Vulnerability archive: section 11, page 1

Open a report to review affected versions, available fixes and original sources. Each report covers a specific issue; its presence does not establish whether your website is affected.

• Simple Job Board <= 2.9.4 Authenticated Stored Cross-Site Scripting
• FAT Services Booking <= 5.6 - Authenticated (Subscriber+) Stored Cross-Site Scripting
• Responsive Image Gallery, Gallery Album <= 2.0.3 - Authenticated (Contributor+) Stored Cross-Site Scripting
• Ultimate Member <= 2.0.27 - Multiple Cross-Site Scripting vulnerabilities
• Contact form 7 Custom validation <= 1.1.3 - Unauthenticated SQL Injection via 'post'
• Quentn WP 1.2.13 - 1.2.14 - Unauthenticated SQL Injection
• Multiple Plugins <= (Various Versions) - Authenticated (Contributor+) Stored DOM-Based Cross-Site Scripting via Featherlight.js JavaScript Library
• Incoming Links < 0.9.10b - Stored Cross-Site Scripting
• WP Google Map Plugin < 2.3.10 - Cross-Site Request Forgery
• Side Cart Woocommerce (Ajax) < 2.1 - Cross-Site Request Forgery
• Starter Templates <= 4.4.41 - Authenticated (Author+) Arbitrary File Upload via WXR Upload Bypass
• Portfolio Gallery – Photo Gallery <= 1.1.8 - Authenticated (Admin+) SQL Injection
• Elegant Blocks <= 1.7 - Authenticated (Contributor+) Stored Cross-Site Scripting
• Unlimited Elements For Elementor (Free Widgets, Addons, Templates) <= 1.5.112 - IP Address Spoofing to Antispam Bypass
• ClickWhale – Link Manager, Link Shortener and Click Tracker for Affiliate Links & Link Pages <= 2.4.1 - Reflected Cross-Site Scripting
• MOLIE <= 0.5 - SQL Injection
• WM JqMath <= 1.3 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'style' Shortcode Attribute
• Arya Multipurpose Pro <= 1.0.8 - Reflected Cross-Site Scripting
• AI ChatBot <= 4.8.9 and 4.9.2 - Missing Authorization on AJAX actions
• Export Import Menus <= 1.9.2 - Unauthenticated Information Exposure
• WPBookit Pro <= 1.6.18 - Missing Authorization
• Terminal Africa <= 1.13.17 - Reflected Cross-Site Scripting
• Mail Masta <= 1.0 - SQL Injection via filter_list parameter
• Booking Ultra Pro <= 1.1.6 - Cross-Site Request Forgery
• Woostify Sites Library <= 1.6.2 - Missing Authorization
• Theme Junkie Team Content <= 0.1.1 - Authenticated (Contributor+) Stored Cross-Site Scripting
• Flatastic <= 2.0 - Unauthenticated PHP Object Injection
• DN Shipping by Weight for WooCommerce <= 1.1.1 - Cross-Site Request Forgery to Plugin Settings Update
• Facebook for WooCommerce <= 1.9.12 - Cross-Site Request Forgery allowing Option Update
• ATT YouTube Widget <= 1.0 - Cross-Site Request Forgery to Stored Cross-Site Scripting
• Peekaboo <= 1.1 - Authenticated (Contributor+) Stored Cross-Site Scripting
• Menubar <= 5.8.2 - Cross-Site Request Forgery in wpm-admin.php
• Sensei LMS <= 4.24.4 - Missing Authorization
• Do That Task <= 1.5.5 - Unauthenticated Arbitrary File Upload
• Cloudinary <= 3.3.0 - Missing Authorization
• Paid Member Subscriptions <= 3.0.0 - Missing Authorization
• Contact Form to DB by BestWebSoft – Messages Database Plugin For WordPress <= 1.7.2 - Authenticated (Author+) SQL Injection
• Kirki – Freeform Page Builder, Website Builder & Customizer <= 6.3.1 - Unauthenticated Stored Cross-Site Scripting via Registration Metadata
• Feed Them Social – Page, Post, Video, and Photo Galleries <= 2.8.6 - Cross-Site Request Forgery Bypass
• WP Booking System <= 2.1.0.1 - Authenticated (Subscriber+) SQL Injection via 'current_month' Parameter
• Custom Field Suite <= 2.6.7 - Authenticated (Contributor+) Stored Cross-Site Scripting via cfs[post_title]
• WordPress Page Contact <= 1.0 - Authenticated (Admin+) SQL Injection
• Ninja Forms Contact Form 2.9.36 - 2.9.42 - Unauthenticated Arbitrary File Upload
• Themesflat Addons For Elementor <= 2.0.0 - Unauthenticated PHP Object Injection
• ThemeRain Core <= 1.1.9 - Missing Authorization
• underConstruction <= 1.21 - Authenticated (Administrator+) Stored Cross-Site Scripting
• WordPress Social Login <= 3.0.4 - Authenticated (Administrator+) Stored Cross-Site Scripting
• One Click Plugin Updater <= 2.4.14 - Cross-Site Request Forgery to Settings Update
• EELV Newsletter <= 4.8.2 - Reflected Cross-Site Scripting
• Academy LMS <= 2.0.10 - Open Redirect
• Multi-language Responsive Portfolio WordPress <= 1.0 - Authenticated (Admin+) Stored Cross-Site Scripting
• MStore API <= 3.9.6 - Cross-Site Request Forgery to Product Limit Update
• YITH Request a Quote for WooCommerce < 4.46.1 - Unauthenticated Insecure Direct Object Reference
• Royal Elementor Addons and Templates <= 1.7.1003 - Authenticated (Contributor+) Post Disclosure
• Daisycon prijsvergelijkers <= 4.9.0 - Authenticated (Contributor+) Stored Cross-Site Scripting
• PW WooCommerce Bulk Edit <= 2.134 - Cross-Site Request Forgery
• WP Contact Slider <= 2.4.6 - Stored Cross-Site Scripting
• Quick Contact Form <= 8.0.3.1 - Cross-Site Request Forgery to Sensitive Information Disclosure
• WordPress Core < 4.9 - Insecure Deserialization
• Forminator Forms – Contact Form, Payment Form & Custom Form Builder <= 1.57.2 - Missing Authorization
• Logo Showcase with Slick Slider – Logo Carousel, Logo Slider & Logo Grid <= 1.2.4 - Cross-Site Request Forgery
• Conversion Ninja (Unspecified Version) - Cross-Site Scripting
• Explara Events <= 0.1.3 - Reflected Cross-Site Scripting
• DW Question & Answer Pro <= 1.3.6 - Cross-Site Request Forgery
• Ultimate Blocks <= 3.3.6 - Authenticated (Contributor+) Stored Cross-Site Scripting
• Bulk Delete Users by Email <= 1.2 - Reflected Cross-Site Scripting
• Sosh Share Buttons <= 1.1.0 - Cross-Site Request Forgery
• Custom Sidebars <= 3.0.9 - Cross-Site Request Forgery
• All Video Gallery <= 1.1 - SQL Injection
• HTML Forms <= 1.5.1 - Unauthenticated Stored Cross-Site Scripting
• Blog Introduction <= 0.3.0 - Cross-Site Request Forgery to Settings Update
• cformsII < 14.6.10 - SQL Injection
• Clockwork SMS Notfications < 2.4.2 - Cross-Site Scripting
• Avada | Website Builder For WordPress & eCommerce <= 3.11.9 - Authenticated (Contributor+) Stored Cross-Site Scripting via fusion_button Shortcode
• ProfileGrid – User Profiles, Groups and Communities <= 5.9.4.4 - Missing Authorinzation to Authenticated (Subscriber+) Join Group Requests Management
• Yogi < 2.9.3 - Authenticated (Subscriber+) PHP Object Injection
• Relevanssi <= 4.0.4 - Cross-Site Scripting
• Contact Form 7 – Clockwork SMS < 2.4.1 - Reflected Cross-Site Scripting
• Limit Attempts by BestWebSoft <= 1.2.9 - Reflected Cross-Site Scripting
• QuBotChat <= 1.1.5 - Authenticated(Administrator+) Stored Cross-Site Scripting
• Simple File List <= 6.3.7 - Missing Authorization to Authenticated (Contributor+) Arbitrary File Operations (Deletion / Move / Folder Creation / Download) via 'frontmanage' Shortcode Attribute
• Pinevale <= 1.0.14 - Unauthenticated Local File Inclusion
• Responsive Lightbox & Gallery <= 2.7.9 - Authenticated (Editor+) Stored Cross-Site Scripting via Comment Content 'title' Attribute
• Eldon <= 1.0 - Unauthenticated Local File Inclusion
• Adsmonetizer <= 3.2.4 - Reflected Cross-Site Scripting
• FluentForms <= 4.3.24 - Authenticated(Contributor+) Stored Cross-Site Scripting
• Comment-Emailer <= 1.0.5 - Cross-Site Request Forgery to Stored Cross-Site Scripting
• Bus Ticket Booking with Seat Reservation <= 5.2.3 - Reflected Cross-Site Scripting
• Survey Maker <= 5.1.9.4 - Missing Authorization to Unauthenticated Limited Option Update
• Comment Engine Pro <= 1.0 - Authenticated (Editor+) Stored Cross-Site Scripting
• Markdown on Save Improved <= 2.5 - Stored Cross-Site Scripting
• Molongui Authorship <= 5.2.12 - Unauthenticated Stored DOM-Based Cross-Site Scripting via Comment href Attribute
• Welcart e-Commerce < 2.2.8 - Missing Capabilities Check to Information Disclosure
• Recent Backups <= 0.7 - Directory Traversal
• Client Dash <= 2.2.1 - Authenticated (Administrator+) Stored Cross-Site Scripting via settings
• Popup Maker <= 1.16.4 - Authenticated (Admin+) Cross-Site Scripting
• GeneratePress Premium <= 2.3.2 - Authenticated(Contributor+) Stored Cross-Site Scripting via Custom Meta
• Database for Contact Form 7, WPforms, Elementor forms <= 1.5.4 - Authenticated (Authenticated+) SQL Injection
• Run Contests, Raffles, and Giveaways with ContestsWP <= 2.0.3 - Reflected Cross-Site Scripting
• WP Forum Server <= 1.8.2 - Authenticated (Administrator+) SQL Injection