Vulnerability archive: section 11, page 12

Open a report to review affected versions, available fixes and original sources. Each report covers a specific issue; its presence does not establish whether your website is affected.

• Nexa Blocks <= 1.1.0 - Authenticated (Contributor+) Server-Side Request Forgery
• Plugin Logic <= 1.0.7 - Authenticated (Administrator+) SQL Injection
• Pagination by BestWebSoft < 1.2.2 - Authenticated (Administrator+) Stored Cross-Site Scripting
• Delicious <= 1.9.5 - Missing Authorization
• Schedule Post Changes With PublishPress Future: Unpublish, Delete, Change Status, Trash, Change Categories <= 4.9.2 - Missing Authorization to Authenticated (Contributor+) Authors' Emails Exposure
• WC Fields Factory <= 4.1.10 - Missing Authorization
• WebLibrarian < 3.4.8.7 - Cross-Site Scripting
• Highlight < 0.9.3 - Authenticated (Admin+) Stored Cross-Site Scripting
• PilotPress <= 2.0.43 - Authenticated (Subscriber+) Privilege Escalation via Account Takeover via 'username' Parameter
• Gutenverse <= 1.8.5 - Missing Authorization via 'data/update' API Endpoint
• Smart Popup by Supsystic <= 1.13.1 - Unauthenticated Stored Cross-Site Scripting
• EasyPay <= 4.3.0 - Unauthenticated Information Exposure
• Breeze – WordPress Cache Plugin <= 2.0.2 - Unprotected AJAX Actions
• Dynamics 365 Integration <= 1.3.23 - Authenticated (Contributor+) Remote Code Execution and Arbitrary File Read via Twig Server-Side Template Injection
• Plugin BlueX for WooCommerce <= 3.1.4 - Missing Authorization
• Simple User Profile <= 1.9 - Cross-Site Request Forgery to Stored Cross-Site Scripting
• WP Forum Server < 1.7.5 - Cross-Site Scripting
• cformsII <= 15.0.6 - Unauthenticated Stored Cross-Site Scripting
• Exchange Rates <= 1.2.5 - Authenticated (Contributor+) Stored Cross-Site Scripting
• Counter Box <= 2.0.13 - Authenticated (Administrator+) PHP Object Injection via Import
• WP Lead Plus X <= 0.98 - Stored Cross-Site Scripting
• Tabulate <= 2.10.3 - Reflected Cross-Site Scripting
• Avada (Fusion) Builder <= 3.15.1 - Authenticated (Subscriber+) Limited Arbitrary WordPress Action Execution
• WP-Lister Lite for eBay <= 3.8.11 - Authenticated (Shop Manager+) SQL Injection
• Progress Tracker <= 0.9.3 - Authenticated (Contributor+) Stored Cross-Site Scripting
• Behance Portfolio Manager <= 1.7.5 - Cross-Site Request Forgery
• Trendy Restaurant Menu <= 1.0.0 - Authenticated (Contributor+) Stored Cross-Site Scripting
• dTabs <= 1.4 - Reflected Cross-Site Scripting
• Wpik WordPress Basic Ajax Form <= 1.0 - Authenticated (Contributor+) Stored Cross-Site Scripting
• BetterDocs – Best Documentation, FAQ & Knowledge Base Plugin with AI Support & Instant Answer for Elementor & Gutenberg <= 3.3.3 - Unauthenticated PHP Object Injection
• Copyscape Premium <= 1.3.8 - Cross-Site Request Forgery
• Metform Elementor Contact Form Builder <= 3.3.0 - Authenticated (Contributor+) Stored Cross-Site Scripting via mf_thankyou shortcode
• Booking Ultra Pro <= 1.1.13 - Unauthenticated Local File Inclusion
• Jobica Core <= 1.4.2 - Missing Authorization
• Curvo Theme (All Known Versions) - Cross-Site Request Forgery and Arbitrary File Upload
• Persian Woocommerce SMS <= 7.2.3 - Reflected Cross-Site Scripting
• Tour Master - Tour Booking, Travel, Hotel <= 5.4.9 - Unauthenticated Stored Cross-Site Scripting
• Paid Member Subscriptions <= 2.4.1 - Reflected Cross-Site Scripting
• HandL UTM Grabber / Tracker <= 2.8.0 - Reflected Cross-Site Scripting
• File Manager <= 7.2.7 - Missing Authorization
• Order Delivery Date for WP e-Commerce <= 1.2 - Unauthenticated Stored Cross-Site Scripting
• Accessibility <= 1.0.6 - Cross-Site Request Forgery
• Simple Video Directory <= 1.4.3 - Authenticated (Admin+) Stored Cross-Site Scripting
• Dynamic Pricing With Discount Rules for WooCommerce <= 4.5.11 - Unauthenticated Stored Cross-Site Scripting
• Timetable and Event Schedule by MotoPress <= 2.4.11 - Authenticated (Contributor+) SQL Injection
• WP Visitor Statistics (Real Time Traffic) <= 8.7 - Unauthenticated SQL Injection via 'fullRef' Parameter
• Stockdio Historical Chart < 2.8.1 - Reflected Cross-Site Scripting
• Wise Chat <= 2.6.3 - Reverse Tabnabbing
• Google Doc Embedder <= 2.6.1 - Cross-Site Scripting
• Role Includer <= 1.6 - Reflected Cross-Site Scripting via user_id Parameter
• Image Gallery – Grid Gallery <= 1.1.1 - Stored Cross-Site Scripting
• SiteOrigin Widgets Bundle <= 1.64.0 - Missing Authorization
• Custom Dashboard Widget <= 1.0.0 - Authenticated (Contributor+) Stored Cross-Site Scripting
• GEO my WordPress <= 4.5.0.1 - Unauthenticated Local File Inclusion
• Special Feed Items <= 1.0.1 - Cross-Site Request Forgery to Stored Cross-Site Scripting
• Responsive <= 5.0.2 - Missing Authorization to HTML Injection
• Dropdown Menu Widget <= 1.9.7 - Cross-Site Request Forgery to Stored Cross-Site Scripting
• Import Export Suite for CSV and XML Datafeed <= 7.19 - Authenticated (Subscriber+) Arbitrary File Upload
• WP SEO Redirect 301 <= 2.3.1 - Cross-Site Request Forgery
• Custom Login And Signup Widget <= 1.0 - Authenticated (Administrator+) Remote Code Execution
• Realtyna Organic IDX plugin + WPL Real Estate <= 5.4.1 - Reflected Cross-Site Scripting
• Appsero <= 1.2.1 - Missing Authorization
• Post SMTP – Complete Email Deliverability and SMTP Solution with Email Logs, Alerts, Backup SMTP & Mobile App 4.0.0-beta.1 - Missing Authorization to Authenticated (Subscriber+) Settings Change
• DHVC Form <= 2.4.7 - Unauthenticated Privilege Escalation
• Tutor LMS <= 3.9.12 - Authenticated (Subscriber+) Insecure Direct Object Reference to Quiz Attemp Modification
• Sermon Browser < 0.43.6 - Cross-Site Scripting
• CM E-Mail Blacklist – Simple email filtering for safer registration <= 1.5.5 - Reflected Cross-Site Scripting
• Diza <= 1.3.9 - Unauthenticated Local File Inclusion
• LatePoint <= 4.9.91 - Cross-Site Request Forgery
• Customizer Export/Import <= 0.9.7 - Authenticated (Admin+) Arbitrary File Upload via Customization Settings Import
• VR Frases <= 3.0.1 - Reflected Cross-Site Scripting
• Easy Appointments <= 3.12.21 - Missing Authorization
• Ultimate Review <= 2.4.3 - Unauthenticated Persistent Denial of Service
• Jeg Elementor Kit <= 2.6.4 - Authenticated (Contributor+) Stored Cross-Site Scripting via Countdown Widget
• Images to WebP < 1.9 - Cross-Site Request Forgery
• Cackle <= 4.33 - Cross-Site Request Forgery
• Filr – Secure document library <= 1.2.3.5 - Authenticated (Author+) Arbitrary File Upload
• Login as User <= 1.0.3 - Authenticated (Subscriber+) Privilege Escalation via 'oclaup_original_admin' Cookie
• SpiderVPlayer < 1.5.18 - Multiple Blind Authenticated SQL Injections
• Ocean Extra <= 2.1.1 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode
• SecuPress Free <= 2.3.9 - Missing Authorization to Authenticated (Subscriber+) Arbitrary Plugin Installation
• XStore Core <= 5.3.8 - Unauthenticated PHP Object Injection
• Blog2Social: Social Media Auto Post & Scheduler <= 8.8.2 - Missing Authorization to Authenticated (Subscriber+) Arbitrary Post Meta Deletion via 'b2s_reset_social_meta_tags' AJAX Action
• phpCAS authentication library < 1.6.0 - Service Hostname Discovery Exploitation
• GenerateBlocks <= 2.1.1 - Improper Authorization to Authenticated (Contributor+) Arbitrary Options Disclosure
• SpamReferrerBlock <= 2.22 - Cross-Site Request Forgery
• Simple Giveaways <= 2.45.0 - Authenticated (Editor+) Stored Cross-Site Scripting via Form, Prize, and Sharing Method Fields
• Sign-up Sheets <= 1.0.13 - Authenticated CSV Injection
• ImageRecycle pdf & image compression <= 3.1.13 - Missing Authorization to Settings Update in enableOptimization
• Survey Form Block <= 1.0.1 - Missing Authorization to Authenticated (Subscriber+) Survey Submission Data Export
• SysBasics Customize My Account for WooCommerce <= 4.3.6 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode Attributes
• XTRA Settings <= 2.1.8 - Reflected Cross-Site Scripting
• ARMember <= 4.0.23 - Authenticated (Administrator+) Stored Cross-Site Scripting
• ARforms <= 6.4 - Authenticated (Subscriber+) SQL Injection
• WordPress Core <= 3.0.3 - Cross-Site Scripting
• WooCommerce 9.8.0 - 11.1.2 - Authenticated (Shop Manager+) Privilege Escalation
• Scheduled Announcements Widget <= 0.2 - Authenticated (Contributor+) Stored Cross-Site Scripting
• BSK Forms Blacklist <= 3.8 - Reflected Cross-Site Scripting
• Image Photo Gallery Final Tiles Grid <= 3.6.8 - Authenticated (Author+) Stored Cross-Site Scripting via 'Custom Scripts' Setting
• Plotly < 1.0.3 - Stored Cross-Site Scripting