Vulnerability archive: section 11, page 17

Open a report to review affected versions, available fixes and original sources. Each report covers a specific issue; its presence does not establish whether your website is affected.

• SEO Redirection Plugin – 301 Redirect Manager <= 9.18 - Authenticated (Subscriber+) Information Exposure
• Spectra – WordPress Gutenberg Blocks <= 2.19.0 - Authenticated (Contributor+) Stored Cross-Site Scripting
• EventPrime <= 2.8.6 - Reflected Cross-Site Scripting
• Watu Quiz <= 3.3.9.2 - Reflected Cross-Site Scripting via 'question'
• CM Tooltip Glossary <= 3.9.20 - Authenticated Stored Cross-Site Scripting
• Hotlink2Watermark <= 0.3.2 - Cross-Site Request Forgery
• WPForms <= 2.0.0.1 - Authenticated (Contributor+) Stored Cross-Site Scripting via OptinMonster Integration data-sitekey Attribute in Post Content
• Awesome Support <= 6.1.4 - Authenticated (Submitter+) Arbitrary File Deletion
• WPC Smart Compare for WooCommerce <= 6.6.0 - Unauthenticated Information Exposure
• Download Plugins and Themes in ZIP from Dashboard <= 1.9.1 - Reflected Cross-Site Scripting
• YourChannel <= 1.2.4 - Cross-Site Request Forgery to Plugin Channel Reset
• Colibri Page Builder <= 1.0.240 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode
• Sympl Repeater for ACF and Elementor <= 2.3 - Authenticated (Author+) Stored Cross-Site Scripting via ACF Repeater Field Values
• Anomify AI <= 0.3.6 - Authenticated (Administrator+) Stored Cross-Site Scripting via 'anomify_api_key' Parameter
• WholeSale Products Dynamic Pricing Management WooCommerce <= 1.2 - Authenticated (Administrator+) Stored Cross-Site Scripting via Plugin Settings
• Ultimate Client Dash <= 4.7 - Authenticated (Administrator+) Stored Cross-Site Scripting
• bbPress Move Topics <= 1.1.6 - Reflected Cross-Site Scripting
• Edwiser Bridge <= 2.0.6 - Cross-Site Request Forgery Bypass
• Location Weather <= 3.0.2 - Missing Authorization to Authenticated (Contributor+) Block Settings Modification and Cache Purging
• CBX Accounting & Bookkeeping <= 1.3.14 - Reflected Cross-Site Scripting
• WP Hotel Booking <= 2.1.5 - Missing Authorization
• SpiderCalendar <= 1.6.64 - Reflected Cross-Site Scripting
• Contact Form by FormGet < 5.3.1 - Authenticated Stored Cross-Site Scripting
• Frontend Content Forms for User Submissions (UGC) <= 2.8.13 - Authenticated (Contributor+) Stored Cross-Site Scripting
• WCFM Marketplace <= 3.4.12 - Cross-Site Request Forgery
• Site Offline <= 1.4.9 - Maintenance Mode Bypass
• Custom Share Buttons with Floating Sidebar <= 4.1 - Stored Cross-Site Scripting
• ProfilePress <= 4.16.12 - Missing Authorization to Authenticated (Subscriber+) Inactive Membership Plan Subscription
• Image Hover Effects – Elementor Addon <= 1.3.3 - Authenticated Stored Cross-Site Scripting
• Visitor Traffic Real Time Statistics pro <= 11.10 - Authenticated (Subscriber+) SQL Injection
• Resume Submissions & Job Postings < 2.5.2 - Arbitrary File Upload
• 1003 Mortgage Application <= 1.75 - Unauthenticated CSV Injection
• Wordpress Auto Spinner <= 3.25.0 - Missing Authorization
• WooCommerce <= 3.2.3 - Authenticated PHP Object Injection
• Potent Donations for WooCommerce <= 1.1.9 - Cross-Site Request Forgery in hm_wcdon_admin_page
• Zenny <= 1.7.5 - Unauthenticated Local File Inclusion
• WordPress Core < 6.5.5 - Authenticated (Contributor+) Stored Cross-Site Scripting via Template Part Block
• Cornerstone <= 0.8.0 - Reflected Cross-Site Scripting via PHP_SELF
• AI Content Writing Assistant (Content Writer, ChatGPT, Image Generator) All in One <= 1.1.6 - Cross-Site Request Forgery
• Clean Login <= 1.5 - Reflected Cross-Site Scripting
• Coming Soon Page – Responsive Coming Soon & Maintenance Mode <= 1.1.18 - Cross-Site Scripting via logo_width parameter
• WPC Estimated Delivery Date for WooCommerce <= 4.0.1 - Reflected Cross-Site Scripting via 'rule_data' Parameter
• Nmedia WordPress Member Conversation < 1.4 - Arbitrary File Upload
• Simple Download Counter <= 2.2 - Authenticated (Contributor+) Stored Cross-Site Scripting
• Jquery Validation For Contact Form 7 <= 5.2 - Cross-Site Request Forgery to Arbitrary Options Update
• Doofinder for WooCommerce <= 2.1.8 - Authenticated (Administrator+) Stored Cross-Site Scripting via settings
• Direct Payments WP <= 1.3.0 - Missing Authorization
• WP Symposium <= 15.8.1 - Reflected Cross-Site Scripting
• Nexter Blocks <= 4.0.7 - Missing Authorization
• URL Preview <= 1.0 - Unauthenticated Server-Side Request Forgery via 'url' Parameter
• Wholesale Market <= 2.2.2 - Authenticated (Subscriber+) Privilege Escalation via 'role_required' Parameter
• RD Order Modifier for WooCommerce <= 1.0.5 - Cross-Site Request Forgery
• Mailster <= 1.0.3 - Reflected Cross-Site Scripting
• Elementor AI Addons – 70 Widgets, Premium Templates, Ultimate Elements <= 2.2.1 - Authenticated (Contributor+) Private Templates Content Disclosure
• Ultimate Member <= 2.12.1 - Authenticated (Subscriber+) Stored Cross-Site Scripting via Textarea Profile Field with HTML Support (DOM Gadget via id Attribute)
• Beaver Builder Page Builder – Drag and Drop Website Builder <= 2.10.1.1 - Authenticated (Author+) Stored Cross-Site Scripting via 'settings[js]'
• Link Whisper Free <= 0.8.8 - Reflected Cross-Site Scripting
• Ultimate FAQ <= 2.4.3 - Cross-Site Request Forgery
• RegistrationMagic <= 6.0.9.8 - Authentication Bypass
• Add User Autocomplete < 1.2 - Authenticated (Subscriber+) Privilege Escalation
• SyntaxHighlighter Evolved <= 3.1.9 - Cross-Site Scripting
• Contact Form 7 Star Rating with font Awesome <= 1.3 - Authenticated (Editor+) Stored Cross-Site Scripting
• Button <= 1.1.27 - Authenticated (Contributor+) PHP Object Injection in button_shortcode
• Estatik <= 2.3.0 - Cross-Site Request Forgery to Arbitrary File Upload
• Pre* Party Resource Hints < 1.8.19 - Authenticated(Administrator+) SQL Injection
• Traveler <= 3.1.8 - Unauthenticated Local File Inclusion via hotel_alone_load_more_post
• File Upload <= 5.1.7 - Unauthenticated SQL Injection
• TheGem < 5.8.1.1 - Missing Authorization
• Mr. Cobbler | Custom Shoemaking & Footwear Repairs WordPress Theme <= 1.1.9 - Unauthenticated Local File Inclusion
• The Aisle Core <= 2.0.5 - Unauthenticated Local File Inclusion
• Add Hierarchy (parent) to post <= 3.12 - Reflected Cross-Site Scripting
• YMC Filter <= 3.12.7 - Authenticated (Contributor+) Stored Cross-Site Scripting
• Web Stories Widgets For Elementor <= 1.1 - Authenticated (Contributor+) Stored Cross-Site Scripting
• Realty Workstation <= 1.0.9 - Authenticated SQL Injection
• WP Maps <= 4.8.6 - Authenticated (Subscriber+) Limited Local File Inclusion
• H5P CSS Editor <= 1.0 - Reflected Cross-Site Scripting
• BM Content Builder < 3.16.3.3 - Authenticated (Contributor+) Arbitrary File Deletion
• Woo MerchantX <= 1.0 - Cross-Site Request Forgery
• Royal Elementor Addons <= 1.3.59 - Insufficient Access Control to Theme Activation
• Contact Form 7 Database Addon – CFDB7 <= 1.2.6.8 - Unauthenticated Sensitive Information Exposure
• MStore API – Create Native Android & iOS Apps On The Cloud <= 4.20.0 - Unauthenticated Privilege Escalation
• WP Smiley <= 1.4.1 - Cross-Site Scripting
• Albo Pretorio Online <= 4.6.1 - Reflected Cross-Site Scripting
• Resume Builder <= 3.1.1 - Authenticated (Subscriber+) Stored Cross-Site Scripting
• Traveler < 3.2.6 - Reflected Cross-Site Scripting
• WP Media folder <= 5.7.2 - Missing Authorization to Authenticated(Subscriber+) Plugin settings change
• Advanced File Manager Shortcode <= 2.5.3 - Authenticated (Contributor+) Arbitrary File Upload
• Small Package Quotes – Purolator Edition <= 3.6.4 - Unauthenticated SQL Injection
• Piotnet Forms <= 1.0.30 - Authenticated (Editor+) Stored Cross-Site Scripting
• BU Slideshow <= 2.3.10 - Authenticated (Contributor+) Stored Cross-Site Scripting
• VikRentItems Flexible Rental Management System <= 1.2.3 - Unauthenticated SQL Injection
• ARMember Premium <= 7.3.1 - Unauthenticated SQL Injection via 'order' Parameter
• Sina Extension for Elementor <= 3.10.1 - Reflected Cross-Site Scripting
• Find Unused Images <= 1.0.7 - Missing Authorization to Unauthenticated Arbitrary Attachment Deletion
• Carousel, Slider, Gallery by WP Carousel <= 2.7.3 - Authenticated (Admin+) Stored Cross-Site Scripting
• Hydra Booking <= 1.2.2 - Authenticated (Host+) Stored Cross-Site Scripting via 'first_name' Parameter
• Visitor Stats Widget <= 1.5.0 - Reflected Cross-Site Scripting
• Happy Addons for Elementor <= 3.10.9 - Authenticated (Contributor+) Stored Cross-Site Scripting via Image Accordion
• Simple Photo Gallery <= 1.8.0 - Stored Cross-Site Scripting
• Leyka <= 3.31.9 - Authenticated (Contributor+) Stored Cross-Site Scripting