Vulnerability archive: section 10, page 8

Open a report to review affected versions, available fixes and original sources. Each report covers a specific issue; its presence does not establish whether your website is affected.

• Picture Gallery – Frontend Image Uploads, AJAX Photo List <= 1.5.22 - Authenticated (Contributor+) Stored Cross-Site Scripting via videowhisper_picture_upload_guest Shortcode
• eBay Product Feeds <= 3.4.9 - Authenticated (Administrator+) Stored Cross-Site Scripting
• Hash Elements <= 1.5.4 - Authenticated (Contributor+) Information Exposure
• Uncomplicated SEO <= 1.2 - Reflected Cross-Site Scripting
• Widget Logic < 5.10.2 - Cross-Site Request Forgery
• Visual Composer Website Builder <= 45.8.0 - Authenticated (Editor+) Stored Cross-Site Scripting
• Microsoft Clarity <= 0.9.3 - Cross-Site Request Forgery to Stored Cross-Site Scripting
• WP eCommerce <= 3.8.9 - Cross-Site Scripting
• Vulnerability: eCommerce Product Catalog plugin for WordPress <= 3.3.4 - Authenticated (Administrator+) Stored Cross-Site Scripting
• MoneyTheme (All Versions) - Cross-Site Scripting
• Membership For WooCommerce <= 2.9.0 - Missing Authorization
• Users Ultra Membership, Users Community and Member Profiles With PayPal Integration Plugin < 1.5.63 - Cross-Site Scripting
• Cookie banner plugin for WordPress – Cookiebot CMP by Usercentrics <= 4.4.1 - Missing Authorization to Authenticated (Subscriber+) Survey Submission
• CoCart – Headless REST API for WooCommerce <= 4.8.4 - Missing Authorization
• Awesome Support – WordPress HelpDesk & Support Plugin <= 6.3.6 - Missing Authorization to Unauthenticated Role Demotion
• SEO Plugin by Squirrly SEO <= 12.3.19 - Authenticated (Contributor+) SQL Injection via url Parameter
• CHP Ads Block Detector <= 3.9.4 - Authenticated (Subscriber+) Stored Cross-Site Scripting
• Customer Reviews for WooCommerce <= 5.38.1 - Missing Authorization via manual review reminders
• Ekiline Block Collection <= 1.0.5 - Authenticated (Contributor+) Stored Cross-Site Scripting
• Custom Twitter Feeds (Tweets Widget) <= 2.1.2 - Cross-Site Request Forgery
• WordPress Download Manager < 3.1.22 - Cross-Site Request Forgery
• Checkout Field Editor (Checkout Manager) for WooCommerce <= 2.1.7 - Unauthenticated Stored Cross-Site Scripting via Block Checkout Custom Radio Field
• GS Insever Portfolio <= 1.4.4 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode
• Advanced Ads <= 2.0.14 - Authenticated (Editor+) Remote Code Execution via Shortcode
• AcyMailing – An Ultimate Newsletter Plugin and Marketing Automation Solution for WordPress <= 11.0.5 - Unauthenticated Arbitrary File Deletion
• Ninja Forms File Uploads Extension <= 3.3.26 - Cross-Site Request Forgery
• WP Data Access <= 4.3.1 - Admin+ SQL Injection
• Password for WP <= 1.5 - Cross-Site Request Forgery to Stored Cross-Site Scripting
• Payment Forms for Paystack <= 4.0.2 - Authenticated (Contributor+) Stored Cross-Site Scripting
• SSL Wireless SMS Notification <= 3.5.0 - Unauthenticated SQL Injection
• CloudFlare(R) Cache Purge <= 1.2 - Reflected Cross-Site Scripting
• Suggestion Toolkit <= 5.0 - Missing Authorization
• JetBackup – WP Backup, Migrate & Restore <= 1.3.9 - Cross-Site Request Forgery to Arbitrary File Upload
• WP Maintenance <= 6.1.9.7 - Authenticated (Administrator+) PHP Object Injection
• Essential Blocks – Page Builder Gutenberg Blocks, Patterns & Templates <= 4.4.6 - Authenticated (Contributor+) Stored Cross-Site Scripting
• StifLi Backup Tools <= 2.2.7 - Unauthenticated Information Exposure
• Popup More Popups <= 2.3.2 - Authenticated (Administrator+) Stored Cross-Site Scripting
• smart SEO <= 2.12 - Unauthenticated Local File Inclusion
• JS Help Desk – The Ultimate Help Desk & Support Plugin <= 2.8.8 - Authenticated (Subscriber+) Insecure Direct Object Reference
• Eventin <= 4.0.31 - Authenticated (Contributor+) PHP Object Injection
• Perfect Brands for WooCommerce <= 3.6.2 - Authenticated (Contributor+) SQL Injection
• fluXtore <= 1.6.0 - Missing Authorization
• Booking Manager <= 2.1.5 - Authenticated(Contributor+) SQL Injection via Shortcode
• FluentBoards <= 2.0.14 - Missing Authorization
• coreActivity <= 2.0.1 - IP Spoofing
• Forminator Forms <= 1.57.2.0 - Authenticated (Admin+) Privilege Escalation
• Apimo Connector <= 2.6.3.1 - Cross-Site Request Forgery to Settings Update
• Beautiful Cookie Consent Banner <= 2.10.1 - Unauthenticated Stored Cross-Site Scripting
• Rate My Post – Star Rating Plugin by FeedbackWP <= 4.2.4 - Unauthenticated Voting On Scheduled Posts
• WordPress Comments Fields <= 4.0 - Authenticated (Admin+) Stored Cross-Site Scripting
• Sermon Browser < 0.43.6 - SQL Injection
• The League <= 4.4.1 - Missing Authorization
• Envato Sales By Item <= 1.1 - Unauthenticated SQL Injection via AJAX call
• Kali Forms — Contact Form & Drag-and-Drop Builder <= 2.4.18 - Authenticated (Subscriber+) Arbitrary File Deletion
• PHP Compatibility Checker <= 1.5.2 - Cross-Site Request Forgery
• Embed Swagger <= 1.0.0 - Reflected Cross-Site Scripting
• XT Event Widget for Social Events <= 1.1.7 - Authenticated (Contributor+) Local File Inclusion
• Photo Gallery – Responsive Image Galleries by Supsystic <= 1.16.3 - Authenticated (Administrator+) Stored Cross-Site Scripting
• Travel Bucket List <= 0.5.2 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode Attributes
• WP Chrono <= 1.5.4 - Authenticated (Contributor+) Stored Cross-Site Scripting
• SUMO Affiliates Pro <= 11.7.0 - Unauthenticated Stored Cross-Site Scripting
• G-Lock Double Opt-in Manager <= 2.6.5 - SQL Injection
• Annie <= 2.1.1 - Cross-Site Request Forgery to Stored Cross-Site Scripting
• GiveWP <= 3.2.2 - Authenticated (Contributor+) Stored Cross-Site Scripting
• FluentCart A New Era of eCommerce <= 1.6.2 - Authenticated (Custom+) Arbitrary File Deletion via 'file_path' Parameter
• BulletProof Security < .51.1 - SQL Injection
• Borderless – Widgets, Elements, Templates and Toolkit for Elementor & Gutenberg <= 1.6.2 - Authenticated (Author+) Stored Cross-Site Scripting via SVG Upload
• Page Builder: Pagelayer <= 1.7.7 - Authenticated (Author+) Stored Cross-Site Scripting via Header/Footer
• Everest Forms – Contact Form, Payment Form, Quiz, Survey & Custom Form Builder with AI <= 3.6.0 - Unauthenticated PHP Object Injection
• Data Tables Generator by Supsystic <= 1.15.1 - Authenticated (Subscriber+) Stored Cross-Site Scripting via Table Cell 'data' Value via updateRows Action
• Jupiterx Core <= 4.8.12 - Authenticated (Contributor+) Stored Cross-Site Scripting via Inline SVG
• WCFM Marketplace – Multivendor Marketplace for WooCommerce <= 3.8.1 - Unauthenticated SQL Injection
• Finale Lite <= 2.18.0 - Cross-Site Request Forgery
• Goodlayers Hotel <= 3.1.4 - Unauthenticated PHP Object Injection
• Subscribe2 <= 10.37 - Cross-Site Request Forgery
• Quiz Maker <= 6.5.8.3 - Unauthenticated SQL Injection via 'ays_questions' Parameter
• AmpedSense – AdSense Split Tester <= 4.68 - Unauthenticated Cross-Site Scripting
• Scroll UP <= 2.0 - Reflected Cross-Site Scripting
• RevInsite <= 1.1.0 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode Attributes
• StreamWeasels Twitch Integration <= 1.9.3 - Authenticated (Contributor+) Stored Cross-Site Scripting
• ReDi Restaurant Reservation <= 24.0128 - Cross-Site Request Forgery via redi_restaurant_admin_options_page()
• WordPress Core < 3.5.2 - Missing Authorization Checks
• WordPress Survey & Poll – Quiz, Survey and Poll Plugin for WordPress <= 1.7.5 - Authenticated (Contributor+) Stored Cross-Site Scripting
• Templately <= 2.2.5 - Improper Authorization to Arbitrary Post Deletion
• JS Help Desk <= 3.1.3 - Authenticated (Contributor+) User Email Disclosure
• WCFM – Multivendor Marketplace REST API for WooCommerce <= 1.6.3 - Missing Authorization
• RestrictMate – Restrict Page, Post and any Content ( Content Restriction and Membership Plugin) < 1.3.0 - Unauthenticated Privilege Escalation
• Brozzme Scroll Top <= 1.8.5 - Authenticated (Administrator+) Stored Cross-Site Scripting
• Post My CF7 Form <= 6.2.0 - Missing Authorization
• guzzlehttp/psr7 < 1.9.1 & 2.4.5 - Interpretation Conflict
• Autoptimize <= 2.7.7 - Arbitrary File Upload (and Remote Code Execution) via Import Settings
• WP Mailster <= 1.8.16.0 - Authenticated (Contributor+) Stored Cross-Site Scripting
• WooCommerce Cart Count Shortcode <= 1.0.4 - Authenticated (Contributor+) Stored Cross-Site Scripting
• Animation Addons for Elementor – GSAP Motion Elementor Addons & Website Templates < 2.7.2 - Unauthenticated Server-Side Request Forgery
• Sharebar <= 1.2.1 - SQL Injection
• Nexter <= 2.0.3 - Authenticated (Subscriber+) SQL Injection via 'to' and 'from'
• JTL-Connector for WooCommerce <= 2.4.1 - Missing Authorization to Authenticated (Subscriber+) Settings Modification via Multiple Functions
• VRView <= 1.1.3 and WP-VR-view <= 1.6 - Reflected Cross-Site Scripting
• MyBookTable Bookstore by Stormhill Media <= 2.1.4 - Cross-Site Scripting
• Drop Shadow Boxes <= 1.7.13 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode