Vulnerability archive: section 11, page 2

Open a report to review affected versions, available fixes and original sources. Each report covers a specific issue; its presence does not establish whether your website is affected.

• WP Slider Plugin <= 1.4.5 - Authenticated (Admin+) Cross-Site Scripting
• Tutor LMS <= 4.0.8 - Authenticated (Subscriber+) Reflected DOM-Based Cross-Site Scripting via 'redirect_url' Parameter
• Tainá <= 0.2.4 - Authenticated (Subscriber+) Stored Cross-Site Scripting
• Ultra Addons for Contact Form 7 <= 3.5.21 - Authenticated (Contributor+) Stored Cross-Site Scripting via UACF7_CUSTOM_FIELDS Shortcode
• WP Travel Engine – Tour Booking Plugin – Tour Operator Software <= 6.7.10 - Missing Authorization
• Testimonial Slider <= 2.2.6 - Stored Cross-Site Scripting
• VDZ Google Analytics or Google Tag Manager < 1.4.9 - Authenticated (Admin+) Stored Cross-Site Scripting
• WpEvently <= 4.2.9 - Missing Authorization
• Premium Courses & eLearning <= 1.0.5 - SQL Injection
• SEO Backlink Monitor <= 1.6.0 - Authenticated (Administrator+) Server-Side Request Forgery
• Timetable and Event Schedule by MotoPress <= 2.3.19 - Arbitrary User's Hashed Password/Email/Username Disclosure
• ExactMetrics 8.6.0 - 9.0.2 - Authenticated (Custom) Insecure Direct Object Reference to Arbitrary Plugin Installation
• Xpro Elementor Addons <= 1.4.4.2 - Authenticated (Contributor+) Stored Cross-Site Scripting
• PHP Everywhere <= 2.0.3 - Remote Code Execution by Contributor+ users via gutenberg block
• FormBuilder <= 1.08 - Cross-Site Request Forgery
• Groundhogg <= 4.2.6.1 - Authenticated (Admin+) SQL Injection
• MetalpriceAPI <= 1.1.4 - Authenticated (Contributor+) Remote Code Execution
• Greenshift <= 11.0.2 - Authenticated (Contributor+) Stored Cross-Site Scripting
• BP Email Assign Templates <= 1.7 - Authenticated (Admin+) Arbitrary Option Deletion
• WP Multilang – Translation and Multilingual Plugin <= 2.4.31 - Unauthenticated Stored Cross-Site Scripting
• Advanced Excerpt <= 4.4 - Authenticated (Administrator+) Stored Cross-Site Scripting
• Simple Custom Author Profiles <= 1.0.0 - Authenticated (Administrator+) Stored Cross-Site Scripting
• Advanced Database Cleaner <= 3.1.6 - Cross-Site Request Forgery
• MapPress Maps for WordPress <= 2.94.9 - Authenticated (Administrator+) Stored Cross-Site Scripting
• Gracey < 1.4 - Unauthenticated PHP Object Injection
• JobHunt Job Alerts <= 3.6 - Missing Authorization to Unauthenticated Arbitrary Content Deletion
• Datalogics Ecommerce Delivery <= 2.6.65 - Missing Authorization to Authenticated (Subscriber+) Arbitrary Modification via Multiple AJAX Actions (datalogics_create_shipping / datalogics_cancel_shipping)
• Social Auto Poster <= 2.1.4 - Cross-Site Request Forgery to Plugin Settings Reset
• Unlimited Elements for Elementor <= 2.0.19 - Authenticated (Contributor+) PHP Object Injection
• Royal Elementor Addons <= 1.3.93 - Unauthenticated IP Spoofing
• Unsafe Mimetypes <= 0.1.4 - Cross-Site Request Forgery to Stored Cross-Site Scripting
• Lewe ChordPress <= 3.9.7 - Cross-Site Request Forgery to Stored Cross-Site Scripting
• AZIndex <= 0.8.1 - Cross-Site Request Forgery to Index Deletion
• Bookit <= 2.5.0 - Missing Authorization to Unauthenticated Settings Update
• GuruWalk Affiliates <= 1.0.0 - Authenticated (Administrator+) Stored Cross-Site Scripting via plugin settings
• Service Finder SMS System <= 2.0.0 - Authentication Bypass
• Custom Add User <= 2.0.2 - Reflected Cross-Site Scripting
• Integration for Keap/infusionsoft and Contact Form 7, WPForms, Elementor, Formidable, Ninja Forms <= 1.2.1 - Unauthenticated PHP Object Injection
• DearFlip <= 2.2.26 - Authenticated (Contributor+) Stored Cross-Site Scripting via force_fit
• NotificationX – Best FOMO, Social Proof, WooCommerce Sales Popup & Notification Bar Plugin With Elementor <= 2.8.2 - Unauthenticated SQL Injection
• Carousel, Recent Post Slider and Banner Slider <= 2.0 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode
• External Links in New Window / New Tab <= 1.42 - Unauthenticated Stored Cross-Site Scripting
• Download Manager <= 3.2.49 - IP Blocking Bypass
• PowerPress <= 10.0.1 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode
• Admin and Customer Messages After Order for WooCommerce: OrderConvo <= 14 - Missing Authorization to Unauthenticated Information Disclosure
• File Manager Pro <= 8.3.4 - Authenticated (Subscriber+) Arbitrary File Upload
• Backend Designer <= 1.3 - Authenticated (Admin+) Stored Cross-Site Scripting
• Smarty for WordPress <= 3.1.35 - Authenticated (Administrator+) Stored Cross-Site Scripting
• Last Viewed Posts by WPBeginner <= 1.0.1 - Unauthenticated Sensitive Information Exposure
• 12 Step Meeting List <= 3.14.24 - Authenticated (Contributor+) Server-Side Request Forgery
• Swatchly – WooCommerce Variation Swatches for Products <= 1.2.0 - Cross-Site Request Forgery via plugin_activation
• WooDiscuz – WooCommerce Comments <= 2.2.9 - Authenticated (Administrator+) Stored Cross-Site Scripting
• Emu2 <= 0.83b - Reflected Cross-Site Scripting
• Gallery Lightbox <= 1.0.0.39 - Authenticated (Author+) Stored Cross-Site Scripting
• 6Storage Rentals <= 2.19.4 - Missing Authorization
• Live Composer <= 2.1.19 - Authenticated (Contributor+) Stored Cross-Site Scripting via dslc_module_projects_output Shortcode
• Register IPs <= 1.8.0 - Unauthenticated Stored Cross-Site Scripting
• Fluent Forms – Customizable Contact Forms, Survey, Quiz, & Conversational Form Builder <= 6.2.14 - Missing Authorization
• Custom Field Suite <= 2.6.4 - Authenticated (Admin+) Stored Cross-Site Scripting
• MailerLite Signup Forms < 1.4.4 - Unauthenticated SQL Injection
• Woocommerce Customers Manager < 26.6 - Reflected Cross-Site Scripting
• WP Magazine Modules Lite <= 1.1.2 - Authenticated (Contributor+) Local File Inclusion
• Booking Calendar - Clockwork SMS <= 1.0.5 - Reflected Cross-Site Scripting
• Telegram Bot & Channel <= 3.6.2 - Authenticated (Administrator+) Stored Cross-Site Scripting
• Kindeditor For WordPress < 1.4 - Reflected Cross-Site Scripting
• WooCommerce Product Filters 2.0.0 - 2.0.5 - Unauthenticated PHP Object Injection
• MailPoet <= 5.5.1 - Authenticated (Administrator+) Stored Cross-Site Scripting
• Distance Based Shipping Calculator <= 2.0.21 - Reflected Cross-Site Scripting
• YANewsflash <= 1.0.3 - Cross-Site Request Forgery to Stored Cross-Site Scripting
• OSM – OpenStreetMap <= 6.1.13 - Authenticated (Contributor+) Stored Cross-Site Scripting
• WSM Downloader <- 1.4.0 - Domain Bypass
• MarketKing — Ultimate WooCommerce Multivendor Marketplace Solution <= 2.0.00 - Missing Authorization
• WpStream – Live Streaming, Video on Demand, Pay Per View <= 4.4.10 - Cross-Site Request Forgery via wpstream_settings
• Endless Posts Navigation <= 2.2.7 - Cross-Site Request Forgery
• Invico - WordPress Consulting Business Theme <= 1.9 - Reflected Cross-Site Scripting
• ElasticPress <= 5.3.4 - Unauthenticated Information Exposure
• Five Minute Webshop <= 1.3.2 - Authenticated (Admin+) SQL Injection via orderby
• LadiApp <= 4.4 - Cross-Site Request Forgery via save_config()
• Funnel Builder for WordPress by FunnelKit <= 2.14.3 - Authenticated(Administrator+) SQL Injection
• Quantic Social Image Hover <= 1.0.8 - Cross-Site Request Forgery to Settings Update
• Easy Drag And drop All Import : WP Ultimate CSV Importer <= 5.6 - Cross-Site Request Forgery
• VideoWhisper Site Manager for ChatGPT, Claude, Codex, Grok <= 1.2.10 - Missing Authorization
• Zephyr Project Manager <= 3.3.101 - Reflected Cross-Site Scripting
• NEX-Forms - Ultimate Form Builder <= 8.4.3 - Authenticated Stored Cross-Site Scripting via Form Name
• Simpel Reserveren 3 <= 3.5.2 - Reflected Cross-Site Scripting
• Post Grid Gutenberg Blocks and WordPress Blog Plugin – PostX <= 4.0.4 - Authenticated (Contributor+) Stored Cross=Site Scripting
• Calculation for contact form 7 <= 1.0 - Unauthenticated Stored Cross-Site Scripting
• Photo Gallery by Ays <= 5.1.3 - Reflected Cross-Site Scripting via ays_gpg_settings_tab
• NextGEN Gallery <= 2.2.44 - Cross-Site Scripting via image alt and title text
• Global Body Mass Index Calculator <= 1.2 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode Attributes
• TemplatesNext ToolKit <= 3.2.9 - Authenticated (Contributor+) Stored Cross-Site Scripting
• Quttera Web Malware Scanner <= 3.5.1.41 - Authenticated (Administrator+) Server-Side Request Forgery
• Insert Pages <= 3.6.1 - Contributor+ Arbitrary Posts/Pages Access
• Powerplay Gallery <= 3.3 - SQL Injection
• UserPro <= 5.1.1 - Missing Authorization via multiple functions
• BuddyPress Activity Shortcode <= 1.1.8 - Authenticated (Contributor+) Stored Cross-Site Scripting
• SEOPress – On-site SEO <= 7.2 - Authenticated (Admin+) Stored Cross-Site Scripting
• WPJobBoard <= 5.6.4 - Reflected Cross-Site Scripting & Cross-Frame Scripting
• Drop Shadow Boxes <= 1.7.10 - Authenticated (Contributor+) Stored Cross-Site Scripting
• ChatBot <= 4.7.8 - Authenticated (Administrator+) SQL Injection