Vulnerability archive: section 11, page 16

Open a report to review affected versions, available fixes and original sources. Each report covers a specific issue; its presence does not establish whether your website is affected.

• All-In-One Security (AIOS) – Security and Firewall <= 5.0.8 - IP Spoofing to Protection Mechanism Bypass
• JetElements For Elementor <= 2.7.7 - Authenticated (Contributor+) Stored Cross-Site Scripting
• SH Email Alert <= 1.0 - Reflected Cross-Site Scripting
• Jeg Elementor Kit <= 2.6.4 - Authenticated (Contributor+) Cross-Site Scripting via Elementor Widget URL Custom Attributes
• Post/Page Copying Tool to Export and Import post/page for Cross site Migration <= 2.0.3 - Authenticated (Contributor+) Arbitrary File Upload
• RSS Aggregator by Feedzy – Feed to Post, Autoblogging, News & YouTube Video Feeds Aggregator <= 4.4.1 - Missing Authorization
• Beacon <= 2.24 - Unauthenticated Local File Inclusion
• Beaver Builder – WordPress Page Builder <= 2.7.2 - Authenticated (Contributor+) Stored Cross-Site Scripting
• GeoDirectory <= 2.8.190 - Authenticated (Subscriber+) Stored Cross-Site Scripting via Dynamic Content Field-Token Substitution via Listing Title
• ProSolution WP Client < 2.0.11 - Reflected Cross-Site Scripting
• Subscriptions for WooCommerce <= 1.9.5 - Missing Authorization
• WooCommerce - Store Exporter <= 2.7.2 - Reflected Cross-Site Scripting via 'filter'
• My Restaurant Menu <= 0.2.0 - Authenticated (Contributor+) Stored Cross-Site Scripting
• MojoPlug Slide Panel <= 1.1.2 - Authenticated (Administrator+) Stored Cross-Site Scripting
• Cool Tag Cloud <= 2.29 - Authenticated (Contributor+) Stored Cross-Site Scripting
• WordPress Core < 4.5.2 - Cross-Site Scripting via MediaElement.js
• Podlove Web Player <= 5.9.1 - Authenticated (Contributor+) PHP Object Injection
• Featured Image Caption <= 0.8.10 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode
• Simple Google Calendar Outlook Events Widget <= 3.0.0 - Unauthenticated Server-Side Request Forgery
• Slideshow SE <= 2.5.17 - Authenticated (Author+) Limited Local File Inclusion
• Easy PayPal Events & Tickets <= 1.3 - Insecure Direct Object Reference to Unauthenticated Information Exposure
• Go Animate <= 1.0 - Cross-Site Request Forgery to Stored Cross-Site Scripting
• Nitan <= 2.9 - Unauthenticated Local File Inclusion
• Order Splitter for WooCommerce <= 5.3.5 - Missing Authorization to Authenticated (Subscriber+) Order Information Exposure
• Newsletters <= 4.6.18 - Cross-Site Scripting via contentarea Parameter
• miniOrange Discord Integration <= 2.2.2 - Unauthenticated Local File Inclusion
• FunnelKit – Funnel Builder for WooCommerce Checkout <= 3.15.0.1 - Unauthenticated SQL Injection
• Disable Right Click For WP <= 1.1.6 - Cross-Site Request Forgery
• TS Webfonts for SAKURA <= 3.1.0 - Authenticated (Admin+) Stored Cross-Site Scripting
• Notify Odoo <= 1.0.0 - Cross-Site Request Forgery to Stored Cross-Site Scripting
• Ultimate Post Kit <= 4.0.15 - Unauthenticated Information Disclosure
• Product Video Gallery for Woocommerce <= 1.5.1.8 - Authenticated (Shop Manager+) Stored Cross-Site Scripting via custom_thumbnail Parameter
• User Access Manager <= 2.0.8 - Reflected Cross-Site Scripting
• Event Booking Manager for WooCommerce <= 5.1.4 - Reflected Cross-Site Scripting
• Custom 404 Pro <= 3.11.1 - Reflected Cross-Site Scripting
• Super Store Finder <= 7.2 - Unauthenticated SQL Injection
• Media Library Assistant <= 3.15 - Authenticated (Contributor+) SQL Injection via Shortcode
• Build <= 1.0.3 - Authenticated (Contributor+) Stored Cross-Site Scripting
• bbPress Notify <= 2.18.3 - Reflected Cross-Site Scripting
• User Frontend – Membership, User Registration, User Profile, User Directory & Content Restriction with Frontend Post Submission < 4.3.10 - Authenticated (Editor+) PHP Object Injection
• Zonify – Amazon Product Importer for WooCommerce < 1.0.5 - Unauthenticated Information Exposure
• Happy Addons for Elementor <= 3.9.1.1 - Reflected Cross-Site Scripting
• Ultimate Product Catalog <= 4.4.48 - Authenticated (Contributor+) Arbitrary File Upload
• Paytium: Mollie payment forms & donations <= 4.4.2 - Authenticated (Contributor+) Stored Cross-Site Scripting via shortcode
• Advanced CF7 DB <= 2.0.9 - Missing Authorization to Authenticated (Subscriber+) Form Submissions Excel Export
• LadiApp <= 4.3 - Missing Authorization
• Martins Free & Easy SEO BackLink Link Building Network <= 1.2.29 - Reflected Cross-Site Scripting via _wpnonce
• Image Hotspot by DevVN <= 1.2.9 - Authenticated (Author+) Stored Cross-Site Scripting via Custom Field Meta
• Real3D Flipbook – 3D FlipBook, PDF FlipBook, PDF Viewer, PDF Embedder <= 5.5 - Unauthenticated Stored Cross-Site Scripting
• Team Manager <= 2.3.16 - Missing Authorization
• Tag Miner (Automatic Tag Extraction) < 1.1.5 - Cross-Site Scripting
• Cooked <= 1.16.1 - Authenticated (Contributor+) Stored Cross-Site Scripting via [cooked-timer] Shortcode Content
• Countdown, Coming Soon, Maintenance – Countdown & Clock <= 2.3.2 - Cross-Site Scripting
• Ultimate CSV Importer 7.17 - 9.1 - Authenticated (Administrator+) Stored Cross-Site Scripting
• wpLike2Get <= 1.2.9 - Unauthenticated Information Exposure
• Premium Packages <= 7.2.6 - Authenticated (Subscriber+) Stored Cross-Site Scripting via 'checkout[billing][phone]' Parameter
• Fluent Support Pro <= 2.3.1 - Cross-Site Request Forgery
• Multiple Wow-Company Plugins (Various Versions) -- Reflected Cross-Site Scripting via 'page' parameter
• Blue Memories <= 1.5 - Cross-Site Scripting
• AI Engine <= 2.4.7 - Authenticated (Subscriber+) Server-Side Request Forgery
• WoWPth <= 2.0 - Reflected Cross-Site Scripting
• PuppyFW <= 0.4.4 - Authenticated (Subscriber+) Privilege Escalation
• My Shortcodes <= 2.3 - Missing Authorization via Multiple AJAX Actions
• Simple Banner <= 2.11.0 - Authenticated (Administrator+) Stored Cross-Site Scripting
• Timetics <= 1.0.29 - Missing Authorization
• MCP Server for WordPress <= 1.8.1 - Authenticated (Contributor+) Information Exposure
• Royal Addons for Elementor – Addons and Templates Kit for Elementor < 1.7.1066 - Authenticated (Contributor+) Stored Cross-Site Scripting
• what3words Address Field <= 4.0.15 - Cross-Site Request Forgery to Stored Cross-Site Scripting
• myEASYbackup < 1.0.9 - Directory Traversal
• Amely <= 3.1.4 - Unauthenticated SQL Injection
• Creator LMS – WordPress LMS Plugin for Coaches, Cohorts & Course Creators <= 1.2.19 - Authenticated (Contributor+) Path Traversal
• Breadcrumb NavXT <= 7.5.0 - Missing Authorization to Sensitive Information Exposure
• WP Easy Post Types <= 1.4.4 - Authenticated (Contributor+) Stored Cross-Site Scripting via Post Meta
• WP Symposium <= 15.8 - Unauthenticated SQL Injection
• WP Attractive Donations System - Easy Stripe & Paypal donations <= 1.25 - Unauthenticated SQL Injection
• Blocksy Companion <= 2.0.31 - Authenticated (Contributor+) Stored Cross-Site Scripting
• TheGem (Elementor) <= 5.10.5 - Authenticated (Subscriber+) Stored Cross-Site Scripting
• Mingle Forum < 1.0.34 - Unauthenticated SQL Injection
• Bulk <= 1.0.11 - Missing Authorization
• GTDB Guitar Tuners <= 4.2.2 - Authenticated (Contributor+) Stored Cross-Site Scripting
• ProfilePress - Pro <= 4.11.1 - Authentication Bypass via WordPress.com OAuth provider
• Motors – Car Dealer, Classifieds & Listing <= 1.4.107 - Authenticated (Subscriber+) Arbitrary File Deletion via 'stm_dealer_logo_path' Parameter
• Marker.io <= 1.1.6 - Cross-Site Request Forgery
• Post Status Notifier Lite <= 1.12.0 - Reflected Cross-Site Scripting
• All Embed – Elementor Addons <= 1.1.3 - Authenticated (Contributor+) Stored Cross-Site Scripting
• NotificationX <= 2.9.5 - Authenticated (Contributor+) Stored Cross-Site Scripting
• Contact Form by Supsystic <= 1.7.29 - Cross-Site Request Forgery to Stored Cross-Site Scripting via saveAsCopy AJAX Action
• FunnelKit – Funnel Builder for WooCommerce Checkout <= 3.15.0.2 - Missing Authorization
• WordPress Core <= 2.3.3 - Directory Traversal
• Greenmart <= 4.2.3 - Unauthenticated Local File Inclusion
• IP2Location Country Blocker <= 2.38.8 - Missing Authorization to Unauthenticated Information Exposure via admin_init Function
• EWWW Image Optimizer <= 7.2.0 - Unauthenticated Sensitive Information Exposure via Debug Log
• Simple Payment 1.3.6 - 2.3.8 - Authentication Bypass to Admin
• Meks Smart Social Widget <= 1.6.4 - Authenticated (Admin+) Stored Cross-Site Scripting
• Ditty – Responsive News Tickers, Sliders, and Lists <= 3.1.44 - Authenticated (Contributor+) Stored Cross-Site Scripting
• Blog2Social: Social Media Auto Post & Scheduler <= 9.0.0 - Missing Authorization
• a3 Responsive Slider <= 2.1.0 - Cross-Site Request Forgery to Stored Cross-Site Scripting
• Mstoic Shortcodes <= 2.0 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'start' Shortcode Attribute
• Email Subscribers by Icegram Express <= 5.7.20 - Unauthenticated SQL Injection via hash
• Link Whisper Free <= 0.9.4 - Reflected Cross-Site Scripting