Vulnerability archive: section 11, page 19

Open a report to review affected versions, available fixes and original sources. Each report covers a specific issue; its presence does not establish whether your website is affected.

• PVN Auth Popup <= 1.0.0 - Authenticated (Admin+) Stored Cross-Site Scripting
• LearnPress – WordPress LMS Plugin for Create and Sell Online Courses <= 4.4.9 - Unauthenticated Stored Cross-Site Scripting
• LiteSpeed Cache <= 6.2.0.1 - Cross-Site Request Forgery to Stored Cross-Site Scripting
• WP Customer Area <= 8.3.4 - Authenticated (Custom+) Path Traversal
• Elementor Addon Elements <= 1.12.12 - Authenticated (Contributor+) Stored Cross-Site Scripting via Dual Button Widget
• Spectra – WordPress Gutenberg Blocks <= 2.3.1 - HTML Injection in Emails
• Stripe Payment Plugin for WooCommerce <= 3.5.9 - Reflected Cross-Site Scripting
• Taxi Booking Manager for WooCommerce <= 1.2.1 - Missing Authorization
• CubeWP Framework <= 1.1.24 - Authenticated (Subscriber+) Privilege Escalation
• The Plus Addons for Elementor Pro <= 5.0.6 - Sensitive Data Disclosure
• ADFO – Custom data in admin dashboard <= 1.9.0 - Cross-Site Request Forgery
• Smart Popup by Supsystic <= 1.13.0 - Missing Authorization
• Ocean Extra <= 2.2.8 - Authenticated (Contributor+) Stored Cross-Site Scripting via Flickr Widget
• B Slider- Gutenberg Slider Block for WP <= 1.1.30 - Authenticated (Subscriber+) Missing Authorization to Arbitrary Plugin Installation
• Email Subscribers & Newsletters < 4.3.1 - Unauthenticated Blind SQL Injection
• Events Manager <= 7.4.0 - Missing Authorization to Unauthenticated Sensitive Information Disclosure via 'status', 'private', and 'private_only' Parameters
• Bootstrap collapse <= 1.0.4 - Cross-Site Request Forgery to Stored Cross-Site Scripting
• Aruba HiSpeed Cache <= 3.0.4 - Cross-Site Request Forgery to Plugin Settings Reset
• Advanced Ads – Ad Manager & AdSense <= 2.0.26 - Authenticated (Subscriber+) Information Exposure
• Product Feed PRO for WooCommerce <= 12.4.4 - Cross-Site Request Forgery
• Nested Pages <= 3.3.2 - Authenticated (Contributor+) PHP Object Injection
• Easy Theme Options <= 1.0 - Reflected Cross-Site Scripting
• Jetpack – WP Security, Backup, Speed, & Growth <= 13.3.1 - Authenticated (Contributor+) Stored Cross-Site Scripting via wpvideo Shortcode
• Uncanny Automator – Easy Automation, Integration, Webhooks & Workflow Builder Plugin <= 7.3.1.2 - Unauthenticated PHP Object Injection
• MkRapel Regiones y Ciudades de Chile para WC <= 4.3.0 - Cross-Site Request Forgery via multiple functions
• Herd Effects <= 5.2.3 - Cross-Site Request Forgery to Effect Deletion
• Add to Header <= 1.0 - Cross-Site Request Forgery to Stored Cross-Site Scripting
• VikRentCar Car Rental Management System <= 1.3.0 - Authenticated (Admin+) Cross Site Scripting
• Pushe Web Push Notification <= 0.5.0 - Authenticated (Administrator+) Stored Cross-Site Scripting
• WP Statistics <= 12.6.6.1 - Unauthenticated Stored Cross-Site Scripting via IP Manipulation
• Cool Flipbox – Shortcode & Gutenberg Block <= 1.8.3 - Reflected Cross-Site Scripting
• Smart Slider 3 <= 3.5.1.33 - Authenticated (Subscriber+) Arbitrary File Read via actionExportAll
• Timetics – Appointment Booking & Scheduling <= 1.0.53 - Missing Authorization
• Lobot Slider Administrator <= 0.6.0 - Cross-Site Request Forgery to Settings Update
• Vimeo Video Autoplay Automute <= 1.0 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode
• ND Shortcodes <= 7.5 - Authenticated (Author+) Stored Cross-Site Scripting
• Auto FTP <= 1.0.1 - Cross-Site Request Forgery to Stored Cross-Site Scripting
• Product Attachment for WooCommerce < 2.3.3 - Unauthenticated Information Exposure
• WordPress Users <= 1.3 - SQL Injection
• WP Support Plus Responsive Ticket System <= 9.1.1 - Stored Cross-Site Scripting
• Product Labels For Woocommerce <= 1.5.8 - Authenticated (Administrator+) SQL Injection
• WP Password Policy <= 3.7.1 - Authenticated (Subscriber+) Privilege Escalation
• Goftino <= 1.6 - Authenticated (Subscriber+) Stored Cross-Site Scripting
• CubeWP – All-in-One Dynamic Content Framework <= 1.1.27 - Unauthenticated Post Disclosure in class-cubewp-search-ajax-hooks.php
• TempTool [Show Current Template Info] <= 1.3.1 - Authenticated (Contributor+) Stored Cross-Site Scripting
• Tribe <= 1.7.3 - Unauthenticated Local File Inclusion
• Web en Mantenimiento <= 1.0.6 - Cross-Site Request Forgery to Settings Update
• WPMK Block <= 1.0.1 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode Attributes
• Counters Block <= 1.1.2 - Authenticated (Contributor+) Stored Cross-Site Scripting
• Popup Image <= 1.0.1 - Authenticated (Contributor+) Stored Cross-Site Scripting
• Side Menu Lite - add sticky fixed buttons < 2.2.6 - SQL Injection
• Social Media Share Buttons & Social Sharing Icons <= 3.0.1 - Reflected DOM-Based Cross-Site Scripting via URL
• Klubraum Membership Request <= 1.1.0 - Missing Authorization to Unauthenticated Arbitrary Plugin Settings Update
• Dokan <= 5.1.0 - Authenticated (Vendor+) Information Exposure
• 2Checkout Payment Gateway for WooCommerce <= 6.2 - Missing Authorization via sniff_ins
• Make Email Customizer for WooCommerce <= 1.0.6 - Authenticated (Subscriber+) Arbitrary Options Update
• Yada Wiki <= 3.5 - Authenticated (Contributor+) Stored Cross-Site Scripting
• Custom Field Template <= 2.6 - Authenticated (Contributor+) Stored Cross-Site Scripting via $search_label
• Private Messages for UserPro <= 4.10.0 - Reflected Cross-Site Scripting
• ARForms Form Builder <= 6.5 - Unauthenticated Arbitrary File Upload
• Paid Membership Plugin, Ecommerce, User Registration Form, Login Form, User Profile & Restrict Content <= 4.16.18 - Authenticated (Author+) Limited Unsafe File Upload via upload_mimes Filter Expansion
• Custom Login Page Styler <= 7.1.1 - Missing Authorization to Authenticated (Subsciber+) Log Deletion and Session Termination
• Role Based Pricing for WooCommerce <= 1.6.2 - Missing Authorization to PHAR Deserialization
• SEO Flow by LupsOnline <= 2.2.1 - Unauthenticated Arbitrary Post/Category Modification
• LeadSnap <= 1.23 - Unauthenticated PHP Object Injection via AJAX
• PO/MO Editor <= 1.4.2 - Authenticated (Subscriber+) Stored Cross-Site Scripting via 'podata' Parameter
• FastBots <= 1.0.12 - Authenticated (Administrator+) Stored Cross-Site Scripting via Plugin Settings
• WordPress Core < 4.0 - Missing Session Cookie Expiration
• MailOptin <= 1.2.54.0 - Authenticated (Admin+) Cross Site Scripting
• ShoutOut <= 4.0.2 - Reflected Cross-Site Scripting
• WPCargo Track & Trace <= 6.9.4 - Reflected Cross-Site Scripting
• Kiwiz - Certification de facturation - Woocommerce <= 2.1.3 - Unauthenticated Arbitrary File Download
• Traveler <= 3.2.6 - Missing Authorization
• Note Press <= 0.1.10 - Authenticated (Admin+) SQL Injection via id Parameter
• jQuery HTML5 File Upload <= 3.0 - Unauthenticated Settings Update
• Find Your Reps <= 1.2 - Cross-Site Request Forgery to Stored Cross-Site Scripting
• AtomChat <= 1.1.6 - Authenticated (Contributor+) Stored Cross-Site Scripting
• DA Media GigList <= 1.9.0 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'list_title' Shortcode Attribute
• Gallery Images Ape <= 2.2.8 - Missing Authorization
• Spectra <= 2.13.7 - Missing Authorization via generate_ai_content
• Official CleverReach Plugin for WooCommerce <= 3.4.4 - Cross-Site Request Forgery to Settings Update
• Orbit Fox: Duplicate Page, Menu Icons, SVG Support, Cookie Notice, Custom Fonts & More <= 3.0.6 - Authenticated (Administrator+) Stored Cross-Site Scripting via 'menu-item-icon' Parameter
• Quiz Maker <= 6.7.0.88 - Authenticated (Admin+) Stored Cross-Site Scripting
• ProductDyno <= 1.0.24 - Reflected Cross-Site Scripting via 'res' Parameter
• WP Email Users <= 1.7.6 - SQL Injection
• Client Power Tools Portal <= 1.9.0 - Reflected Cross-Site Scripting
• Malware Scanner <= 4.7.1 - IP Spoofing
• Dropdown Content <= 1.0.2 - Authenticated (Contributor+) Stored Cross-Site Scripting
• Archives Calendar Widget <= 1.0.15 - Authenticated (Admin+) Stored Cross-Site Scripting
• MultiVendorX – WooCommerce Multivendor Marketplace AI Powered Solutions <= 5.0.10 - Missing Authorization
• Updraft <= 0.6.1 - Reflected Cross-Site Scripting via 'backup_timestamp'
• WP VR – 360 Panorama and Free Virtual Tour Builder For WordPress <= 8.5.32 - Authenticated (Contributor+) Stored Cross-Site Scripting
• Tablesome <= 1.1.35.1 - Authenticated (Subscriber+) Information Exposure
• Dynamic Elementor Addons <= 1.0.0 - Authenticated (Contributor+) Local File Inclusion
• WPAdmin AWS CDN <= 2.0.13 - Cross-Site Request Forgery
• Sensei LMS – Online Courses, Quizzes, & Learning <= 4.24.1 - Unauthenticated Email Template Disclosure
• Super Forms <= 6.3.316 - Unauthenticated Privilege Escalation via 'role' Parameter
• TheBi <= 1.0.5 - Reflected Cross-Site Scripting
• Gwolle Guestbook <= 2.5.3 - Cross-Site Scripting
• Wptobe-signinup <= 1.1.2 - Reflected Cross-Site Scripting