - Authenticated (Administrator+) Stored Cross-Site Scripting in FAQ Builder
• wp image slideshow <= 12.0 - Authenticated (Subscriber+) SQL Injection via Shortcode
• Radio Player <= 2.0.73 - Unauthenticated Server-Side Request Forgery
• Interact: Embed A Quiz On Your Site <= 3.1 - Cross-Site Request Forgery
• Wordfence Security – Firewall & Malware Scan <= 5.1.3 - Cross-Site Scripting
• WPUpper Share Buttons <= 3.51 - Cross-Site Request Forgery to Custom CSS Update
• Copymatic – AI Content Writer & Generator <= 1.9 - Missing Authorization
• WordPress Core <= 2.1.2 - Cross-Site Scripting
• BEAR <= 1.1.4 - Authenticated (Shop manager+) Stored Cross-Site Scripting via Plugin Options
• WordPress Social Login <= 3.0.4 - Reflected Cross-Site Scripting
• WP-BusinessDirectory – Business directory plugin for WordPress <= 4.0.0 - Authenticated (Subscriber+) Arbitrary File Upload
• Content Cloner <= 1.0.1 - Missing Authorization
• The Events Calendar: Eventbrite Tickets < 3.10.2 - Cross-Site Scripting
• RDP Wiki Embed <= 1.2.20 - Cross-Site Request Forgery
• Default Thumbnail Plus <= 1.0.2.3 - Authenticated (Contributor+) Arbitrary File Upload
• WP-tagMaker <= 0.2.2 - Reflected Cross-Site Scripting
• Import Export WordPress Users and WooCommerce Customers <= 1.3.1 - CSV Injection
• WP Live Chat Support <= 7.1.04 - Cross-Site Scripting
• WassUp Real Time Analytics < 1.9.1 - Cross-Site Scripting
• Appointment Booking Calendar — Simply Schedule Appointments Booking Plugin <= 1.6.9.27 - Unauthenticated SQL Injection
• Woo Product Feed For Marketing Channels <= 1.9.0 - Missing Authorization
• Essential Addons for Elementor <= 5.9.26 - Authenticated (Contributor+) Stored Cross-Site Scripting
• School Management System – WPSchoolPress <= 2.2.16 - Missing Authorization to Privilege Escalation via Account Takeover
• iONE360 configurator <= 2.0.57 - Reflected Cross-Site Scripting
• SportsPress – Sports Club & League Manager <= 2.7.21 - Authenticated (Admin+) Stored Cross-Site Scripting
• WP Front-end login and register <= 2.1.0 - Reflected Cross-Site Scripting
• Smart Framework <= Multiple Plugins - Missing Authorization to Authenticated (Subscriber+) Stored Cross-Site Scripting
• Blog Manager WP <= 1.0.5 - Authenticated (Administrator+) Stored Cross-Site Scripting
• SKT Addons for Elementor <= 3.3 - Authenticated (Contributor+) Post Disclosure
• Easy Digital Downloads – Recent Purchases <= 1.0.2 - Unauthenticated Remote File Inclusion
• BMLT WordPress Plugin <= 3.11.4 - Cross-Site Request Forgery to Settings Creation and Deletion
• Product Catalog Enquiry <= 5.0.2 - Missing Authorization
• WPQA < 5.9 - Cross-Site Request Forgery
• Pre Order Addon for WooCommerce – Advance Order/Backorder Plugin <= 2.2 - Reflected Cross-Site Scripting
• Responsive Blocks – Page Builder for Blocks & Patterns <= 2.2.0 - Missing Authorization
• Popup addon for Ninja Forms <= 3.4 - Authenticated (Contributor+) Stored Cross-Site Scripting
• WP Social SEO Booster – Knowledge Graph Social Signals SEO <= 1.2.0 - Authenticated (Contributor+) Stored Cross-Site Scripting
• WooCommerce Photo Reviews - Review Reminders - Review for Discounts <= 1.3.13 - Reflected Cross-Site Scripting
• W3 Total Cache <= 0.9.4 - Cross-Site Request Forgery leading to Stored Cross-Site Scripting
• Bulk NoIndex & NoFollow Toolkit <= 2.15 - Reflected Cross-Site Scripting
• FWD Slider <= 1.0 - Reflected Cross-Site Scripting
• Skip To <= 2.0.0 - Cross-Site Request Forgery to Stored Cross-Site Scripting
• Post and Page Builder by BoldGrid – Visual Drag and Drop Editor <= 1.27.8 - Authenticated (Contributor+) Server-Side Request Forgery
• KiviCare – Clinic & Patient Management System (EHR) <= 3.2.0 - Sensitive Information Exposure
• JetProductGallery <= 2.2.0.2 - Authenticated (Contributor+) Stored Cross-Site Scripting
• Stockdio Historical Chart <= 2.8.18 - Authenticated (Contributor+) Stored Cross-Site Scripting
• Hustle <= 6.0.7 - Unauthenticated CSV Injection
• Leaflet Maps Marker Pro < 1.5.8 - SQL Injection
• WC Price History for Omnibus <= 2.1.4 - Authenticated (Shop manager+) PHP Object Injection
• Thank Me Later <= 3.3.4 - Admin+ Stored Cross-Site Scripting
• Slide Anything – Responsive Content / HTML Slider and Carousel <= 2.3.43 - Editor+ Cross-Site Scripting
• Thim Core <= 2.3.3 - Authenticated (Subscriber+) Remote Code Execution
• More From Google <= 0.0.2 - Reflected Cross-Site Scripting
• Colibri Page Builder <= 1.0.334 - Authenticated (Contributor+) Stored Cross-Site Scripting via colibri_newsletter Shortcode
• Ashe <= 2.243 - Reflected Cross-Site Scripting via add_query_arg Parameter
• LearnPress <= 4.3.2.8 - Missing Authorization to Authenticated (Subscriber+) Arbitrary Quiz Answer Deletion
• Login Logout Register Menu <= 2.0 - Authenticated (Contributor+) Stored Cross-Site Scripting
• Tourimo <= 1.2.3 - Unauthenticated Local File Inclusion
• Float Menu <= 4.3 - Arbitrary Menu Deletion via Cross-Site Request Forgery
• EasyMe Connect <= 3.0.3 - Cross-Site Request Forgery
• Ultimate Addons for WPBakery Page Builder <= 3.19.20 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode
• Manual - Documentation, Knowledge Base & Education WordPress <= 7.5.4 - Unauthenticated Stored Cross-Site Scripting
• Envo Extra <= 1.9.9 - Missing Authorization
• Ninja Forms Contact Form <= 3.4.33 - Administrator Open Redirect
• Simple Personal Message < 2.0.0 - Authenticated SQL Injection
• ClickDesigns <= 1.8.0 - Missing Authorization to API Key Modification or Removal
• Realia <= 1.4.0 - Arbitrary Post Deletion
• Media Library Assistant <= 3.39 - Authenticated (Subscriber+) Stored Cross-Site Scripting
• Takeout <= 1.3.0 - Unauthenticated Local File Inclusion
• Answer My Question <= 1.3 - SQL Injection
• Album and Image Gallery with Lightbox – Flagallery Photo Portfolio <= 1.72 - Reflected Cross-Site Scripting
• I Draw <= 1.0 - Authenticated (Author+) Arbitrary File Upload
• Blogmatic <= 1.0.3 - Authenticated (Subscriber+) Arbitrary File Upload
• Lazy Blocks <= 4.1.0 - Missing Authorization
• Survey And Quiz Tool <= 2.9.2 - Unauthenticated Cross-Site Scripting
• WordPress Core < 2.3.2 - SQL Injection
• Altra Side Menu <= 2.0 - Cross-Site Request Forgery to Arbitrary Menu Deletion
• Theme Tweaker <= 5.20 - Cross-Site Request Forgery
• WPoperation Elementor Addons <= 1.1.9 - Authenticated (Contributor+) Stored Cross-Site Scripting
• JetBackup – Backup, Restore & Migrate 3.1.18.8 - 3.1.23.3 - Authenticated (Admin+) Backup Download
• Top Quark Architecture Plugin < 2.1.1 - Arbitrary File Upload
• Ultimate Dashboard <= 3.8.5 - Authenticated (Administrator+) Stored Cross-Site Scripting
• WooCommerce PDF Invoice Builder <= 1.2.101 - Cross-Site Request Forgery
• People Lists <= 1.3.10 - Missing Authorization
• List of Posts from each Category plugin for WordPress <= 2.0 - Cross-Site Request Forgery to Stored Cross-Site Scripting
• SiteOrigin Widgets Bundle <= 1.70.4 - Missing Authorization to Authenticated (Subscriber+) Arbitrary Shortcode Execution
• Email Encoder Bundle <= 2.1.8 - Authenticated (Contributor+) Stored Cross-Site Scripting via shortcode
• Infility Global <= 2.12.7 - Authenticated (Subscriber+) SQL Injection
• Employee Spotlight <= 5.1.1 - Unauthenticated PHP Object Injection
• Edwiser Bridge <= 3.0.7 - Authenticated (Subscriber+) Stored Cross-Site Scripting
• WP Mobile Menu <= 2.8.4.3 - Cross-Site Request Forgery
• Skill Bar <= 1.2 - Authenticated (Contributor+) Stored Cross-Site Scripting
• Movylo Marketing Automation <= 2.0.7 - Reflected Cross-Site Scripting
• User Registration & Membership – Free & Paid Memberships, Subscriptions, Content Restriction, User Profile, Custom User Registration & Login Builder < 5.2.6 - Authenticated (Custom Role+) Privilege Escalation
• Product Time Countdown for WooCommerce <= 1.6.2 - Authenticated (Contributor+) Stored Cross-Site Scripting
• Speedup Optimization <= 1.5.9 - Missing Authorization to Authenticated (Subscriber+) Plugin Settings Update via 'speedup01_enabled' AJAX Action
• Smash Balloon Custom Facebook Feed <= 4.3.1 - Authenticated (Contributor+) Stored Cross-Site Scripting via `data-color` Attribute
• Supreme Modules Lite <= 2.5.62 - Authenticated (Author+) Arbitrary File Upload via JSON Upload Bypass
• Essential Addons for Elementor <= 6.2.4 - Missing Authorization
• WP Photo Album Plus <= 8.7.01.001 - Unauthenticated Arbitrary File Upload