Vulnerability archive: section 11, page 10

Open a report to review affected versions, available fixes and original sources. Each report covers a specific issue; its presence does not establish whether your website is affected.

• The Business <= 1.6.1 - Unauthenticated PHP Object Injection
• PlainInventory <= 3.1.9 - Cross-Site Request Forgery to Stored Cross-Site Scripting
• WP ERP <= 1.12.3 - Reflected Cross-Site Scripting
• WP Contest <= 1.0.0 - Authenticated (Contributor+) SQL Injection
• Web Directory Free <= 1.6.8 - Authenticated (Contributor+) SQL Injection via post_id
• HubSpot All-In-One Marketing - Forms, Popups, Live Chat <= 11.3.32 - Missing Authorization to Authenticated (Contributor+) Installed Plugin Disclosure
• WP Background Takeover < 4.1.5 - Directory Traversal
• LoginPress <= 1.1.15 - Authenticated Stored Cross-SIte Scripting
• Posts Footer Manager <= 2.1.0 - Authenticated (Administrator+) Stored Cross-Site Scripting
• AdRotate – Ad manager & AdSense Ads <= 5.8.17 - Admin+ SQL Injection
• Payment Form for PayPal Pro < 1.0.2 - Reflected Cross-Site Scripting
• Boot Store <= 1.6.4 - Reflected Cross-Site Scripting
• Sell Downloads <= 1.0.1 - Arbitrary File Read
• UsersWP <= 1.2.42 - Authenticated (Contributor+) Stored Cross-Site Scripting
• Page Builder Sandwich <= 5.1.0 - Missing Authorization to Authenticated(Subscriber+) Arbitrary Post Editing
• Product Catalog 8 <= 1.2.0 - SQL Injection
• Docket (WooCommerce Collections / Wishlist / Watchlist) < 1.7.0 - Missing Authorization to Unauthenticated Arbitrary Post/Page Deletion
• GigPress <= 2.3.29 - Authenticated (Admin+) Stored Cross-Site Scripting
• Emailing Subscription <= 1.4.1 - Unauthenticated SQL Injection
• Hive Support <= 1.2.6 - Unauthenticated Sensitive Information Exposure
• Responsive Tabs <= 4.0.6 - Authenticated (Contributor+) Stored Cross-Site Scripting
• OpenMenu <= 3.5 - Authenticated (Contributor+) Stored Cross-Site Scripting
• Bradmax Player <= 1.1.27 - Authenticated (Contributor+) Stored Cross-Site Scripting
• HUSKY – Products Filter Professional for WooCommerce <= 1.3.6.5 - Unauthenticated Local File Inclusion
• PrivateContent <= 8.4.3 - Protection Mechanism Bypass
• Jigoshop – Store Toolkit <= 1.3.8 - Missing Authorization Checks
• Festy <= 1.13.0 - Unauthenticated Local File Inclusion
• WP Docs <= 1.9.8 - Missing Authorization via multiple AJAX actions
• Listar – Directory Listing & Classifieds WordPress Plugin <= 3.0.0 - Missing Authorization to Authenticated (Subscriber+) Listing Update
• Advanced Access Manager <= 6.9.15 - Authenticated (Contributor+) Stored Cross-Site Scripting
• Advanced Custom Fields Pro <= 5.9.0 - Reflected Cross-Site Scripting
• FL3R FeelBox <= 8.1 - Cross-Site Request Forgery leading to Plugin Settings Reset
• TablePress <= 2.2.4 - Authenticated(Author+) Server Side Request Forgery(SSRF) via _get_import_files
• TrustedLogin Vendor < 1.1.1 - Unauthenticated Information Disclosure
• WooCommerce OTP Login With Phone Number, OTP Verification <= 1.8.47 - Authentication Bypass
• WordPress Core < 4.4.2 - Open Redirect via wp_validate_redirect
• Schedule Post Changes With PublishPress Future: Unpublish, Delete, Change Status, Trash, Change Categories <= 4.9.1 - Authenticated (Author+) Missing Authorization to Post/Page Status Modification
• AMP for WP <= 0.9.97.20 - Stored Cross-Site Scripting
• Piotnet Forms <= 2.1.40 - Unauthenticated Arbitrary File Upload via Form File Upload
• Smash Balloon Social Photo Feed <= 1.4.6.2 - Cross-Site Request Forgery to Stored Cross-Site Scripting
• cformsII <= 15.1.3 - Cross-Site Request Forgery
• Simple Link Directory <= 8.8.3 - Missing Authorization
• Paid Memberships Pro <= 2.12.8 - Authenticated (Contributor+) User Meta Disclosure
• tagDiv Opt-In Builder <= 1.7.3 - Reflected Cross-Site Scripting
• Gotham Block Extra Light <= 1.5.0 - Authenticated (Contributor+) Arbitrary File Read via 'ghostban' Shortcode
• IMPress for IDX Broker <= 3.2.3 - Authenticated (Contributor+) Stored Cross-Site Scripting
• Kiwi Social Share <= 2.0.10 - Arbitrary Options Update
• Formidable Form Builder < 2.05.03 - Unauthenticated Stored Cross-Site Scripting
• WangGuard <= 1.7.2 - Reflected Cross-Site Scripting
• Email Subscriber <= 1.1 - Stored Cross-Site Scripting
• Counter Box – WordPress plugin for countdown, timer, counter <= 1.2 - SQL Injection
• Livemesh Addons for Beaver Builder <= 3.9.2 - Authenticated (Subscriber+) Stored Cross-Site Scripting via Missing Authorization
• Background Image Cropper <= 1.2 - Unauthenticated Remote Code Execution
• Ninja Forms <= 3.15.4 - Unauthenticated Stored Cross-Site Scripting via Paragraph Text (RTE) Field Submission
• Zigaform <= 7.6.5 - Unauthenticated Form Submission Data Disclosure in rocket_front_payment_seesummary AJAX Endpoint
• WP Custom Cursors < 3.2 - Cross-Site Request Forgery
• Portrait-Archiv.com Photostore < 3.2 - Reflected Cross-Site Scripting
• WP Forms Puzzle Captcha <= 4.1 - Captcha Bypass
• Rank Math SEO – AI SEO Tools to Dominate SEO Rankings <= 1.0.235 - Authenticated (Contributor+) Stored Cross-Site Scripting via Rank Math API
• Slider Revolution <= 6.7.37 - Missing Authorization to Authenticated (Contributor+) Arbitrary File Read
• Error Log Viewer <= 1.1.1 - Arbitrary File Deletion
• Love Travel 1.0 - 1.9 - Reflected Cross-Site Scripting and Cross-Frame Scripting
• Awesome Support <= 6.1.4 - Cross-Site Request Forgery via wpas_edit_reply_ajax()
• WP Controller <= 3.2.0 - Cross-Site Request Forgery to Stored Cross-Site Scripting
• Salon Booking System and Salon Booking System Pro <= 7.6.2 - Sensitive Data Disclosure
• AFS Analytics <= 4.21 - Missing Authorization
• Zephyr Project Manager <= 3.3.203 - Authenticated (Custom+) Arbitrary File Read And Server-Side Request Forgery
• Easy WP SMTP <= 1.5.1 - Authenticated (Admin+) Directory Traversal
• All In One WP Security & Firewall <= 3.9.4 - Reflected Cross-Site Scripting
• Tutor LMS <= 2.1.8 - Missing Authorization via multiple AJAX actions
• WP Floating Menu <= 1.4.0 - Cross-Site Scripting via id Parameter
• Mapa Politico España < 3.7.0 - Stored Cross-Site Scripting
• Image Cleanup <= 1.9.2 - Cross-Site Request Forgery
• Carousel Slider <= 2.2.9 - Authenticated (Editor+) Stored Cross-Site Scripting
• Hostel <= 1.1.3 - Stored Cross-Site Scripting
• DesignThemes Core Features <= 4.7 - Missing Authorization to Unauthenticated Arbitrary File Read via dt_process_imported_file
• Integrate PhonePe with WooCommerce <= 1.2.1 - Unauthenticated Payment Bypass
• User Access Manager < 1.2 - Cross-Site Request Forgery
• Easy CountDowner <= 1.0.8 - Cross-Site Request Forgery
• Form Maker by 10Web <= 1.15.29 - Authenticated (Admin+) Stored Cross-Site Scripting
• Asgaros Forum <= 1.15.14 - Admin+ SQL Injection via forum_id
• Anti-spam, Spam protection, ReCaptcha for all forms and GDPR-compliant <= 4.1.1 - Cross-Site Request Forgery
• Rehub <= 19.6.1 - Authenticated (Editor+) Local File Inclusion
• Payment Plugins for Stripe WooCommerce <= 4.0.7 - Missing Authorization
• Request a Quote for WooCommerce and Elementor – Get a Quote Button – Product Enquiry Form Popup – Product Quotation <= 1.4 - Unauthenticated Arbitrary Shortcode Execution via fire_contact_form
• Youtube Embed Plus <= 14.2.4 - Missing Authorization
• Category D3 Tree <= 1.1 - Authenticated (Contributor+) Stored Cross-Site Scripting
• WP-Download <= 1.2 - SQL Injection
• Wp EMember <= 10.6.6 - Unauthenticated Stored Cross-Site Scripting
• Order Your Posts Manually <= 2.2.5 - Reflected Cross-Site Scripting via '_user_request'
• Project Manager – AI Powered Project Management, Task Management, Kanban Board & Time Tracker 2.2.0 - 4.0.6 - Authenticated (Subscriber+) Insecure Direct Object Reference
• Client Testimonial Slider <= 2.0 - Authenticated (Administrator+) Stored Cross-Site Scripting via 'Testimonial Heading' Setting
• Zephyr Project Manager <= 3.3.201 - Missing Authorization
• Product Feed PRO for WooCommerce <= 11.2.1 - Reflected Cross-Site Scripting
• Error Notification <= 0.2.7 - Cross-Site Request Forgery to Stored Cross-Site Scripting
• WPKit For Elementor <= 1.1.0 - Missing Authorization to Unauthenticated Arbitrary Options Update
• Hesabfa Accounting <= 2.2.4 - Cross-Site Request Forgery
• Client Dash <= 2.2.0 - Authenticated (Admin+) Cross-Site Scripting
• Restaurant Menu and Food Ordering <= 2.4.16 - Missing Authorization to Menu Creation
• uListing <= 1.6.6 - Unauthenticated Arbitrary Roles and Capabilities Creation/Deletion